Package org.apache.shiro.web.filter.authc

Class UserFilter

  • All Implemented Interfaces:
    javax.servlet.Filter, org.apache.shiro.util.Nameable, PathConfigProcessor
    public class UserFilter
extends AccessControlFilter
    Filter that allows access to resources if the accessor is a known user, which is defined as having a known principal. This means that any user who is authenticated or remembered via a 'remember me' feature will be allowed access from this filter.

    If the accessor is not a known user, then they will be redirected to the loginUrl

    Since:
    0.9

    • Constructor Detail

      • UserFilter

        public UserFilter()

    • Method Detail

      • isAccessAllowed

        protected boolean isAccessAllowed​(javax.servlet.ServletRequest request,
                                  javax.servlet.ServletResponse response,
                                  Object mappedValue)
        Returns true if the request is a loginRequest or if the current subject is not null, false otherwise.
        Specified by:
        isAccessAllowed in class AccessControlFilter
        Parameters:
        request - the incoming ServletRequest
        response - the outgoing ServletResponse
        mappedValue - the filter-specific config value mapped to this filter in the URL rules mappings.
        Returns:
        true if the request is a loginRequest or if the current subject is not null, false otherwise.

      • onAccessDenied

        protected boolean onAccessDenied​(javax.servlet.ServletRequest request,
                                 javax.servlet.ServletResponse response)
                          throws Exception
        This default implementation simply calls saveRequestAndRedirectToLogin and then immediately returns false, thereby preventing the chain from continuing so the redirect may execute.
        Specified by:
        onAccessDenied in class AccessControlFilter
        Parameters:
        request - the incoming ServletRequest
        response - the outgoing ServletResponse
        Returns:
        true if the request should continue to be processed; false if the subclass will handle/render the response directly.
        Throws:
        Exception - if there is an error processing the request.