Return HTTP Error 401 Code & Skip Filter Chains

Question

Using a custom Spring Security filter, I\'d like to return an HTTP 401 error code if the HTTP Header doesn\'t contain a particular key-value pair.

Example:

Answer 1

Just do as they say in the upper answer. "so setting the response status code and returning immediately" This is just type:

res.setStatus(HttpServletResponse.SC_UNAUTHORIZED);  
return;

Answer 2

From the API docs for the doFilter method, you can:

• Either invoke the next entity in the chain using the FilterChain object (chain.doFilter()),
• or not pass on the request/response pair to the next entity in the filter chain to block the request processing

so setting the response status code and returning immediately without invoking chain.doFilter is the best option for what you want to achieve here.

Answer 3

I suggest this solution below.

public void doFilter(ServletRequest req, ServletResponse res,
                         FilterChain chain) throws IOException, ServletException {

        HttpServletRequest request = (HttpServletRequest) req;
        final String val = request.getHeader(FOO_TOKEN)

        if (val == null || !val.equals("FOO")) {
            ((HttpServletResponse) response).sendError(HttpServletResponse.SC_UNAUTHORIZED, "The token is not valid.");
        } else {
            chain.doFilter(req, res);
        }
    }

Answer 4

So you can use something like this.

@Override
public void doFilter() {
    if (whiteListOrigins.contains(incomeOrigin)) {
        httpResponse.setHeader("Access-Control-Allow-Origin", incomeOrigin);
        chain.doFilter(request, response);
    } else {
        ((HttpServletResponse) response).sendError(HttpServletResponse.SC_FORBIDDEN, "Not Allowed to Access. Please try with valid Origin.");
    }
}