How to enforce license check on each .jsp page on spring mvc webapplication? - spring-mvc

Question

We are developing a web application with Spring MVC and rest based conrollers. we have already implemented Authentication using spring security. Now this product should run with a valid license. This implementation is done and before webapp starts up we have this check to see whether product is licensed or not. If not user can upload license file and they can start use the product.
Once they start using the product, say after few days license might expire (of course, starting of server will catch this, but if there is no server re-start then they can happily use ever after expiry). So I want to have check on each request, whether the product is licensed (just like isAuthenticated()) or not. If not authenticated, i can redirect to License upload page.
Any ideas / pointers are appreciated.
<filter>
<filter-name>springSecurityFilterChain</filter-name>
<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>
<filter-mapping>
<filter-name>springSecurityFilterChain</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
<beans:bean id="mySuccessHandler" class="com.cavirin.security.MySavedRequestAwareAuthenticationSuccessHandler" />
<authentication-manager alias="authenticationManager">
<authentication-provider ref="localAuthenticationProvider" />
</authentication-manager>
<http auto-config="true" use-expressions="true">
<request-cache ref="authenticationRequestCache" />
<form-login login-page="/"
authentication-success-handler-ref="successHandler"
authentication-failure-url="/rest/login/reAuthenticate" />
<intercept-url pattern="/rest/**" access="isAuthenticated()" />
</http>
<beans:bean id="successHandler"
class="com.cavirin.security.MySavedRequestAwareAuthenticationSuccessHandler">
<beans:property name="defaultTargetUrl" value="/rest/login/checkUser" />
</beans:bean>

Answer 1

To check on every request you could just add a filter to your app. But that would be very annoying for users who were half-way through doing something when they get redirected to the license page. It also seems quite inefficient. As an alternative, you could add an AuthenticationProvider which just checks when someone logs in and denies authentication otherwise.