JAX-RS 2.0通过@NameBinding注释过滤参数

Question

我创建了一些JAX-RS 2.0资源(使用在Servlet容器中运行的Jeresey 2.4)和一个处理身份验证和授权的过滤器,可以通过@NameBinding注释有选择地应用.一切都很好.

我希望能够在此注释上定义一些参数(特别是访问每个方法/资源所需的安全权限),这些参数在运行时可用于过滤器以改变此行为.

我注意到拦截器可以通过javax.ws.rs.ext.InterceptorContext.getAnnotations()执行此操作,但是javax.ws.rs.container.ContainerRequestContext中没有等效的过滤器.有什么想法可以实现吗？我希望能够做类似以下的事情:

@Target({TYPE, METHOD})
@Retention(value = RetentionPolicy.RUNTIME)
@NameBinding
public @interface Secured {
    String[] requiredPermissions() default {};
}

@Secured
@Priority(Priorities.AUTHENTICATION)
public class SecurityRequestFilter implements ContainerRequestFilter {
    @Override
    public void filter(ContainerRequestContext containerRequestContext) throws IOException {
        // extract credentials, verify them and check that the user has required permissions, aborting if not
    }
}

@Path("/userConfiguration/")
public class UserConfigurationResource {
    @GET
    @Produces(MediaType.APPLICATION_XML)
    @Secured(requiredPermissions = {"configuration-permission"})
    public Response getConfig(@Context HttpServletRequest httpServletRequest) {
        // produce a response
    }
}

Answer 1

对于非供应商特定的解决方案,从JAX-RS 2.0开始,您可以使用ResourceInfo:

@Secured
@Priority(Priorities.AUTHENTICATION)
public class SecurityRequestFilter implements ContainerRequestFilter {

    @Context
    private ResourceInfo resourceInfo;

    @Override
    public void filter(ContainerRequestContext requestContext) throws IOException {

        Method method = resourceInfo.getResourceMethod();

        if (method != null) {
            Secured secured = method.getAnnotation(Secured.class);
            ...
        }
    }
}

Answer 2

您可以从UriInfo获取此信息,尤其是它(特定于Jersey)的ExtendedUriInfo子接口.要获取实例,请调用ContainerRequestContext#getUriInfo()并强制转换它

final ExtendedUriInfo extendendUriInfo = (ExtendedUriInfo) containerRequestContext.getUriInfo();

或者将其注入您的过滤器:

@Inject
private ExtendedUriInfo extendendUriInfo;

然后

extendedUriInfo
    .getMatchedResourceMethod()
    .getInvocable()
    .getHandlingMethod().getAnnotation(Secured.class);

在第二种方法中,您可以实现DynamicFeature并仅将过滤器分配给特定的资源方法(即,如果过滤器的配置更复杂,过滤器仅适用于几种方法,并且您希望减少开销,... ).看看RolesAllowedDynamicFeature的实现,它增加了对Jersey中资源方法的安全注释的支持.