How can I block access to application pages with session filter?

Question

Session Filter Code

@WebFilter(urlPatterns = { "/*" })
public class FiltroSessaoUsuario implements Filter {

public void init(FilterConfig fConfig) throws ServletException {

}

public void doFilter(ServletRequest request, ServletResponse response, 
FilterChain chain)
        throws IOException, ServletException {
    try {
        HttpServletRequest httpRequest = (HttpServletRequest) request;
        HttpServletResponse httpResponse = (HttpServletResponse) response;
        if (httpRequest.getAttribute("usuario") != null) {
            chain.doFilter(request, response);
        } else {
            request.getRequestDispatcher("erro-
 login.jsp").forward(httpRequest, httpResponse);
        }
    } catch (Exception e) {
        throw new RuntimeException("Ocorreu um erro no filtro de sessao do 
usuario.", e);
    }
}

public void destroy() {

}
}

Code of login logic

public class LoginUsuarioLogica implements Logica {
public void executa(HttpServletRequest request, HttpServletResponse 
response) throws Exception {
    Usuario usuario = new Usuario();
    usuario.setEmail(request.getParameter("email"));
    usuario.setSenha(request.getParameter("senha"));
    HttpSession sessao = request.getSession();
    if (new UsuarioDAO().validaLogin(usuario)) {
        sessao.setAttribute("usuario", usuario.getEmail());
        request.getRequestDispatcher("index.jsp").forward(request, 
response);
    } else {
        sessao.invalidate();
        request.getRequestDispatcher("erro-login.jsp").forward(request, 
response);
    }
}
}

Code of logout logic

public class LogoutUsuarioLogica implements Logica {
public void executa(HttpServletRequest request, HttpServletResponse 
response) throws Exception {
    if (request.getParameter("parametro").equalsIgnoreCase("logout")) {
        HttpSession sessao = request.getSession();
        sessao.invalidate();
        response.sendRedirect("login.jsp");
    }
}
}

Answer 1

Change the user to check if the HTTP session has the "user" attribute, please run below:

public void init(FilterConfig fConfig) throws ServletException {

}

public void doFilter(ServletRequest request, ServletResponse response, 
    FilterChain chain)
            throws IOException, ServletException {
        try {
            HttpServletRequest httpRequest = (HttpServletRequest) request;
            HttpServletResponse httpResponse = (HttpServletResponse) response;
            HttpSession sessao = httpRequest.getSession();
            Object usuarioLogado = sessao.getAttribute("usuario");

            if ( usuarioLogado != null) {
                chain.doFilter(request, response);
            } else {
                request.getRequestDispatcher("erro-login.jsp").forward(httpRequest, httpResponse);
            }
        } catch (Exception e) {
            throw new RuntimeException("Ocorreu um erro no filtro de sessao do usuario.", e);
        }
    }

public void destroy() {

}

Please note that the @Webfilter annotation(urlPatterns = { "/*" }) will apply your filter to all application requests. Inclusive, login.jsp and error-login.jsp. This makes no sense because the filter cannot validate whether the user is logged in to the page that the user uses to log in.

You didn’t report how you structured your project, so I can’t tell you for sure what URL pattern you should report. One option would be to put all your restricted JSP pages in a folder other than login.jsp and error-login.jsp pages, so apply the filter only to that folder.

A proposed organization of archives would be:

login.jsp
erro-login.jsp
paginas-restritas
  - pagina1.jsp
  - pagina2.jsp

Webfilter would look like this:

@WebFilter(urlPatterns = { "/paginas-restritas/*" }) 
public class FiltroSessaoUsuario implements Filter {
...

Another less practical option is for you to set a Patterns URL stating all the pages to which the filter should be applied, leaving out login.jsp and error-login.jsp:

@WebFilter(urlPatterns = { "/paginas-restritas/pagina1.jsp","/paginas-restritas/pagina2.jsp"})

The drawback of this solution is having to change the urlPatterns for each new page you create in your application. Over time, the maintenance of this code will become difficult.

A third option is to leave the filter applicable to all requests and within the Filter codeThe user programmatically checks whether the request is being made for login.jsp or error-login.jsp and invokes chain.doFilter() so that the request continues:

 ...
 String path = httpRequest.getRequestURI().substring(httpRequest.getContextPath().length()).replaceAll("[/]+$", ""); 
 if (path.equalsIgnoreCase("login.jsp") || path.equalsIgnoreCase("erro-login.jsp")) {
      chain.doFilter(request, response);
      return;
 }
 if ( usuarioLogado != null) {
       chain.doFilter(request, response);
 } else {
        request.getRequestDispatcher("erro-login.jsp").forward(httpRequest, httpResponse);
 }
 ...