10

I have pages in my web application which are accessible only by the administrator. I wrote filter, but I don't understand how to return HTTP error code(403) from the filter if user isn't the admin.

public class AdminFilter implements Filter {
    @Override
    public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException, ServletException {
        String username = servletRequest.getParameter("username");
        String password = servletRequest.getParameter("password");

        UserDao userDaoImpl = new UserDaoImpl();
        if(userDaoImpl.findByUsername(username).getPassword().equals(password)) {
            filterChain.doFilter(servletRequest, servletResponse);
        } else {
            //respond with 403
        }
    }
}

I understand that I can redirect to my custom 403 page but I'm wondering how to return HTTP error code.

3 Answers 3

29

You need to cast servletResponse to HttpServletResponse first:

HttpServletResponse response = (HttpServletResponse) servletResponse;

Then use its sendError() method:

response.sendError(HttpServletResponse.SC_FORBIDDEN);

SC_FORBIDDEN stands for code 403.

By the way, you don't redirect to 403 page, you just respond with that status. If you do that, the servlet container will serve a special 403 page to the user. You can configure that page in your web.xml:

<error-page>
    <error-code>403</error-code>
    <location>/error-403.htm</location>
</error-page>

This instructs the container to serve your custom page /error-403.htm when you set 403 status.

If you want a redirect, you could use response.sendRedirect() (it issues a 302 redirect).

2
  • I don't get the "don't redirect" part. What if I want custom 403 page with funny design? I need to respond with the status and have something that will respond to this status with the page?
    – Artmal
    Aug 29, 2017 at 19:21
  • I've updated the answer to clearify the situation with a 403 page with a funny design Aug 30, 2017 at 6:42
4

I have solved in this way:

((HttpServletResponse) response).setStatus(HttpServletResponse.SC_BAD_REQUEST);
(HttpServletResponse) response).sendError(HttpServletResponse.SC_BAD_REQUEST, "HMAC Failed - X-Authenticated-Id not available");
return;
2

Resolved it by setting 401 as error code in the backend and catching the error in angular interceptor as below.

Backend Java code:

(HttpServletResponse) response).sendError(HttpServletResponse.SC_UNAUTHORIZED);

Angular code:

intercept(req: HttpRequest, next: HttpHandler): Observable> {

    return next.handle(req)
        .catch(error => {

            if (error instanceof HttpErrorResponse && error.status == 401) {
                this.router.navigateByUrl('/sessionExpired', { replaceUrl: true });

                return new EmptyObservable();
            }
            return _throw(error);
        });
}

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.