public class

SecurityContextHolderAwareRequestWrapper

extends HttpServletRequestWrapper
java.lang.Object
   ↳ javax.servlet.ServletRequestWrapper
     ↳ javax.servlet.http.HttpServletRequestWrapper
       ↳ org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestWrapper

Class Overview

A Spring Security-aware HttpServletRequestWrapper, which uses the SecurityContext-defined Authentication object to implement the servlet API security methods isUserInRole(String) and getRemoteUser().

See Also

Summary

[Expand]
Inherited Constants
From interface javax.servlet.http.HttpServletRequest
Public Constructors
SecurityContextHolderAwareRequestWrapper(HttpServletRequest request, String rolePrefix)
Public Methods
String getRemoteUser()
Returns the principal's name, as obtained from the SecurityContextHolder.
Principal getUserPrincipal()
Returns the Authentication (which is a subclass of Principal), or null if unavailable.
boolean isUserInRole(String role)
Simple searches for an exactly matching getAuthority().
String toString()
[Expand]
Inherited Methods
From class javax.servlet.http.HttpServletRequestWrapper
From class javax.servlet.ServletRequestWrapper
From class java.lang.Object
From interface javax.servlet.ServletRequest
From interface javax.servlet.http.HttpServletRequest

Public Constructors

public SecurityContextHolderAwareRequestWrapper (HttpServletRequest request, String rolePrefix)

Public Methods

public String getRemoteUser ()

Returns the principal's name, as obtained from the SecurityContextHolder. Properly handles both String-based and UserDetails-based principals.

Returns
  • the username or null if unavailable

public Principal getUserPrincipal ()

Returns the Authentication (which is a subclass of Principal), or null if unavailable.

Returns
  • the Authentication, or null

public boolean isUserInRole (String role)

Simple searches for an exactly matching getAuthority().

Will always return false if the SecurityContextHolder contains an Authentication with nullprincipal and/or GrantedAuthority[] objects.

Parameters
role the GrantedAuthorityString representation to check for
Returns
  • true if an exact (case sensitive) matching granted authority is located, false otherwise

public String toString ()