com.liferay.portletmvc4spring.security

Class SpringSecurityPortletFilter

java.lang.Object

com.liferay.portletmvc4spring.security.SpringSecurityPortletFilter

All Implemented Interfaces:

javax.portlet.filter.ActionFilter, javax.portlet.filter.PortletFilter, javax.portlet.filter.RenderFilter, javax.portlet.filter.ResourceFilter

public class SpringSecurityPortletFilter
extends java.lang.Object
implements javax.portlet.filter.ActionFilter, javax.portlet.filter.RenderFilter, javax.portlet.filter.ResourceFilter

In order to enable CSRF protection, it is necessary to register this class in the WEB-INF/portlet.xml descriptor. For example:

 
 <portlet>
    <filter>
        <filter-name>SpringSecurityPortletFilter</filter-name>
        <filter-class>com.liferay.portletmvc4spring.security.SpringSecurityPortletFilter</filter-class>
        <lifecycle>ACTION_PHASE</lifecycle>
        <lifecycle>RENDER_PHASE</lifecycle>
        <lifecycle>RESOURCE_PHASE</lifecycle>
    </filter>
    <filter-mapping>
        <filter-name>SpringSecurityPortletFilter</filter-name>
        <portlet-name>portlet1</portlet-name>
    </filter-mapping>
 </portlet>
 
 

It is also necessary to specify SpringSecurityPortletConfigurer in a component-scan or register it in the WEB-INF/spring-context/portlet-application-context.xml descriptor. For example:

 
 <bean id="springSecurityPortletConfigurer" class="com.liferay.portletmvc4spring.security.SpringSecurityPortletConfigurer" />
 <bean id="delegatingFilterProxy" class="org.springframework.web.filter.DelegatingFilterProxy">
    <property name="targetBeanName" value="springSecurityFilterChain" />
 </bean>
 
 

Finally, it is necessary to specify the following in the WEB-INF/web.xml descriptor:

 
 <filter>
    <filter-name>delegatingFilterProxy</filter-name>
    <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
 </filter>
 <filter-mapping>
    <filter-name>delegatingFilterProxy</filter-name>
    <url-pattern>/WEB-INF/servlet/view</url-pattern>
    <dispatcher>FORWARD</dispatcher>
    <dispatcher>INCLUDE</dispatcher>
 </filter-mapping>
 
 

Author:

Neil Griffin

Constructor Summary

Constructors

Constructor and Description
SpringSecurityPortletFilter()

Method Summary

Modifier and Type	Method and Description
void	destroy()
void	doFilter(javax.portlet.ActionRequest actionRequest, javax.portlet.ActionResponse actionResponse, javax.portlet.filter.FilterChain portletFilterChain)
void	doFilter(javax.portlet.RenderRequest renderRequest, javax.portlet.RenderResponse renderResponse, javax.portlet.filter.FilterChain filterChain)
void	doFilter(javax.portlet.ResourceRequest resourceRequest, javax.portlet.ResourceResponse resourceResponse, javax.portlet.filter.FilterChain portletFilterChain)
void	init(javax.portlet.filter.FilterConfig filterConfig)
protected void	renderError(ApplicationContext applicationContext, java.util.Locale locale, java.io.Writer writer, java.lang.String messageKey, java.lang.String defaultMessage)
protected void	renderError(java.io.Writer writer, java.lang.String message)

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

SpringSecurityPortletFilter

public SpringSecurityPortletFilter()

Method Detail

destroy

public void destroy()

Specified by:

destroy in interface javax.portlet.filter.PortletFilter

doFilter

public void doFilter(javax.portlet.ActionRequest actionRequest,
                     javax.portlet.ActionResponse actionResponse,
                     javax.portlet.filter.FilterChain portletFilterChain)
              throws java.io.IOException,
                     javax.portlet.PortletException

Specified by:

doFilter in interface javax.portlet.filter.ActionFilter

Throws:

java.io.IOException

javax.portlet.PortletException

doFilter

public void doFilter(javax.portlet.ResourceRequest resourceRequest,
                     javax.portlet.ResourceResponse resourceResponse,
                     javax.portlet.filter.FilterChain portletFilterChain)
              throws java.io.IOException,
                     javax.portlet.PortletException

Specified by:

doFilter in interface javax.portlet.filter.ResourceFilter

Throws:

java.io.IOException

javax.portlet.PortletException

doFilter

public void doFilter(javax.portlet.RenderRequest renderRequest,
                     javax.portlet.RenderResponse renderResponse,
                     javax.portlet.filter.FilterChain filterChain)
              throws java.io.IOException,
                     javax.portlet.PortletException

Specified by:

doFilter in interface javax.portlet.filter.RenderFilter

Throws:

java.io.IOException

javax.portlet.PortletException

init

public void init(javax.portlet.filter.FilterConfig filterConfig)
          throws javax.portlet.PortletException

Specified by:

init in interface javax.portlet.filter.PortletFilter

Throws:

javax.portlet.PortletException

renderError

protected void renderError(java.io.Writer writer,
                           java.lang.String message)
                    throws java.io.IOException

Throws:

java.io.IOException

renderError

protected void renderError(ApplicationContext applicationContext,
                           java.util.Locale locale,
                           java.io.Writer writer,
                           java.lang.String messageKey,
                           java.lang.String defaultMessage)
                    throws java.io.IOException

Throws:

java.io.IOException