Security Filters

// ── Filters you will meet most often, in execution order ─────────────
// (Spring Security 6.x; which ones appear depends on your configuration)
//
//  DisableEncodeUrlFilter
//  WebAsyncManagerIntegrationFilter
//  SecurityContextHolderFilter        loads the SecurityContext
//  HeaderWriterFilter                 writes security headers (X-Content-Type-Options,
//                                     X-Frame-Options, Cache-Control ...)
//  CorsFilter                         CORS (only if cors() is configured)
//  CsrfFilter                         rejects POST/PUT/DELETE without a CSRF token
//  LogoutFilter
//  UsernamePasswordAuthenticationFilter   only with formLogin()
//  BasicAuthenticationFilter              only with httpBasic()
//  RequestCacheAwareFilter
//  SecurityContextHolderAwareRequestFilter
//  AnonymousAuthenticationFilter      sets an anonymous user if nobody logged in
//  SessionManagementFilter
//  ExceptionTranslationFilter         turns security exceptions into 401 / 403
//  AuthorizationFilter                enforces authorizeHttpRequests() rules

// ── Several chains: the first matching chain wins ────────────────────
@Configuration
@EnableWebSecurity
public class SecurityConfig {

    @Bean
    @Order(1)
    SecurityFilterChain apiChain(HttpSecurity http) throws Exception {
        http.securityMatcher("/api/**")          // only handles /api/**
            .authorizeHttpRequests(a -> a.anyRequest().authenticated());
        return http.build();
    }

    @Bean
    @Order(2)
    SecurityFilterChain webChain(HttpSecurity http) throws Exception {
        http.authorizeHttpRequests(a -> a.anyRequest().permitAll())
            .formLogin(Customizer.withDefaults());   // everything else
        return http.build();
    }
}

// No @Component here: the filter is created in the security config
public class RequestLoggingFilter extends OncePerRequestFilter {

    private static final Logger log =
            LoggerFactory.getLogger(RequestLoggingFilter.class);

    @Override
    protected void doFilterInternal(HttpServletRequest request,
                                    HttpServletResponse response,
                                    FilterChain chain)
            throws ServletException, IOException {

        long start = System.nanoTime();
        String requestId = UUID.randomUUID().toString().substring(0, 8);
        MDC.put("requestId", requestId);
        try {
            chain.doFilter(request, response);
        } finally {
            long ms = (System.nanoTime() - start) / 1_000_000;
            log.info("{} {} -> {} ({} ms)", request.getMethod(),
                    request.getRequestURI(), response.getStatus(), ms);
            MDC.clear();
        }
    }

    @Override
    protected boolean shouldNotFilter(HttpServletRequest request) {
        return request.getRequestURI().startsWith("/actuator/health");
    }
}

@Bean
SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
    http
        // Early position: also logs requests rejected with 401/403
        .addFilterBefore(new RequestLoggingFilter(),
                SecurityContextHolderFilter.class)
        .authorizeHttpRequests(a -> a.anyRequest().authenticated());
    return http.build();
}

// addFilterBefore(f, X)  -> runs just before X
// addFilterAfter(f, X)   -> runs just after X
// addFilterAt(f, X)      -> same position as X; X is NOT replaced, both run

// ── If you must keep @Component, stop Boot registering it twice ──────
@Bean
FilterRegistrationBean<RequestLoggingFilter> disableServletRegistration(
        RequestLoggingFilter filter) {
    FilterRegistrationBean<RequestLoggingFilter> reg =
            new FilterRegistrationBean<>(filter);
    reg.setEnabled(false);       // keep it only in the security chain
    return reg;
}

// ── JwtService (jjwt 0.12.x) ─────────────────────────────────────────
@Service
public class JwtService {

    private final SecretKey key;
    private final long ttlMillis;

    public JwtService(@Value("${app.jwt.secret}") String base64Secret,
                      @Value("${app.jwt.ttl-minutes:15}") long ttlMinutes) {
        this.key = Keys.hmacShaKeyFor(Decoders.BASE64.decode(base64Secret));
        this.ttlMillis = ttlMinutes * 60_000;
    }

    public String generate(UserDetails user) {
        Date now = new Date();
        return Jwts.builder()
                .subject(user.getUsername())
                .issuedAt(now)
                .expiration(new Date(now.getTime() + ttlMillis))
                .signWith(key)
                .compact();
    }

    // Verifies signature and expiry; throws JwtException if either fails
    public String validateAndGetUsername(String token) {
        return Jwts.parser().verifyWith(key).build()
                .parseSignedClaims(token)
                .getPayload()
                .getSubject();
    }
}

// ── The filter ───────────────────────────────────────────────────────
public class JwtAuthenticationFilter extends OncePerRequestFilter {

    private final JwtService jwtService;
    private final UserDetailsService userDetailsService;

    public JwtAuthenticationFilter(JwtService jwtService,
                                   UserDetailsService userDetailsService) {
        this.jwtService = jwtService;
        this.userDetailsService = userDetailsService;
    }

    @Override
    protected void doFilterInternal(HttpServletRequest request,
                                    HttpServletResponse response,
                                    FilterChain chain)
            throws ServletException, IOException {

        String header = request.getHeader(HttpHeaders.AUTHORIZATION);
        if (header == null || !header.startsWith("Bearer ")) {
            chain.doFilter(request, response);     // not our business
            return;
        }

        try {
            String username = jwtService.validateAndGetUsername(header.substring(7));
            if (SecurityContextHolder.getContext().getAuthentication() == null) {
                UserDetails user = userDetailsService.loadUserByUsername(username);
                if (user.isEnabled()) {
                    var auth = UsernamePasswordAuthenticationToken
                            .authenticated(user, null, user.getAuthorities());
                    auth.setDetails(new WebAuthenticationDetailsSource()
                            .buildDetails(request));
                    SecurityContext context = SecurityContextHolder.createEmptyContext();
                    context.setAuthentication(auth);
                    SecurityContextHolder.setContext(context);
                }
            }
        } catch (ExpiredJwtException e) {
            request.setAttribute("auth.error", "expired");
        } catch (JwtException | IllegalArgumentException
                 | UsernameNotFoundException e) {
            request.setAttribute("auth.error", "invalid");
        }
        // Never write the error here: stay unauthenticated and let the
        // entry point answer 401 only where authentication is required.
        chain.doFilter(request, response);
    }
}

// ── Consistent JSON 401 ──────────────────────────────────────────────
public class JsonAuthenticationEntryPoint implements AuthenticationEntryPoint {

    private final ObjectMapper mapper = new ObjectMapper();

    @Override
    public void commence(HttpServletRequest request, HttpServletResponse response,
                         AuthenticationException ex) throws IOException {
        String message = "expired".equals(request.getAttribute("auth.error"))
                ? "Token has expired" : "Authentication required";
        response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
        response.setHeader(HttpHeaders.WWW_AUTHENTICATE, "Bearer");
        response.setContentType(MediaType.APPLICATION_JSON_VALUE);
        mapper.writeValue(response.getOutputStream(), Map.of("error", message));
    }
}

// ── Wiring ───────────────────────────────────────────────────────────
@Bean
SecurityFilterChain api(HttpSecurity http, JwtService jwtService,
                        UserDetailsService userDetailsService) throws Exception {
    http
        .csrf(csrf -> csrf.disable())    // safe only for header-token APIs
        .sessionManagement(s ->
            s.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
        .authorizeHttpRequests(a -> a
            .requestMatchers("/api/auth/**", "/api/public/**",
                             "/actuator/health").permitAll()
            .anyRequest().authenticated())
        .exceptionHandling(e -> e
            .authenticationEntryPoint(new JsonAuthenticationEntryPoint()))
        .addFilterBefore(
            new JwtAuthenticationFilter(jwtService, userDetailsService),
            UsernamePasswordAuthenticationFilter.class);
    return http.build();
}

// application.yml:
// app:
//   jwt:
//     secret: ${JWT_SECRET}      # Base64, 32+ bytes, from the environment
//     ttl-minutes: 15

public class RateLimitingFilter extends OncePerRequestFilter {

    private static final double PERMITS_PER_SECOND = 10.0;

    // Bounded, self-cleaning: idle clients are evicted
    private final Cache<String, RateLimiter> limiters = Caffeine.newBuilder()
            .maximumSize(100_000)
            .expireAfterAccess(Duration.ofMinutes(10))
            .build();

    private final ObjectMapper mapper = new ObjectMapper();

    @Override
    protected void doFilterInternal(HttpServletRequest request,
                                    HttpServletResponse response,
                                    FilterChain chain)
            throws ServletException, IOException {

        RateLimiter limiter = limiters.get(resolveClientKey(request),
                k -> RateLimiter.create(PERMITS_PER_SECOND));

        if (!limiter.tryAcquire()) {            // non-blocking
            response.setStatus(HttpStatus.TOO_MANY_REQUESTS.value());
            response.setHeader(HttpHeaders.RETRY_AFTER, "1");
            response.setContentType(MediaType.APPLICATION_JSON_VALUE);
            mapper.writeValue(response.getOutputStream(),
                    Map.of("error", "Too Many Requests"));
            return;
        }
        chain.doFilter(request, response);
    }

    private String resolveClientKey(HttpServletRequest request) {
        Authentication auth = SecurityContextHolder.getContext().getAuthentication();
        if (auth != null && auth.isAuthenticated()
                && !(auth instanceof AnonymousAuthenticationToken)) {
            return "user:" + auth.getName();
        }
        // Real client IP when a trusted proxy is configured (see body text)
        return "ip:" + request.getRemoteAddr();
    }

    @Override
    protected boolean shouldNotFilter(HttpServletRequest request) {
        return request.getRequestURI().startsWith("/actuator/health");
    }
}

// ── Registration: the anchor filter must be added first ──────────────
http.addFilterBefore(jwtFilter, UsernamePasswordAuthenticationFilter.class)
    .addFilterAfter(new RateLimitingFilter(), JwtAuthenticationFilter.class);

// application.yml (behind a trusted reverse proxy only):
// server:
//   forward-headers-strategy: native

// ── application-dev.yml ──────────────────────────────────────────────
// logging:
//   level:
//     org.springframework.security: DEBUG
//     # TRACE lists every filter as it is invoked, e.g.
//     # "Invoking CsrfFilter (5/15)"
//     # org.springframework.security: TRACE
//
// What to look for in the log:
//   Securing GET /api/users                      <- a chain matched the request
//   Will secure any request with [ ...filters ]  <- the chain's filter list (startup)
//   Failed to authorize ... with attributes ...  <- AuthorizationFilter said no
//   Set SecurityContextHolder to anonymous ...   <- nobody authenticated the request

// ── Print the real chain at startup ──────────────────────────────────
@Component
public class SecurityChainInspector
        implements ApplicationListener<ApplicationReadyEvent> {

    private static final Logger log =
            LoggerFactory.getLogger(SecurityChainInspector.class);

    private final FilterChainProxy filterChainProxy;

    public SecurityChainInspector(FilterChainProxy filterChainProxy) {
        this.filterChainProxy = filterChainProxy;
    }

    @Override
    public void onApplicationEvent(ApplicationReadyEvent event) {
        filterChainProxy.getFilterChains().forEach(chain -> {
            log.info("Security chain: {}", chain);
            chain.getFilters().forEach(f ->
                log.info("  {}", f.getClass().getSimpleName()));
        });
    }
}

// ── A test that locks the behaviour in ───────────────────────────────
@SpringBootTest
@AutoConfigureMockMvc
class SecurityChainTest {

    @Autowired MockMvc mvc;

    @Test
    void protectedRouteWithoutTokenIs401() throws Exception {
        mvc.perform(get("/api/users"))
           .andExpect(status().isUnauthorized());
    }

    @Test
    void publicRouteIsOpen() throws Exception {
        mvc.perform(get("/api/public/ping"))
           .andExpect(status().isOk());
    }

    @Test
    void garbageTokenOnProtectedRouteIs401() throws Exception {
        mvc.perform(get("/api/users").header("Authorization", "Bearer nope"))
           .andExpect(status().isUnauthorized());
    }
}

// ── 1. Filter runs twice / logs appear in duplicate ──────────────────
// Cause: filter is a @Component, so Boot registers it as a servlet filter
//        AND you added it to the security chain.
// Fix:   create it with new in the SecurityFilterChain bean, or disable
//        the servlet registration (FilterRegistrationBean.setEnabled(false)).

// ── 2. You expect 401 but get 403 for a missing token ────────────────
// Cause: without formLogin()/httpBasic() there is no entry point that
//        starts authentication, so Spring answers with a bare 403.
// Fix:
http.exceptionHandling(e -> e
    .authenticationEntryPoint(new JsonAuthenticationEntryPoint()));
// 401 = "who are you?" (not authenticated)
// 403 = "I know who you are, you may not do this" (authenticated, no right)

// ── 3. POST/PUT/DELETE returns 403 even with a valid JWT ─────────────
// Cause: CsrfFilter is still active and the request has no CSRF token.
// Fix for a stateless, header-token API only:
http.csrf(csrf -> csrf.disable());
// Keep CSRF ON if authentication relies on cookies or a session.

// ── 4. Custom filter never runs ──────────────────────────────────────
// Check, in this order:
//  a) Is the filter really in the chain? Print it with the inspector above.
//  b) Does the request match this chain? A securityMatcher("/api/**") on
//     another @Order(1) chain can capture the request first.
//  c) Does shouldNotFilter() return true for this path?
//  d) Is it anchored to a class that was never registered? addFilterAfter
//     with a custom anchor fails unless that anchor was added earlier.