Added Jwttoken as header while calling Identity-API #274
Conversation
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the You can disable this status message by setting the WalkthroughThe changes refactor JWT token extraction and HTTP header construction in Changes
Sequence Diagram(s)sequenceDiagram
participant Client
participant HttpUtils
participant RestTemplateUtil
participant CookieUtil
participant UserAgentContext
Client->>HttpUtils: Initiate HTTP request
HttpUtils->>RestTemplateUtil: getJwttokenFromHeaders(headers)
RestTemplateUtil->>CookieUtil: getJwtTokenFromCookie(request)
RestTemplateUtil->>UserAgentContext: getUserAgent() (if needed)
RestTemplateUtil-->>HttpUtils: Headers updated with JWT and User-Agent
HttpUtils->>Client: Proceed with HTTP request using updated headers
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~15 minutes Possibly related PRs
Poem
✨ Finishing Touches🧪 Generate unit tests
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
|
@coderabbitai review |
✅ Actions performedReview triggered.
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
♻️ Duplicate comments (2)
src/main/java/com/iemr/common/utils/http/HttpUtils.java (2)
78-78: Same header duplication issue as in get() method.The same header duplication issue exists here with the instance-level
headersfield.
105-105: Same header duplication issue as in get() methods.The same header duplication issue exists here with the instance-level
headersfield.
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (2)
src/main/java/com/iemr/common/utils/RestTemplateUtil.java(1 hunks)src/main/java/com/iemr/common/utils/http/HttpUtils.java(5 hunks)
🧰 Additional context used
🧠 Learnings (6)
📓 Common learnings
Learnt from: vishwab1
PR: PSMRI/Common-API#214
File: src/main/java/com/iemr/common/service/recaptcha/CaptchaValidationService.java:28-31
Timestamp: 2025-06-10T10:21:53.819Z
Learning: The user vishwab1 expects CAPTCHA tokens to be optionally sent in request bodies during implementation, suggesting a gradual rollout approach where clients may or may not include CAPTCHA tokens initially.
Learnt from: vishwab1
PR: PSMRI/Common-API#214
File: src/main/java/com/iemr/common/service/recaptcha/CaptchaValidationService.java:28-31
Timestamp: 2025-06-10T10:53:24.380Z
Learning: The user vishwab1 confirmed that their CAPTCHA implementation handles null token checking at the controller level before calling the service, which mitigates the direct security vulnerability of the service returning true for null tokens.
Learnt from: sandipkarmakar3
PR: PSMRI/Common-API#162
File: src/main/java/com/iemr/common/utils/CookieUtil.java:52-66
Timestamp: 2025-02-21T07:43:03.828Z
Learning: In the Common-API project's CookieUtil class, the current implementation of addJwtTokenToCookie using both response.addCookie() and manual Set-Cookie header has been tested and confirmed to work as required for their use case. URL encoding of the JWT token is not necessary.
Learnt from: sandipkarmakar3
PR: PSMRI/Common-API#162
File: src/main/java/com/iemr/common/utils/CookieUtil.java:40-47
Timestamp: 2025-02-21T07:42:36.497Z
Learning: In the Common-API project's CookieUtil class, JWT cookies are configured with SameSite=None to support cross-origin requests, which is required for the project's CORS functionality.
Learnt from: indraniBan
PR: PSMRI/Common-API#138
File: src/main/java/com/iemr/common/utils/JwtAuthenticationUtil.java:0-0
Timestamp: 2025-02-03T12:42:38.278Z
Learning: In the JwtAuthenticationUtil class, catching a generic Exception in the validateUserIdAndJwtToken method is acceptable as per the team's preference.
Learnt from: indraniBan
PR: PSMRI/Common-API#138
File: src/main/environment/common_uat.properties:0-0
Timestamp: 2025-02-03T12:41:59.244Z
Learning: In the Common-API project, JWT secret configuration should use environment variables (e.g., `jwt.secret=env.JWT_SECRET_KEY@`) across all environments for better security.
📚 Learning: in the common-api project's cookieutil class, the current implementation of addjwttokentocookie usin...
Learnt from: sandipkarmakar3
PR: PSMRI/Common-API#162
File: src/main/java/com/iemr/common/utils/CookieUtil.java:52-66
Timestamp: 2025-02-21T07:43:03.828Z
Learning: In the Common-API project's CookieUtil class, the current implementation of addJwtTokenToCookie using both response.addCookie() and manual Set-Cookie header has been tested and confirmed to work as required for their use case. URL encoding of the JWT token is not necessary.
Applied to files:
src/main/java/com/iemr/common/utils/RestTemplateUtil.javasrc/main/java/com/iemr/common/utils/http/HttpUtils.java
📚 Learning: in the common-api project's cookieutil class, jwt cookies are configured with samesite=none to suppo...
Learnt from: sandipkarmakar3
PR: PSMRI/Common-API#162
File: src/main/java/com/iemr/common/utils/CookieUtil.java:40-47
Timestamp: 2025-02-21T07:42:36.497Z
Learning: In the Common-API project's CookieUtil class, JWT cookies are configured with SameSite=None to support cross-origin requests, which is required for the project's CORS functionality.
Applied to files:
src/main/java/com/iemr/common/utils/RestTemplateUtil.javasrc/main/java/com/iemr/common/utils/http/HttpUtils.java
📚 Learning: in this codebase, for java spring boot api controllers like `abdmfacilitycontroller.java`, it's a co...
Learnt from: helenKaryamsetty
PR: PSMRI/Common-API#123
File: src/main/java/com/iemr/common/controller/abdmfacility/AbdmFacilityController.java:31-31
Timestamp: 2024-12-07T19:32:42.660Z
Learning: In this codebase, for Java Spring Boot API controllers like `AbdmFacilityController.java`, it's a common pattern to include the `Authorization` parameter in method signatures, even if it's not used in the implementation, to maintain consistency across APIs.
Applied to files:
src/main/java/com/iemr/common/utils/RestTemplateUtil.javasrc/main/java/com/iemr/common/utils/http/HttpUtils.java
📚 Learning: in the common-api project, jwt secret configuration should use environment variables (e.g., `jwt.sec...
Learnt from: indraniBan
PR: PSMRI/Common-API#138
File: src/main/environment/common_uat.properties:0-0
Timestamp: 2025-02-03T12:41:59.244Z
Learning: In the Common-API project, JWT secret configuration should use environment variables (e.g., `jwt.secret=env.JWT_SECRET_KEY@`) across all environments for better security.
Applied to files:
src/main/java/com/iemr/common/utils/RestTemplateUtil.java
📚 Learning: in the jwtauthenticationutil class, catching a generic exception in the validateuseridandjwttoken me...
Learnt from: indraniBan
PR: PSMRI/Common-API#138
File: src/main/java/com/iemr/common/utils/JwtAuthenticationUtil.java:0-0
Timestamp: 2025-02-03T12:42:38.278Z
Learning: In the JwtAuthenticationUtil class, catching a generic Exception in the validateUserIdAndJwtToken method is acceptable as per the team's preference.
Applied to files:
src/main/java/com/iemr/common/utils/RestTemplateUtil.java
🧬 Code Graph Analysis (1)
src/main/java/com/iemr/common/utils/http/HttpUtils.java (1)
src/main/java/com/iemr/common/utils/RestTemplateUtil.java (1)
RestTemplateUtil(17-81)
🔇 Additional comments (6)
src/main/java/com/iemr/common/utils/RestTemplateUtil.java (3)
13-13: LGTM! Import added for Constants usage.The import for
Constantsis correctly added to support the JWT token header references used throughout the class.
50-59: LGTM! JWT token extraction properly modularized.The extraction of JWT token logic into a separate method improves code reusability and maintainability. Error handling with logging is appropriate.
20-48: No inconsistency in JWT token header formats
Constants.JWT_TOKENis defined as"Jwttoken", so both"Jwttoken=" + jwtTokenFromCookieand
Constants.JWT_TOKEN + "=" + jwtTokenFromCookieproduce identical header names. You can safely ignore this concern. (Optionally, for consistency, replace the hardcoded
"Jwttoken"on line 44 withConstants.JWT_TOKEN.)Likely an incorrect or invalid review comment.
src/main/java/com/iemr/common/utils/http/HttpUtils.java (3)
43-43: LGTM! Import correctly added for RestTemplateUtil usage.The import statement is properly added to support the new JWT token handling functionality.
95-95: LGTM! JWT token integration properly implemented.The JWT token handling is correctly integrated using a local
HttpHeadersobject, avoiding the duplication issue present in other methods.
119-119: LGTM! JWT token integration properly implemented.Similar to the get() method with headers parameter, this correctly uses a local
HttpHeadersobject to avoid duplication issues.
|
|
||
| public String get(String uri) { | ||
| String body; | ||
| RestTemplateUtil.getJwttokenFromHeaders(headers); |
There was a problem hiding this comment.
Potential header duplication in instance-level headers.
The getJwttokenFromHeaders(headers) call on Line 68 uses the instance-level headers field that already contains "Content-Type: application/json" (set in constructor). This will cause duplication since getJwttokenFromHeaders also adds Content-Type header.
public String get(String uri) {
String body;
+ HttpHeaders requestHeaders = new HttpHeaders();
+ requestHeaders.add("Content-Type", "application/json");
- RestTemplateUtil.getJwttokenFromHeaders(headers);
- HttpEntity<String> requestEntity = new HttpEntity<String>("", headers);
+ RestTemplateUtil.getJwttokenFromHeaders(requestHeaders);
+ HttpEntity<String> requestEntity = new HttpEntity<String>("", requestHeaders);
ResponseEntity<String> responseEntity = rest.exchange(uri, HttpMethod.GET, requestEntity, String.class);📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| RestTemplateUtil.getJwttokenFromHeaders(headers); | |
| public String get(String uri) { | |
| String body; | |
| + HttpHeaders requestHeaders = new HttpHeaders(); | |
| + requestHeaders.add("Content-Type", "application/json"); | |
| - RestTemplateUtil.getJwttokenFromHeaders(headers); | |
| - HttpEntity<String> requestEntity = new HttpEntity<String>("", headers); | |
| + RestTemplateUtil.getJwttokenFromHeaders(requestHeaders); | |
| + HttpEntity<String> requestEntity = new HttpEntity<String>("", requestHeaders); | |
| ResponseEntity<String> responseEntity = rest.exchange(uri, HttpMethod.GET, requestEntity, String.class); |
🤖 Prompt for AI Agents
In src/main/java/com/iemr/common/utils/http/HttpUtils.java at line 68, the call
to getJwttokenFromHeaders(headers) uses the instance-level headers which already
include "Content-Type: application/json" set in the constructor, causing
duplicate Content-Type headers. To fix this, create a new HttpHeaders object or
clone the existing headers without the Content-Type before passing it to
getJwttokenFromHeaders, ensuring no duplicate Content-Type headers are added.
| public static void getJwttokenFromHeaders(HttpHeaders headers) { | ||
| ServletRequestAttributes servletRequestAttributes = ((ServletRequestAttributes) RequestContextHolder | ||
| .getRequestAttributes()); | ||
| if (servletRequestAttributes == null) { | ||
| return; | ||
| } | ||
| HttpServletRequest requestHeader = servletRequestAttributes.getRequest(); | ||
| String jwtTokenFromCookie = extractJwttoken(requestHeader); | ||
| headers.add(HttpHeaders.CONTENT_TYPE, MediaType.APPLICATION_JSON_VALUE + ";charset=utf-8"); | ||
| if (null != UserAgentContext.getUserAgent()) { | ||
| headers.add(HttpHeaders.USER_AGENT, UserAgentContext.getUserAgent()); | ||
| } | ||
| if (null != jwtTokenFromCookie) { | ||
| headers.add(HttpHeaders.COOKIE, Constants.JWT_TOKEN + "=" + jwtTokenFromCookie); | ||
| } else if (null != requestHeader.getHeader(Constants.JWT_TOKEN)) { | ||
| headers.add(Constants.JWT_TOKEN, requestHeader.getHeader(Constants.JWT_TOKEN)); | ||
| } | ||
|
|
||
| } |
There was a problem hiding this comment.
🛠️ Refactor suggestion
Potential header duplication issue in new utility method.
The getJwttokenFromHeaders method adds headers to the provided HttpHeaders object without checking if they already exist. This could cause header duplication if the method is called multiple times or if headers are already present.
Consider checking for existing headers before adding them or document that this method should only be called on empty HttpHeaders objects.
public static void getJwttokenFromHeaders(HttpHeaders headers) {
ServletRequestAttributes servletRequestAttributes = ((ServletRequestAttributes) RequestContextHolder
.getRequestAttributes());
if (servletRequestAttributes == null) {
return;
}
HttpServletRequest requestHeader = servletRequestAttributes.getRequest();
String jwtTokenFromCookie = extractJwttoken(requestHeader);
- headers.add(HttpHeaders.CONTENT_TYPE, MediaType.APPLICATION_JSON_VALUE + ";charset=utf-8");
+ if (!headers.containsKey(HttpHeaders.CONTENT_TYPE)) {
+ headers.add(HttpHeaders.CONTENT_TYPE, MediaType.APPLICATION_JSON_VALUE + ";charset=utf-8");
+ }
if (null != UserAgentContext.getUserAgent()) {
- headers.add(HttpHeaders.USER_AGENT, UserAgentContext.getUserAgent());
+ if (!headers.containsKey(HttpHeaders.USER_AGENT)) {
+ headers.add(HttpHeaders.USER_AGENT, UserAgentContext.getUserAgent());
+ }
}
if (null != jwtTokenFromCookie) {
headers.add(HttpHeaders.COOKIE, Constants.JWT_TOKEN + "=" + jwtTokenFromCookie);
} else if (null != requestHeader.getHeader(Constants.JWT_TOKEN)) {
headers.add(Constants.JWT_TOKEN, requestHeader.getHeader(Constants.JWT_TOKEN));
}
}📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| public static void getJwttokenFromHeaders(HttpHeaders headers) { | |
| ServletRequestAttributes servletRequestAttributes = ((ServletRequestAttributes) RequestContextHolder | |
| .getRequestAttributes()); | |
| if (servletRequestAttributes == null) { | |
| return; | |
| } | |
| HttpServletRequest requestHeader = servletRequestAttributes.getRequest(); | |
| String jwtTokenFromCookie = extractJwttoken(requestHeader); | |
| headers.add(HttpHeaders.CONTENT_TYPE, MediaType.APPLICATION_JSON_VALUE + ";charset=utf-8"); | |
| if (null != UserAgentContext.getUserAgent()) { | |
| headers.add(HttpHeaders.USER_AGENT, UserAgentContext.getUserAgent()); | |
| } | |
| if (null != jwtTokenFromCookie) { | |
| headers.add(HttpHeaders.COOKIE, Constants.JWT_TOKEN + "=" + jwtTokenFromCookie); | |
| } else if (null != requestHeader.getHeader(Constants.JWT_TOKEN)) { | |
| headers.add(Constants.JWT_TOKEN, requestHeader.getHeader(Constants.JWT_TOKEN)); | |
| } | |
| } | |
| public static void getJwttokenFromHeaders(HttpHeaders headers) { | |
| ServletRequestAttributes servletRequestAttributes = ((ServletRequestAttributes) RequestContextHolder | |
| .getRequestAttributes()); | |
| if (servletRequestAttributes == null) { | |
| return; | |
| } | |
| HttpServletRequest requestHeader = servletRequestAttributes.getRequest(); | |
| String jwtTokenFromCookie = extractJwttoken(requestHeader); | |
| if (!headers.containsKey(HttpHeaders.CONTENT_TYPE)) { | |
| headers.add(HttpHeaders.CONTENT_TYPE, MediaType.APPLICATION_JSON_VALUE + ";charset=utf-8"); | |
| } | |
| if (null != UserAgentContext.getUserAgent()) { | |
| if (!headers.containsKey(HttpHeaders.USER_AGENT)) { | |
| headers.add(HttpHeaders.USER_AGENT, UserAgentContext.getUserAgent()); | |
| } | |
| } | |
| if (null != jwtTokenFromCookie) { | |
| headers.add(HttpHeaders.COOKIE, Constants.JWT_TOKEN + "=" + jwtTokenFromCookie); | |
| } else if (null != requestHeader.getHeader(Constants.JWT_TOKEN)) { | |
| headers.add(Constants.JWT_TOKEN, requestHeader.getHeader(Constants.JWT_TOKEN)); | |
| } | |
| } |
🤖 Prompt for AI Agents
In src/main/java/com/iemr/common/utils/RestTemplateUtil.java between lines 61
and 79, the getJwttokenFromHeaders method adds headers to the HttpHeaders object
without checking for existing headers, which may cause duplication. To fix this,
before adding each header, check if the header is already present in the
HttpHeaders object and only add it if it is absent. Alternatively, document
clearly that this method should only be called on empty HttpHeaders instances to
avoid duplication.
|
📋 Description
JIRA ID: AMM-1187
Added Jwttoken in Header while calling Identity-API.
Previously we don't have any token validation in Identity so we have implemented Jwttoken session management in Identity-API
✅ Type of Change
ℹ️ Additional Information
Please describe how the changes were tested, and include any relevant screenshots, logs, or other information that provides additional context.
Summary by CodeRabbit
New Features
Refactor
Chores