[jira] [Commented] (SHIRO-409) Need a nossl to match the ssl filter

["Kamal Sharif (JIRA)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/SHIRO-409?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13552360#comment-13552360 ] 

Kamal Sharif commented on SHIRO-409:
------------------------------------

Hi Les;
I am security 'freak' in a sense too and would never want that breach except there are many scenarios where 'nothing major' can happen if one session gets hijacked. For example, I have a news web site where users are allowed to comment only after they identify themselves. I do care about their password be transported over ssl, but after a successful login, I would not want the whole giant site served over ssl as it is not an issue.
Gmail, for example processe login over ssl, but the regular email application is not ssl'ed.

I literally copied the SslFilter.java from the source and modified it a bit(given bellow) and applied in my ini file. the site now does what I want. I love shiro for that reason, I was able to tap into the framework in less than a day! I have been fooling around with spring security and the container managed security(with filters) and no success in the past few months. I love what you do. Kudos. What a great framework.

//this is the ini file updaed 

[filters]
myFilter = org.meri.simpleshirosecuredapplication.filter.NoSslFilter
myFilter.port = 8080 

[urls]
# force ssl for login page 
/simpleshirosecuredapplication/account/login.jsp=ssl[8443], authc

# only users with some roles are allowed to use role-specific pages 
/simpleshirosecuredapplication/repairmen/**=myFilter,authc, roles[repairman]
/simpleshirosecuredapplication/sales/**=myFilter,authc, roles[sales]
/simpleshirosecuredapplication/scientists/**=myFilter,authc, roles[scientist]
/simpleshirosecuredapplication/adminarea/**=myFilter,authc, roles[Administrator]

# enable authc filter for all application pages
/simpleshirosecuredapplication/**=myFilter,authc


//and the NoSslFilter which is the origonal SslFilter with very minor changes

public class NoSslFilter extends PortFilter {

    public static final int DEFAULT_HTTPS_PORT = 443;
    public static final String HTTPS_SCHEME = "https";

    public NoSslFilter() {
        setPort(DEFAULT_HTTPS_PORT);
    }

    @Override
    protected String getScheme(String requestScheme, int port) {
        if (port == super.getPort()) {
            return PortFilter.HTTP_SCHEME;
        } else {
            return HTTPS_SCHEME;
        }
    }

    /**
     * Retains the parent method's port-matching behavior but additionally guarantees that the
     *{@code ServletRequest.}{@link javax.servlet.ServletRequest#isSecure() isSecure()}.  If the port does not match or
     * the request is not secure, access is denied.
     *
     * @param request     the incoming {@code ServletRequest}
     * @param response    the outgoing {@code ServletResponse} - ignored in this implementation
     * @param mappedValue the filter-specific config value mapped to this filter in the URL rules mappings - ignored by this implementation.
     * @return {@code true} if the request is received on an expected SSL port and the
     * {@code request.}{@link javax.servlet.ServletRequest#isSecure() isSecure()}, {@code false} otherwise.
     * @throws Exception if the call to {@code super.isAccessAllowed} throws an exception.
     * @since 1.2
     */
    @Override
    protected boolean isAccessAllowed(ServletRequest request, ServletResponse response, Object mappedValue) throws Exception {
    	
        boolean val= super.isAccessAllowed(request, response, mappedValue) && (!request.isSecure());
        return val;
        
    }
}
                
> Need a nossl to match the ssl filter
> ------------------------------------
>
>                 Key: SHIRO-409
>                 URL: https://issues.apache.org/jira/browse/SHIRO-409
>             Project: Shiro
>          Issue Type: New Feature
>          Components: Authentication (log-in)
>    Affects Versions: 1.2.1
>         Environment: All
>            Reporter: Kamal Sharif
>            Priority: Critical
>              Labels: features
>
> One great-but not seemingly too difficult- feature would be a nossl filter to match the ssl filter. In my website, I only want the login process to be handled over https, but using ssl filter, the site stays in https since all of the links on those pages will stay relative to the https url.
> It would be great if a nossl filter exisited that one could define and would switch the port for the urls defined.

--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators
For more information on JIRA, see: http://www.atlassian.com/software/jira