Zirzirikos Zirzirikos - 3 months ago 37
reST (reStructuredText) Question

JAX-RS 2.0 Filter parameters via @NameBinding annotation

I've created some JAX-RS 2.0 resources (using Jeresey 2.4 running in a Servlet container) and a filter that handles authentication and authorisation that can be selectively applied via a @NameBinding annotation. This all works great.

I would like to be able to define some parameters on this annotation (specifically, security permissions that are required to access each method/resource) that can be available to the filter at runtime to alter this behaviour.

I notice that interceptors can do this via javax.ws.rs.ext.InterceptorContext.getAnnotations() but there is no equivalent in javax.ws.rs.container.ContainerRequestContext for filters. Any ideas how this may be achieved? I would like to be able to do something like the following:

@Target({TYPE, METHOD})
@Retention(value = RetentionPolicy.RUNTIME)
public @interface Secured {
String[] requiredPermissions() default {};

public class SecurityRequestFilter implements ContainerRequestFilter {
public void filter(ContainerRequestContext containerRequestContext) throws IOException {
// extract credentials, verify them and check that the user has required permissions, aborting if not

public class UserConfigurationResource {
@Secured(requiredPermissions = {"configuration-permission"})
public Response getConfig(@Context HttpServletRequest httpServletRequest) {
// produce a response


You can get this information from UriInfo, particularly it's (Jersey specific) ExtendedUriInfo subinterface. To obtain an instance either invoke ContainerRequestContext#getUriInfo() and cast it

final ExtendedUriInfo extendendUriInfo = (ExtendedUriInfo) containerRequestContext.getUriInfo();

or inject it into your filter:

private ExtendedUriInfo extendendUriInfo;



In the second approach you can implement DynamicFeature and assign your filter only to a particular resource methods (i.e. in case the configuration of the filter is more complex, filter applies only to a couple of methods and you want to reduce the overhead, ...). Take a look at the implementation of RolesAllowedDynamicFeature which adds support for security annotations over resource methods in Jersey.