过滤器(在springbootwebapp中)可以基于所有定义的请求映射来验证请求URL吗?

我在一个SpringBootWeb应用程序中实现了一个过滤器(用 @Component 和 @Order(Ordered.HIGHEST_PRECEDENCE)

但是我想在执行任何其他验证(如cert验证)之前验证URL,这样我就可以立即指出它是否是404。因为我遇到了一个很有必要的案子。

更新日期:2018年9月23日

AuthFilter.java

@Component
@Order(Ordered.HIGHEST_PRECEDENCE)
public class AuthFilter implements Filter {

    private final Logger logger = LoggerFactory.getLogger(AuthFilter.class);

    // Define paths that require only client certificate but no Authorization token
    private static final Set<String> ALLOWED_PATHS = Collections.unmodifiableSet(
            new HashSet<>(
                    Arrays.asList("/login", "/register", "/error" )));

    @Override
    public void init(FilterConfig filterConfig) throws ServletException {
        logger.debug("Initiating AuthFilter...");
    }

    @Override
    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
            throws IOException, ServletException {

        if (!(request instanceof HttpServletRequest)) {
            return;
        }

        HttpServletRequest httpRequest = (HttpServletRequest) request;
        HttpServletResponse httpResponse = (HttpServletResponse) response;
        String path = httpRequest.getRequestURI().substring(httpRequest.getContextPath().length()).replaceAll("[/]+$", StringUtils.EMPTY);
        logger.debug("AuthFilter intercepting request: {}", path);
        boolean allowedPath = ALLOWED_PATHS.contains(path);

        int responseCode = 400;
        String responseException = null;

        if (allowedPath) {

            if (this.checkClientCert(CLIENT_CERT_NAME, httpRequest)) {
                logger.debug("{} cert is valid, moving request along", CLIENT_CERT_NAME);
                chain.doFilter(request, response);
                return;
            }

            responseCode = 403;
            responseException = new AuthException("certificate missing", "Must provide a valid client certificate");
            sendResponse(responseCode, responseException, httpResponse);
            return;
        }

        try {

            logger.debug("Checking {} cert and authorization token...", CLIENT_CERT_NAME);
            boolean validClientCert = this.checkClientCert(CLIENT_CERT_NAME, httpRequest);
            boolean validAuthToken = this.checkAuthToken(httpRequest.getHeader("Authorization"));
            if (validClientCert && validAuthToken) {
                logger.debug("{} cert and Auth token are good!", CLIENT_CERT_NAME);
                chain.doFilter(request, response);
                return;
            }
        } catch (Exception e) {
            responseCode = 403;
            responseException = new AuthException("certificate or auth token is missing or invalid", "Must provide a valid client certificate and auth token");
            sendResponse(responseCode, responseException, httpResponse);
        }
    }

    @Override
    public void destroy() {
        throw new UnsupportedOperationException();
    }
}