HandlerMethod given a HttpRequest?

Question

I have an interceptor in which i want to do some intercepting logic based on the annotation on a controller method (Not on controller class). Say want to restrict the access to that controller method for certain users only. Is there any way to get the Handler method (Yes not the handler class) in the HandlerInterceptor?

Answer 1

You can do this in Spring 3.1 now with something like this:

public class ApiSecurityInterceptor implements HandlerInterceptor {

@Override
public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handler) throws Exception {
        HandlerMethod method = (HandlerMethod) handler;
        Api methodAnnotation = method.getMethodAnnotation(Api.class);

        if (methodAnnotation != null) {
            // this method is an @Api, we check the credentials
            // you can do other things with annotation parameters at this point too
        }
    }
}

Then map it in servlet-config.xml:

<?xml version="1.0" encoding="UTF-8"?>
...
<mvc:interceptors>
    <bean class="com.orderpipe.prototype.server.web.interceptors.ApiSecurityInterceptor"/>
</mvc:interceptors>

Then in your actual controller:

@Controller
@RequestMapping(value = "/api-service")
public class AccountApiController {

    @Api(type=CredentialType.OAUTH)
    @RequestMapping(value="get", method = RequestMethod.GET)
    public String get(Model model) {
        // secured method via oauth, for example
        // in a simpler example, you'd not have the parameter for credential type.
    }

}

I use it to implement special servlet paths that implement different security mechanisms to the normal app, for example /api uses oAuth credentials.

Answer 2

I'm afraid not. You would have to group the desired methods in one (or a few) classes and base your check on the class, rather than method.

I guess you can parse the annotations yourself and match the paths, or try to see what spring does to do so in its classes, but that would be more complicated and error-prone.

You can try (but I haven't used it, so I don't know if it works) the @Interceptors annotation on your methods (saw it here)

Answer 3

I have the same need.

I consider an inconsistency that Spring MVC promotes the use of controller methods to handle requests, but the HandlerInterceptor interface does not supply the handler method that's going to handle the request as a parameter; only the controller object.

Requests are handled at the method level and it's the method execution what you need to intercept and for doing that efficiently you need to gain access to the method meta-information, for example, custom annotations declared at method level or its arguments.

The HandlerInterceptor.preHandle signature shoud be:

public boolean preHandle(HttpServletRequest request, HttpServletResponse response, Object handlerInstance, Method handlerMethod) throws Exception;

So that you can do something like this:

hadlerMethod.getAnnotation(MyCustomAnnotation.class);

GOT IT?

In my case, I wanted to implement indexed-paremeter mapping; something STRIPES FRAMEWORK has (or flash scoping).

Do I have to resort to AspectJ to implement my cross-cutting functionality? DISSAPOINTING!

Answer 4

Firstly this is against MVC architectural pattern. MVC architecture is an architectural pattern that desires to

isolate "domain logic" (the application logic for the user) from the user interface (input and presentation), permitting independent development, testing and maintenance of each (separation of concerns).

See here

And controller has a great work in it.It desires decoupling, focusing on design porpose, and etc. I hope software developers don't give up GRASP :/