44

I'm trying to use a ContainerRequestFilter to enforce some authentication on a Tomcat based Jersey application. I followed this document. Problem : the filter is never triggered

The filter class :

@Provider
public class AuthFilter implements ContainerRequestFilter {

    @Override
    public void filter(ContainerRequestContext requestContext)
        throws IOException {

        // MY AUTHENTICATION CODE GOES HERE

    }

The web.xml file :

<?xml version="1.0" encoding="UTF-8"?>
<web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xmlns="http://java.sun.com/xml/ns/javaee"
    xmlns:web="http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd"
    xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd"
    id="debate-rest"
    version="3.0">
  <display-name>rest</display-name>
   <servlet>  
    <servlet-name>Jersey REST Service</servlet-name>  
    <servlet-class>org.glassfish.jersey.servlet.ServletContainer</servlet-class>  
    <init-param>
        <param-name>com.sun.jersey.spi.container.ContainerRequestFilters</param-name>
        <param-value>com.hck.debate.rest.security.AuthFilter</param-value>
    </init-param>
    <init-param>  
      <param-name>jersey.config.server.provider.packages</param-name>  
      <param-value>com.hck.debate.rest.controller</param-value>  
    </init-param>  
    <init-param>  
        <param-name>com.sun.jersey.api.json.POJOMappingFeature</param-name>  
        <param-value>true</param-value>  
    </init-param>      
    <load-on-startup>1</load-on-startup>  
  </servlet>  
  <servlet-mapping>  
    <servlet-name>Jersey REST Service</servlet-name>  
    <url-pattern>/*</url-pattern>  
  </servlet-mapping>

10 Answers 10

38

Okay, I didn't get that the jersey.config.server.provider.packages init param needs to reference not only service classes (API endpoints) but ALL the classes including filters.

Now it works :

<init-param>  
  <param-name>jersey.config.server.provider.packages</param-name>  
  <param-value>com.hck.debate.rest.controller;com.hck.debate.rest.security</param-value>
</init-param>
<init-param>
    <param-name>com.sun.jersey.spi.container.ContainerRequestFilters</param-name>
    <param-value>com.hck.debate.rest.security.AuthFilter</param-value>
</init-param>
5
  • Your above code is working as it is with TomCat, maybe it's different with Glas Fish
    – AZ_
    Aug 26, 2013 at 9:54
  • 3
    The default behavior is to scan recursively, so you can also just use the single base package com.hck.debate.rest Nov 5, 2015 at 4:43
  • 5
    Also note that com.sun.jersey.spi.container.ContainerRequestFilters and com.sun.jersey.api.json.POJOMappingFeature are useless. These are Jersey 1.x properties. They have no impact on Jersey 2.x Nov 5, 2015 at 4:44
  • Also note that by default, the package scanning is recursive. So instead of listing multiple packages, just declare a base package, like com.hck.debate.rest, and it will recursively scan all sub-packages. Jan 11, 2019 at 6:45
  • And just an FYI, the scanning is to pick up classes annotated with @Provider and @Path, so you need to make sure to also have the @Provider annotation. Jan 11, 2019 at 6:47
23

I also had to add the @Provider JAX-RS annotation to my filters.
This makes the filter discoverable during JAX-RS scanning phase.

@Provider
public class MyAppFilter implements ContainerRequestFilter {
    // filter logic
}
3
  • 2
    Same here without the annotation nothing happened May 19, 2014 at 13:36
  • is it "@Provider" really necessary ?
    – VedantK
    Mar 14, 2017 at 6:37
  • Yes, I just had to add the @Provider annotation. Package scanning was already set up correctly
    – ruediste
    Jun 29, 2017 at 5:42
5

Some hints:

  1. Make sure you're using JAX-RS version 2.17.
  2. Make sure you're using the right imports in your filter:

    • import javax.ws.rs.container.ContainerRequestContext;
    • import javax.ws.rs.container.ContainerRequestFilter;
  3. Add the @Provider annotation

2
  • is it "@Provider" really necessary ?
    – VedantK
    Mar 14, 2017 at 6:37
  • Yes, it annotates the component as a provider of something. It is used to extend the base JAX-RS functionality.
    – ACV
    Mar 14, 2017 at 17:20
4

We were missing the below call in our ResourceConfig implementation class:

register(CorrelationIdFilter.class);
2

The minimum requirements to work filters with jersey:

  • add @Provider annotation to filter class
  • the namespace of filter class has to be included in 'jersey.config.server.provider.packages' init-param

Any other settings aren't required (e.g. 'com.sun.jersey.spi.container.ContainerRequestFilters' init-param or ResourceConfig)

2
  • is it "@Provider" really necessary ?
    – VedantK
    Mar 14, 2017 at 6:37
  • yes, it is. Jersey will load only the marked classes from the specified namespace
    – crazyman
    Mar 14, 2017 at 13:40
2

I had the same problem for JAX-RS 2 , jersey and the below annotation fixed it

 @PreMatching
2
  • 3
    But that changes semantics! Adding this method solely influences when the filter is invoked. I seriously doubt that this changes the configuration of anything!
    – GhostCat
    Aug 2, 2018 at 9:04
  • Thanks, this is just what I needed. Jan 17, 2020 at 13:21
0

Instead of using the @Provider annotation (which did not work in my case), you can register your ContainerRequestFilter manually with your JerseyServletFactory:

JerseyServletFactory jerseyServletFactory = new JerseyServletFactory(config);
HttpServlet myServiceServlet = jerseyServletFactory.create(myResource);

// Register your ContainerRequestFilter like this
jerseyServletFactory.addRequestFilter(new MyFilter());

httpServer.register(myServiceServlet, "/api");
httpServer.start();
3
  • and where is this piece of code supposed to be placed?
    – jon
    Mar 9, 2016 at 19:40
  • @jon During initialization. I've place my code between the creation and the start of the JettyHttpServer, with the other stuff that needs to get initialized on start (Datasources, Resources, DAOs, etc.) Mar 9, 2016 at 19:55
  • I did the same, now i want to call destroy (for some custom cleanup task) of servlet. I am not able to get the reference back of this filter to call destroy in shutdown event.
    – Atul Kumar
    Dec 6, 2017 at 11:52
0

If you were stuck like me, note that TomEE 1.7.X uses JAX-RS 1.1, which does not include ContainerRequestFilter.

0

For anybody having this problem in MULE ESB. Remember to register path with:

<jersey:resources doc:name="REST">
   <component doc:name="rest component">
     <spring-object bean="endpoit"/>
   </component>
   <jersey:package packageName="path @Provider-s"/>
</jersey:resources >
-1

Instead of javax.ws.rs, i used com.sun.jersey and it worked

import com.sun.jersey.spi.container.ContainerRequestFilter import com.sun.jersey.spi.container.ContainerRequest

Dropwizard users need to do this

environment.jersey().getResourceConfig()
           .getContainerRequestFilters()
           .add(filter);
1
  • And thereby creating code that relies on packages you shouldnt rely on.
    – GhostCat
    Aug 2, 2018 at 9:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.