कस्टम JWT फ़िल्टर लागू करना

import jakarta.servlet.FilterChain;
import jakarta.servlet.ServletException;
import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;
import org.springframework.web.filter.OncePerRequestFilter;
import java.io.IOException;

public class JwtAuthenticationFilter extends OncePerRequestFilter {

    @Override
    protected void doFilterInternal(
        HttpServletRequest request,
        HttpServletResponse response,
        FilterChain filterChain
    ) throws ServletException, IOException {
        // Our JWT logic will go here
        filterChain.doFilter(request, response);
    }
}

import jakarta.servlet.FilterChain;
import jakarta.servlet.ServletException;
import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;
import org.springframework.web.filter.OncePerRequestFilter;
import java.io.IOException;

public class JwtAuthenticationFilter extends OncePerRequestFilter {

    @Override
    protected void doFilterInternal(
        HttpServletRequest request,
        HttpServletResponse response,
        FilterChain filterChain
    ) throws ServletException, IOException {
        final String authHeader = request.getHeader("Authorization");
        String jwt = null;

        if (authHeader != null && authHeader.startsWith("Bearer ")) {
            jwt = authHeader.substring(7); // Remove "Bearer " prefix
            System.out.println("Extracted JWT: " + jwt.substring(0, 5) + "...");
        } else {
            System.out.println("No JWT found or invalid header.");
        }

        filterChain.doFilter(request, response);
    }
}

import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import java.util.ArrayList;

public class Main {
    public static void main(String[] args) {
        // Simulate a UserDetails object loaded from DB
        UserDetails userDetails = new User(
            "exampleUser", "[PASSWORD_HASH]", new ArrayList<>()
        );

        // Create an Authentication token
        UsernamePasswordAuthenticationToken authToken =
            new UsernamePasswordAuthenticationToken(
                userDetails, null, userDetails.getAuthorities()
            );

        // Set the Authentication in the SecurityContextHolder
        SecurityContextHolder.getContext().setAuthentication(authToken);

        System.out.println("Authentication set for: " +
            SecurityContextHolder.getContext().getAuthentication().getName());

        // Clear context after request (or for next test)
        SecurityContextHolder.clearContext();
    }
}

import java.util.HashMap;
import java.util.Map;

// Simulate Spring Security components needed for the filter logic
class MockSecurityContextHolder {
    private static String authenticatedUser = null;

    public static String getAuthentication() {
        return authenticatedUser;
    }

    public static void setAuthentication(String user) {
        authenticatedUser = user;
    }

    public static void clearContext() {
        authenticatedUser = null;
    }
}

public class Main {

    // This method simulates the core logic of doFilterInternal
    public static void simulateJwtFilter(Map<String, String> requestHeaders) {
        System.out.println("--- Simulating JWT Filter Logic ---");

        final String authHeader = requestHeaders.get("Authorization");
        String jwt = null;
        String username = null;

        if (authHeader != null && authHeader.startsWith("Bearer ")) {
            jwt = authHeader.substring(7);
            // In a real app, this extracts username from JWT payload
            username = "coddyuser"; // Simplified: assume "coddyuser" from a valid JWT
            System.out.println("Filter: JWT found: " + jwt.substring(0, 5) + "...");
        } else {
            System.out.println("Filter: No JWT found or invalid header format.");
        }

        // Check if user is already authenticated
        if (username != null && MockSecurityContextHolder.getAuthentication() == null) {
            // Simulate JWT validation (signature, expiration, etc.)
            boolean tokenValid = true; // Assume valid for this simple demo

            if (tokenValid) {
                // In a real filter, we'd load UserDetails and create an Authentication object
                MockSecurityContextHolder.setAuthentication(username);
                System.out.println("Filter: User '" + username + "' authenticated and context set.");
            } else {
                System.out.println("Filter: JWT validation failed.");
            }
        } else if (username != null && MockSecurityContextHolder.getAuthentication() != null) {
            System.out.println("Filter: User '" + username + "' already authenticated for this request.");
        }

        // In a real filter, this would call filterChain.doFilter(...)
        System.out.println("Filter: Request passed to next filter/handler.");
        System.out.println("--- Filter Logic End ---");
    }

    public static void main(String[] args) {
        // Scenario 1: Request with a valid JWT
        Map<String, String> headers1 = new HashMap<>();
        headers1.put("Authorization", "Bearer abc.def.ghi");
        simulateJwtFilter(headers1);
        System.out.println("Main: SecurityContext has authentication: " +
            (MockSecurityContextHolder.getAuthentication() != null ? MockSecurityContextHolder.getAuthentication() : "None"));
        MockSecurityContextHolder.clearContext(); // Clean up

        System.out.println("\n");

        // Scenario 2: Request without a JWT
        Map<String, String> headers2 = new HashMap<>();
        simulateJwtFilter(headers2);
        System.out.println("Main: SecurityContext has authentication: " +
            (MockSecurityContextHolder.getAuthentication() != null ? MockSecurityContextHolder.getAuthentication() : "None"));
        MockSecurityContextHolder.clearContext(); // Clean up
    }
}

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;

// Assuming JwtAuthenticationFilter is defined elsewhere
class JwtAuthenticationFilter extends OncePerRequestFilter {
    @Override
    protected void doFilterInternal(jakarta.servlet.http.HttpServletRequest request, jakarta.servlet.http.HttpServletResponse response, jakarta.servlet.FilterChain filterChain) throws jakarta.servlet.ServletException, java.io.IOException {
        // Simplified for config demo
        filterChain.doFilter(request, response);
    }
}

@Configuration
@EnableWebSecurity
public class SecurityConfig {

    private final JwtAuthenticationFilter jwtAuthFilter;

    // Inject our custom JWT filter
    public SecurityConfig(JwtAuthenticationFilter jwtAuthFilter) {
        this.jwtAuthFilter = jwtAuthFilter;
    }

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
            .csrf(csrf -> csrf.disable()) // Disable CSRF for stateless APIs
            .authorizeHttpRequests(auth -> auth
                .requestMatchers("/api/auth/**").permitAll() // Public endpoints
                .anyRequest().authenticated() // Secure all other requests
            )
            // Add our custom JWT filter BEFORE the default UsernamePasswordAuthenticationFilter
            .addFilterBefore(jwtAuthFilter, UsernamePasswordAuthenticationFilter.class);

        return http.build();
    }
}