Writing Filters in Apache Sling Web Application

By pulak - JCRDev | Posted on 2009-05-15 09:06

Apache Sling supports filter processing by applying filter chains to the requests before actually dispatching to the servlet or script for processing. In Apache Sling Framework, Filters are plain OSGi services of the type javax.servlet.Filter.

The Apache Sling has two filter chains. It defines, the custom/user defined filter should be added to which filter chain. They are
1. the request filter chain (request level) and
2. the component filter chain (component level).

Two important properties that must be declared for the filter are filter.scope and filter.order.

In order to write a simple request level filter, we need to create a custom filter class which implements the javax.servlet.Filter interface, implement it's doFilter(...) method and every filter is deployed as SCR Component.

Suppose we want to write a request level filter to restrict access/ stop access to certain request URI and in our case say, we want to stop accessing URI containing '/admin/'.

The following is the code for that above said filter.

import java.io.IOException;
import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

/**
* @scr.component immediate="true" metatype="no" enabled="no"
* @scr.property name="service.description" value="Request Filter"
* @scr.property name="filter.scope" value="request" private="true"
* @scr.property name="filter.order" value="-2147483648" type="Integer" private="true"
* @scr.service
*/
public class TestFilter implements Filter
{
private static final String RESOURCE_URI_PATH = "/admin/";
private static final String SC_FORBIDDEN_MSG = "Resource not supported";

public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException
{
HttpServletRequest httpServletRequest = (HttpServletRequest)request;
HttpServletResponse httpServletResponse = (HttpServletResponse)response;

String uri = httpServletRequest.getRequestURI();

if (checkURIPath(uri)) {
handleResourceNotImplemented(httpServletRequest, httpServletResponse);
return;
}

// default implementation
chain.doFilter(request, response);
}

private void handleResourceNotImplemented(HttpServletRequest request, HttpServletResponse response) throws IOException
{
response.sendError(HttpServletResponse.SC_FORBIDDEN, SC_FORBIDDEN_MSG);
}

private boolean checkURIPath(String requestURI)
{
boolean flag = false;

if (requestURI != null) {
if (requestURI.contains(RESOURCE_URI_PATH)) {
flag = true;
}
}

return flag;
}
}

Since the Filter is a SCR Component, we should write the Filter header inside the comment tag and it describes that it is a scr component, starts immediately, it's order and scope. It is as follows

/**
* @scr.component immediate="true" metatype="no" enabled="no"
* @scr.property name="service.description" value="Request Filter"
* @scr.property name="filter.scope" value="request" private="true"
* @scr.property name="filter.order" value="-2147483648" type="Integer" private="true"
* @scr.service
*/

Note:
filter.scope : either request or component (for component level filter)
filter.order : indication that where to place the filter in the filter chain. The smaller the number the earlier in the filter chain.

Now, the above Filter is deployed as a OSGI Service through OSGI Console and can be invoked once per request processing. We can also write component level filters in the same way but they will be invoked for each included resource initiated through the RequestDispatcher.

Hope this will help you to write custom filters.