Think of a scenario where we have a business requirement inside our application where when user tried
to enter his username or email in the login page, we should not accept any username or email which
has a word WPEC inside it.
Of course, I can validate this on the other side also, but I want to validate the back inside so that
if some authentication fails due to this reason, I can log it or I can write an exception into a database.
In order to achieve this, we can write a custom filter and inject into the spring security filter change
flow by using the add filter before method.
You can see here for your representation purposes.
I have defined some inbuilt filters like Cotswold, CSR, a filter and the basic authentication filter
which are provided by spring security framework itself.
So in this chain of filters, I want to inject my own custom filter, which is of request validation
filter before the basic authentication filter.
So whenever we inject our own filter before a certain spring security framework filter, the order we
will get is just before the number.
So for our understanding purposes, I just defined class as a filter, which has either one CSR, which
has other two, followed by my filter, which is arbitrary.
And at the last we have a filter which is basic authentication filter return order for.
So in order to achieve this, let's try to go to the backend code and try to implement a filter with
the logic that we have discussed.
So here I have implemented a filter, which I'll explain you now.
But don't worry if you really want to check what I have written inside this filter, you can always
download the source code from the summary of the section and explore astbury.
What needs, as you can see, the very first requirement that we have to follow is we have to implement
the filter from the package Java X dot.
So let inside this we need to override the method to filter and it receives three parameters request,
response and filters.
Since we want to deal with the filters, we have to convert that request whatever we result into the
history to pisolite request.
Once we convert that here.
What I I'm trying to see is during the initial authentication from the UI in the intercept that we have
written, we are sending an header with the name Attribution and with the base64 encoding with both
email and the password separated by a column.
So this is what is happening from the UI.
So similarly on the backend, in order to understand what is the email entered by the user, I read
through the header with the name Attribution and inside the header.
If the header starts with the name Basic, which means this is my proper header where I can find my
email and password, I can decode it using base64 encoding and decoding.
Once I have the decoded string, I will separate the string using a delimiter that we have used Colen
in the UI and the very first string that I get from this token is Imon.
And inside the email I'm just checking if I how inside it.
If it is there, then I will generate a response which indicates that request received to the UI.
So this is not a four zero one.
It just indicates I received an invalid email to the UI application.
So this we want to execute before actual authentication happens.
Due to that reason, we injected this filter just before the basic authentication filter.
Now let's try to configure this custom filter inside our application for the same.
You have to come to project security config Java.
And here this is the line that I have added to configure a filter.
We can add this line anywhere inside this matter.
But I just added before our the matches and here I am saying you have to add filter before and parsing
my own custom filter by initializing it, followed by what is a spring security filter I want to consider
in order to inject my filter just before it's the filter that we want to consider is basic authentication
filter from the spring security framework.
IT with this configuration, we inject our own custom filter into the spring security filter chain and
let's try to start the application by going to the main class.
Why debugging and Java application from the login page, let's try to form a proper login, which is
happy aderet example dot com one, two, three, four, five and clicking Sinem to login.
Successful as we expected, but let's try to check the console of the back and see whether our filter
is really added into the spring security filter change.
As you can see here just before basic authentication filter our Walkerston filter, which is request
validation before filter has been added to the filter change.
And since our e-mail is valid, it didn't show any error.
Let us try to log out and this time I will enter.
AP straight example, dot com two, three, four, five is the password.
We keep a breakpoint in our filter for your reference.
Clicking, signing.
I can see here the breakpoint has been stopped here and this is the token that we send username colon
and the password and the way we decoded it and fetching the only email pad.
And clearly my email contains now it satisfies a condition that I have written, so it will return a
four hundred error, which indicates bad request to the UI, but it will not call the extra filter in
the chain because I am returning from this filter itself to the client and you can see here in the console,
my request has been filled with the reason for hundred that will return and that back in this way we
can define our one custom filter and added this to before whatever we define filter provided by the
spring security framework in the next, will you let us try to add a filter after an inbuilt filter
provided by spring security?
Thank you.
And see you in the next room by.