Package filter

Class RequestHeadersValidationFilter

java.lang.Object
filter.RequestHeadersValidationFilter
All Implemented Interfaces:
javax.servlet.Filter
public class RequestHeadersValidationFilter extends Object implements javax.servlet.Filter
This filter validates Http request headers for security purpose. Filter checks Origin, Referer, Content type and Ajax headers for preventing attacks.
Author:
TAMIL MUGHILAN

  • Field Summary

    Fields
    Modifier and Type
    Field
    Description
    private static final String
    AJAX_HEADER
     
    private static final String
    AJAX_HEADER_VALUE
     
    private static final List<String>
    ALLOWED_ORIGINS
     

  • Constructor Summary

    Constructors
    Constructor
    Description
    RequestHeadersValidationFilter()
     

  • Method Summary

    Modifier and Type
    Method
    Description
    void
    destroy()
    Cleans up resources when filter is destroyed.
    void
    doFilter(javax.servlet.ServletRequest request, javax.servlet.ServletResponse response, javax.servlet.FilterChain chain)
    Processes requests to validate HTTP headers.
    void
    init(javax.servlet.FilterConfig filterConfig)
    Initializes the filter when application starts.
    private boolean
    isAjaxRequest(javax.servlet.http.HttpServletRequest req)
    Checks if request is an AJAX request.
    private boolean
    isOpenPath(String path)
    Checks if the path is allowed without validation.
    private boolean
    isStaticResource(String path)
     
    private boolean
    validateAjaxHeaders(javax.servlet.http.HttpServletRequest req, javax.servlet.http.HttpServletResponse res)
     
    private boolean
    validateContentType(javax.servlet.http.HttpServletRequest req, javax.servlet.http.HttpServletResponse res)
    Validates the content type in the headers.
    private boolean
    validateOrigin(javax.servlet.http.HttpServletRequest req, javax.servlet.http.HttpServletResponse res)
    Validates Origin and Referer headers with the allowed origins.

    Methods inherited from class java.lang.Object

    clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

  • Field Details

  • Constructor Details

    • RequestHeadersValidationFilter

      public RequestHeadersValidationFilter()

  • Method Details

    • doFilter

      public void doFilter(javax.servlet.ServletRequest request, javax.servlet.ServletResponse response, javax.servlet.FilterChain chain) throws IOException, javax.servlet.ServletException
      Processes requests to validate HTTP headers. Blocks requests with invalid origins or headers.
      Specified by:
      doFilter in interface javax.servlet.Filter
      Parameters:
      request - the servlet request
      response - the servlet response
      chain - the filter chain
      Throws:
      IOException - if an I/O error occurs
      javax.servlet.ServletException - if a servlet error occurs

    • isOpenPath

      private boolean isOpenPath(String path)
      Checks if the path is allowed without validation.
      Parameters:
      path - the request path
      Returns:
      true if it's an open path, false otherwise

    • isStaticResource

      private boolean isStaticResource(String path)

    • validateOrigin

      private boolean validateOrigin(javax.servlet.http.HttpServletRequest req, javax.servlet.http.HttpServletResponse res) throws IOException
      Validates Origin and Referer headers with the allowed origins.
      Parameters:
      req - the HTTP request
      res - the HTTP response
      Returns:
      true if headers are valid, false otherwise
      Throws:
      IOException - if response writing fails

    • isAjaxRequest

      private boolean isAjaxRequest(javax.servlet.http.HttpServletRequest req)
      Checks if request is an AJAX request.
      Parameters:
      req - the HTTP request
      Returns:
      true if it's an AJAX request, false otherwise

    • validateAjaxHeaders

      private boolean validateAjaxHeaders(javax.servlet.http.HttpServletRequest req, javax.servlet.http.HttpServletResponse res) throws IOException
      Throws:
      IOException

    • validateContentType

      private boolean validateContentType(javax.servlet.http.HttpServletRequest req, javax.servlet.http.HttpServletResponse res) throws IOException
      Validates the content type in the headers.
      Parameters:
      req -
      res -
      Returns:
      Throws:
      IOException

    • init

      public void init(javax.servlet.FilterConfig filterConfig)
      Initializes the filter when application starts.
      Specified by:
      init in interface javax.servlet.Filter
      Parameters:
      filterConfig - the filter configuration

    • destroy

      public void destroy()
      Cleans up resources when filter is destroyed.
      Specified by:
      destroy in interface javax.servlet.Filter