Unable to write a Filter which serves for Login - servlets

Question

I have written a filter and declared it under web.xml as shown below
<?xml version="1.0" encoding="UTF-8"?>
<web-app>
<filter>
<display-name>SessionAuthenticationFilter</display-name>
<filter-name>SessionAuthenticationFilter</filter-name>
<filter-class>com.jsp.auth.SessionAuthenticationFilter</filter-class>
<init-param>
<param-name>skipthis</param-name>
<param-value>01-login.html</param-value>
</init-param>
</filter>
<filter-mapping>
<filter-name>SessionAuthenticationFilter</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
</web-app>
And this is my FILTER File
package com.jsp.auth;
import java.io.IOException;
import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;
public class SessionAuthenticationFilter implements Filter {
private FilterConfig filterConfig = null;
public SessionAuthenticationFilter() {
}
public void destroy() {
}
public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain) throws IOException, ServletException {
HttpServletRequest request = (HttpServletRequest) req;
HttpServletResponse response = (HttpServletResponse) res;
HttpSession session = request.getSession(true);
String loginpageuri = filterConfig.getInitParameter("skipthis");
String requesturi = request.getRequestURI();
System.out.println("The requesturi is"+requesturi);
if(!requesturi.endsWith(loginpageuri))
{
String isloggoed = (String)session.getAttribute("LOGIN_USER");
System.out.println("The isloggoed value is"+isloggoed);
if(isloggoed==null||isloggoed.equals("")||isloggoed.isEmpty())
{
response.sendRedirect("http://xxx.xx.xx:8080/admin/01-login.html");
return ;
}
else
{
chain.doFilter(req, res);
}
}
else
{
chain.doFilter(req, res);
}
}
public void init(FilterConfig filterConfig) {
this.filterConfig = filterConfig;
}
}
These are the logs i am getting in my server console . (Its blocking all the .css .js files also)
The isloggoed value isnull
The requesturi is/AdminE/assets/css/style-metro.css
The isloggoed value isnull
The requesturi is/AdminE/assets/css/style-responsive.css
The isloggoed value isnull
The requesturi is/AdminE/assets/css/themes/default.css
The isloggoed value isnull
Incase if i change the url-pattern to this way in my web.xml
/*.html
I am getting HTTP Status 404 - /AdminE/01-login.html
Could anybody please help me how to resolve this ?

Answer 1

According to the Java Servlet Specification, the url-pattern should be:
A string beginning with a ‘/’ character and ending with a ‘/*’ suffix is used for path mapping.
A string beginning with a ‘*.’ prefix is used as an extension mapping.
The empty string ("") is a special URL pattern that exactly maps to the application's context root, i.e., requests of the form
http://host:port/<contextroot>/. In this case the path info is ’/’ and
the servlet path and context path is empty string ("").
A string containing only the ’/’ character indicates the "default" servlet of the application. In this case the servlet path is the
request URI minus the context path and the path info is null.
All other strings are used for exact matches only.
So according to this, the pattern /*.html will be interpreted literally and the * will not act as a wildcard. Try with *.html instead (no leading slash).

Answer 2

If I correctly understand your question, you are trying to use a filter as a login service protecting a whole application. If you do not want to re-invent the wheel, you could also have a look to the excellent shiro or Spring security.
If you prefer to roll your own, you should give your filter more parameters :
the address of the login page (it must let it pass through and redirects to it when not previously logged) - ok you have it
a list of patterns to ignore because the servlet specification (see David Levesque's answer) is not versatile enough - alternatively you can use a positive logic giving a list of patterns to filter. It will be much simpler to use simple extensions (.js, .css, .gif, ...) than full patterns because then, String.endsWith is enough.
I also advise you to do all the parameters management in Filter.init method instead of repeating it for every request. Typically in your code, the attribute should be String loginpageuri, and init method should be :
public void init(FilterConfig filterConfig) {
loginpageuri = filterConfig.getInitParameter("skipthis");
}