/*
 * JwtFilter.java
 *
 * Copyright (C) 2017 [ A Legge Up ]
 *
 * This software may be modified and distributed under the terms
 * of the MIT license.  See the LICENSE file for details.
 */

package com.aleggeup.confagrid.filter;

import java.io.IOException;

import javax.servlet.FilterChain;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;

import org.springframework.web.filter.GenericFilterBean;

import io.jsonwebtoken.Claims;
import io.jsonwebtoken.Jwts;
import io.jsonwebtoken.SignatureException;

public class JwtFilter extends GenericFilterBean {

    public static final String ATTRIBUTE_CLAIMS = "claims";
    public static final String BEARER_PREFIX = "Bearer ";
    public static final String HEADER_AUTHORIZATION = "Authorization";
    public static final String SECRET_KEY = "secretkey";

    @Override
    public void doFilter(final ServletRequest request, final ServletResponse response, final FilterChain chain)
            throws IOException, ServletException {

        final HttpServletRequest httpServletRequest = (HttpServletRequest) request;

        final String authHeader = httpServletRequest.getHeader(HEADER_AUTHORIZATION);
        if (authHeader == null || !authHeader.startsWith(BEARER_PREFIX)) {
            throw new ServletException("Missing or invalid Authorization header.");
        }

        final String token = authHeader.substring(BEARER_PREFIX.length());

        try {
            final Claims claims = Jwts.parser().setSigningKey(SECRET_KEY).parseClaimsJws(token).getBody();
            request.setAttribute(ATTRIBUTE_CLAIMS, claims);
        }
        catch (final SignatureException e) {
            throw new ServletException("Invalid token.");
        }

        chain.doFilter(httpServletRequest, response);
    }
}

@@ -340,32 +340,41 @@
 t javax.servlet.
+http.Http
 ServletRequest;%0A
@@ -390,24 +390,33 @@
 vax.servlet.
+http.Http
 ServletRespo
@@ -424,54 +424,137 @@
 se;%0A
+%0A
 import 
-javax.servlet.http.HttpServletRequest;%0A
+org.slf4j.Logger;%0Aimport org.slf4j.LoggerFactory;%0Aimport org.springframework.security.core.context.SecurityContextHolder;
 %0Aimp
@@ -588,33 +588,36 @@
 .filter.
-Generic
+OncePerRequest
 Filter
-Bean
 ;%0A%0Aimpor
@@ -668,17 +668,25 @@
 oken.Jwt
-s
+Exception
 ;%0Aimport
@@ -706,79 +706,195 @@
 ken.
-SignatureException;%0A%0Apublic class JwtFilter extends GenericFilterBean %7B
+Jwts;%0Aimport io.jsonwebtoken.impl.DefaultClaims;%0A%0Apublic class JwtFilter extends OncePerRequestFilter %7B%0A%0A    private static final Logger LOGGER = LoggerFactory.getLogger(JwtFilter.class);
 %0A%0A  
@@ -1157,21 +1157,24 @@
 de%0A    p
-ublic
+rotected
  void do
@@ -1179,23 +1179,35 @@
 doFilter
+Internal
 (final 
+Http
 ServletR
@@ -1228,16 +1228,20 @@
 , final 
+Http
 ServletR
@@ -1302,18 +1302,23 @@
  throws 
-IO
+Servlet
 Exceptio
@@ -1320,23 +1320,18 @@
 eption, 
-Servlet
+IO
 Exceptio
@@ -1339,93 +1339,8 @@
  %7B%0A%0A
-        final HttpServletRequest httpServletRequest = (HttpServletRequest) request;%0A%0A
     
@@ -1369,28 +1369,17 @@
 eader = 
-httpServletR
+r
 equest.g
@@ -1410,16 +1410,114 @@
 ATION);%0A
+        Claims claims = null;%0A        SecurityContextHolder.getContext().setAuthentication(null);%0A
         
@@ -1599,34 +1599,19 @@
     
-throw new ServletException
+LOGGER.info
 (%22Mi
@@ -1652,35 +1652,133 @@
 der.%22);%0A        
-%7D%0A%0A
+    claims = new DefaultClaims().setSubject(%22anonymous%22);%0A        %7D else %7B%0A            try %7B%0A        
         final St
@@ -1836,25 +1836,24 @@
 gth());%0A
-%0A
         
 try %7B%0A  
@@ -1840,38 +1840,32 @@
 ));%0A        
-try %7B%0A
         
     final Cl
@@ -1856,25 +1856,8 @@
     
-    final Claims 
 clai
@@ -1950,53 +1950,111 @@
     
-request.setAttribute(ATTRIBUTE_CLAIMS, claims
+%7D catch(final JwtException e) %7B%0A                LOGGER.warn(%22Unable to get claims from bearer token%22, e
 );%0A 
@@ -2060,18 +2060,16 @@
         
-%7D%0A
         
@@ -2073,99 +2073,173 @@
    c
-atch (final SignatureException e) %7B%0A            throw new ServletException(%22Invalid token.%22
+laims = new DefaultClaims().setSubject(%22anonymous%22);%0A            %7D%0A        %7D%0A%0A        if (claims != null) %7B%0A            request.setAttribute(ATTRIBUTE_CLAIMS, claims
 );%0A 
@@ -2239,33 +2239,32 @@
 ims);%0A        %7D%0A
-%0A
         chain.do
@@ -2274,20 +2274,9 @@
 ter(
-httpServletR
+r
 eque

Use OncePerRequestFilter instead of GenericFilter and drop to anonymous if not authorized