{"action":"created","comment":{"url":"https://api.github.com/repos/salesforce/Argus/pulls/comments/111266691","pull_request_review_id":32500773,"id":111266691,"diff_hunk":"@@ -74,26 +86,72 @@ public void destroy() { }\n     @Override\n     public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {\n         String user = null;\n+        String sessionId = null;\n \n         if (HttpServletRequest.class.isAssignableFrom(request.getClass())) {\n             HttpServletRequest req = HttpServletRequest.class.cast(request);\n-            HttpSession session = req.getSession(true);\n-            Object remoteUser = session.getAttribute(USER_ATTRIBUTE_NAME);\n-\n-            if (!\"options\".equalsIgnoreCase(req.getMethod()) && !_isAuthEndpoint(req) && remoteUser == null) {\n-            \tHttpServletResponse httpresponse = HttpServletResponse.class.cast(response);\n-            \thttpresponse.setHeader(\"Access-Control-Allow-Origin\", req.getHeader(\"Origin\"));\n-            \thttpresponse.setHeader(\"Access-Control-Allow-Credentials\", \"true\");\n-            \thttpresponse.sendError(HttpServletResponse.SC_UNAUTHORIZED);\n-            } else if (remoteUser != null) {\n-                user = PrincipalUserDto.class.cast(session.getAttribute(USER_ATTRIBUTE_NAME)).getUserName();\n+            \n+            String authorizationHeader = req.getHeader(HttpHeaders.AUTHORIZATION);\n+            \n+            if(authorizationHeader == null && !_isTokenAuthEndpoint(req)) {\n+            \tLoggerFactory.getLogger(getClass()).info(\"Using Session Based Auth...\");\n+            \t//Use Session Based Authentication\n+            \tHttpSession session = req.getSession(true);\n+            \tsessionId = session.getId();\n+                Object remoteUser = session.getAttribute(USER_ATTRIBUTE_NAME);\n+                \n+                if (!\"options\".equalsIgnoreCase(req.getMethod()) && !_isAuthEndpoint(req) && remoteUser == null) {\n+                \tHttpServletResponse httpresponse = HttpServletResponse.class.cast(response);\n+                \thttpresponse.setHeader(\"Access-Control-Allow-Origin\", req.getHeader(\"Origin\"));\n+                \thttpresponse.setHeader(\"Access-Control-Allow-Credentials\", \"true\");\n+                \thttpresponse.sendError(HttpServletResponse.SC_UNAUTHORIZED);\n+                } else if (remoteUser != null) {\n+                    user = PrincipalUserDto.class.cast(remoteUser).getUserName();\n+                }\n+                \n+            } else {\n+            \t//Token Based Authentication\n+            \tLoggerFactory.getLogger(getClass()).info(\"Using Token Based Auth...\");\n+            \tif (!\"options\".equalsIgnoreCase(req.getMethod()) && !_isAuthEndpoint(req)) {\n+                \tif(!authorizationHeader.startsWith(\"Bearer \")) {\n+                \t\tHttpServletResponse httpresponse = HttpServletResponse.class.cast(response);\n+                    \thttpresponse.setHeader(\"Access-Control-Allow-Origin\", req.getHeader(\"Origin\"));\n+                    \thttpresponse.setHeader(\"Access-Control-Allow-Credentials\", \"true\");\n+                    \thttpresponse.sendError(HttpServletResponse.SC_UNAUTHORIZED, HttpHeaders.AUTHORIZATION + \n+                    \t\t\t\" Header is either not proivded or incorrectly formatted.\");\n+                \t} else {               \n+                        try {\n+                        \tString jwt = authorizationHeader.substring(\"Bearer \".length()).trim();\n+                        \tuser = JWTUtils.validateTokenAndGetSubj(jwt, JWTUtils.TokenType.ACCESS);\n+                        } catch(UnsupportedJwtException | MalformedJwtException | IllegalArgumentException e) {\n+                        \tHttpServletResponse httpresponse = HttpServletResponse.class.cast(response);\n+                        \thttpresponse.setHeader(\"Access-Control-Allow-Origin\", req.getHeader(\"Origin\"));\n+                        \thttpresponse.setHeader(\"Access-Control-Allow-Credentials\", \"true\");\n+                        \thttpresponse.sendError(HttpServletResponse.SC_UNAUTHORIZED, \"Unsupported or Malformed JWT. Please provide a valid JWT.\");\n+                        } catch(SignatureException e) {\n+                        \tHttpServletResponse httpresponse = HttpServletResponse.class.cast(response);\n+                        \thttpresponse.setHeader(\"Access-Control-Allow-Origin\", req.getHeader(\"Origin\"));\n+                        \thttpresponse.setHeader(\"Access-Control-Allow-Credentials\", \"true\");\n+                        \thttpresponse.sendError(HttpServletResponse.SC_UNAUTHORIZED, \"Signature Exception. Please provide a valid JWT.\");\n+                        } catch(ExpiredJwtException e) {\n+                        \tHttpServletResponse httpresponse = HttpServletResponse.class.cast(response);\n+                        \thttpresponse.setHeader(\"Access-Control-Allow-Origin\", req.getHeader(\"Origin\"));\n+                        \thttpresponse.setHeader(\"Access-Control-Allow-Credentials\", \"true\");\n+                        \thttpresponse.sendError(HttpServletResponse.SC_UNAUTHORIZED, \"JWT has expired. Please obtain a new token.\");\n+                        }\n+                \t}\n+                }\n             }\n         }\n+        \n         try {\n             MDC.put(USER_ATTRIBUTE_NAME, user);\n+            MDC.put(SESSION_ATTRIBUTE_NAME, sessionId);\n+            request.setAttribute(USER_ATTRIBUTE_NAME, user);","path":"ArgusWebServices/src/main/java/com/salesforce/dva/argus/ws/filter/AuthFilter.java","position":116,"original_position":116,"commit_id":"2038c3da97d453106973bf0dc3be4b7f7444d700","original_commit_id":"2038c3da97d453106973bf0dc3be4b7f7444d700","user":{"login":"dilipdevaraj-sfdc","id":15337565,"avatar_url":"https://avatars3.githubusercontent.com/u/15337565?v=3","gravatar_id":"","url":"https://api.github.com/users/dilipdevaraj-sfdc","html_url":"https://github.com/dilipdevaraj-sfdc","followers_url":"https://api.github.com/users/dilipdevaraj-sfdc/followers","following_url":"https://api.github.com/users/dilipdevaraj-sfdc/following{/other_user}","gists_url":"https://api.github.com/users/dilipdevaraj-sfdc/gists{/gist_id}","starred_url":"https://api.github.com/users/dilipdevaraj-sfdc/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dilipdevaraj-sfdc/subscriptions","organizations_url":"https://api.github.com/users/dilipdevaraj-sfdc/orgs","repos_url":"https://api.github.com/users/dilipdevaraj-sfdc/repos","events_url":"https://api.github.com/users/dilipdevaraj-sfdc/events{/privacy}","received_events_url":"https://api.github.com/users/dilipdevaraj-sfdc/received_events","type":"User","site_admin":false},"body":"Why do we need to explicitly set USER_ATTRIBUTE_NAME in request object now ?","created_at":"2017-04-12T21:37:37Z","updated_at":"2017-04-12T21:37:37Z","html_url":"https://github.com/salesforce/Argus/pull/518#discussion_r111266691","pull_request_url":"https://api.github.com/repos/salesforce/Argus/pulls/518","_links":{"self":{"href":"https://api.github.com/repos/salesforce/Argus/pulls/comments/111266691"},"html":{"href":"https://github.com/salesforce/Argus/pull/518#discussion_r111266691"},"pull_request":{"href":"https://api.github.com/repos/salesforce/Argus/pulls/518"}}},"pull_request":{"url":"https://api.github.com/repos/salesforce/Argus/pulls/518","id":112845146,"html_url":"https://github.com/salesforce/Argus/pull/518","diff_url":"https://github.com/salesforce/Argus/pull/518.diff","patch_url":"https://github.com/salesforce/Argus/pull/518.patch","issue_url":"https://api.github.com/repos/salesforce/Argus/issues/518","number":518,"state":"open","locked":false,"title":"Token Based Auth implementation and SDK changes to support that.","user":{"login":"bsura","id":15331712,"avatar_url":"https://avatars1.githubusercontent.com/u/15331712?v=3","gravatar_id":"","url":"https://api.github.com/users/bsura","html_url":"https://github.com/bsura","followers_url":"https://api.github.com/users/bsura/followers","following_url":"https://api.github.com/users/bsura/following{/other_user}","gists_url":"https://api.github.com/users/bsura/gists{/gist_id}","starred_url":"https://api.github.com/users/bsura/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bsura/subscriptions","organizations_url":"https://api.github.com/users/bsura/orgs","repos_url":"https://api.github.com/users/bsura/repos","events_url":"https://api.github.com/users/bsura/events{/privacy}","received_events_url":"https://api.github.com/users/bsura/received_events","type":"User","site_admin":false},"body":"","created_at":"2017-03-27T21:40:56Z","updated_at":"2017-04-12T21:37:37Z","closed_at":null,"merged_at":null,"merge_commit_sha":"dab135a57b9354ff05768ef75bc0638d94db714e","assignee":null,"assignees":[],"milestone":null,"commits_url":"https://api.github.com/repos/salesforce/Argus/pulls/518/commits","review_comments_url":"https://api.github.com/repos/salesforce/Argus/pulls/518/comments","review_comment_url":"https://api.github.com/repos/salesforce/Argus/pulls/comments{/number}","comments_url":"https://api.github.com/repos/salesforce/Argus/issues/518/comments","statuses_url":"https://api.github.com/repos/salesforce/Argus/statuses/2038c3da97d453106973bf0dc3be4b7f7444d700","head":{"label":"bsura:token_auth","ref":"token_auth","sha":"2038c3da97d453106973bf0dc3be4b7f7444d700","user":{"login":"bsura","id":15331712,"avatar_url":"https://avatars1.githubusercontent.com/u/15331712?v=3","gravatar_id":"","url":"https://api.github.com/users/bsura","html_url":"https://github.com/bsura","followers_url":"https://api.github.com/users/bsura/followers","following_url":"https://api.github.com/users/bsura/following{/other_user}","gists_url":"https://api.github.com/users/bsura/gists{/gist_id}","starred_url":"https://api.github.com/users/bsura/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bsura/subscriptions","organizations_url":"https://api.github.com/users/bsura/orgs","repos_url":"https://api.github.com/users/bsura/repos","events_url":"https://api.github.com/users/bsura/events{/privacy}","received_events_url":"https://api.github.com/users/bsura/received_events","type":"User","site_admin":false},"repo":{"id":53439661,"name":"Argus","full_name":"bsura/Argus","owner":{"login":"bsura","id":15331712,"avatar_url":"https://avatars1.githubusercontent.com/u/15331712?v=3","gravatar_id":"","url":"https://api.github.com/users/bsura","html_url":"https://github.com/bsura","followers_url":"https://api.github.com/users/bsura/followers","following_url":"https://api.github.com/users/bsura/following{/other_user}","gists_url":"https://api.github.com/users/bsura/gists{/gist_id}","starred_url":"https://api.github.com/users/bsura/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bsura/subscriptions","organizations_url":"https://api.github.com/users/bsura/orgs","repos_url":"https://api.github.com/users/bsura/repos","events_url":"https://api.github.com/users/bsura/events{/privacy}","received_events_url":"https://api.github.com/users/bsura/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/bsura/Argus","description":"Time series monitoring and alerting platform.","fork":true,"url":"https://api.github.com/repos/bsura/Argus","forks_url":"https://api.github.com/repos/bsura/Argus/forks","keys_url":"https://api.github.com/repos/bsura/Argus/keys{/key_id}","collaborators_url":"https://api.github.com/repos/bsura/Argus/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/bsura/Argus/teams","hooks_url":"https://api.github.com/repos/bsura/Argus/hooks","issue_events_url":"https://api.github.com/repos/bsura/Argus/issues/events{/number}","events_url":"https://api.github.com/repos/bsura/Argus/events","assignees_url":"https://api.github.com/repos/bsura/Argus/assignees{/user}","branches_url":"https://api.github.com/repos/bsura/Argus/branches{/branch}","tags_url":"https://api.github.com/repos/bsura/Argus/tags","blobs_url":"https://api.github.com/repos/bsura/Argus/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/bsura/Argus/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/bsura/Argus/git/refs{/sha}","trees_url":"https://api.github.com/repos/bsura/Argus/git/trees{/sha}","statuses_url":"https://api.github.com/repos/bsura/Argus/statuses/{sha}","languages_url":"https://api.github.com/repos/bsura/Argus/languages","stargazers_url":"https://api.github.com/repos/bsura/Argus/stargazers","contributors_url":"https://api.github.com/repos/bsura/Argus/contributors","subscribers_url":"https://api.github.com/repos/bsura/Argus/subscribers","subscription_url":"https://api.github.com/repos/bsura/Argus/subscription","commits_url":"https://api.github.com/repos/bsura/Argus/commits{/sha}","git_commits_url":"https://api.github.com/repos/bsura/Argus/git/commits{/sha}","comments_url":"https://api.github.com/repos/bsura/Argus/comments{/number}","issue_comment_url":"https://api.github.com/repos/bsura/Argus/issues/comments{/number}","contents_url":"https://api.github.com/repos/bsura/Argus/contents/{+path}","compare_url":"https://api.github.com/repos/bsura/Argus/compare/{base}...{head}","merges_url":"https://api.github.com/repos/bsura/Argus/merges","archive_url":"https://api.github.com/repos/bsura/Argus/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/bsura/Argus/downloads","issues_url":"https://api.github.com/repos/bsura/Argus/issues{/number}","pulls_url":"https://api.github.com/repos/bsura/Argus/pulls{/number}","milestones_url":"https://api.github.com/repos/bsura/Argus/milestones{/number}","notifications_url":"https://api.github.com/repos/bsura/Argus/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/bsura/Argus/labels{/name}","releases_url":"https://api.github.com/repos/bsura/Argus/releases{/id}","deployments_url":"https://api.github.com/repos/bsura/Argus/deployments","created_at":"2016-03-08T19:36:38Z","updated_at":"2016-10-27T23:38:37Z","pushed_at":"2017-04-10T23:21:27Z","git_url":"git://github.com/bsura/Argus.git","ssh_url":"git@github.com:bsura/Argus.git","clone_url":"https://github.com/bsura/Argus.git","svn_url":"https://github.com/bsura/Argus","homepage":"","size":3319,"stargazers_count":1,"watchers_count":1,"language":"Java","has_issues":false,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":1,"mirror_url":null,"open_issues_count":0,"forks":1,"open_issues":0,"watchers":1,"default_branch":"master"}},"base":{"label":"salesforce:develop","ref":"develop","sha":"3dce5e05c0ea59c9adbbda1b27c16cbfe391c1df","user":{"login":"salesforce","id":453694,"avatar_url":"https://avatars0.githubusercontent.com/u/453694?v=3","gravatar_id":"","url":"https://api.github.com/users/salesforce","html_url":"https://github.com/salesforce","followers_url":"https://api.github.com/users/salesforce/followers","following_url":"https://api.github.com/users/salesforce/following{/other_user}","gists_url":"https://api.github.com/users/salesforce/gists{/gist_id}","starred_url":"https://api.github.com/users/salesforce/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/salesforce/subscriptions","organizations_url":"https://api.github.com/users/salesforce/orgs","repos_url":"https://api.github.com/users/salesforce/repos","events_url":"https://api.github.com/users/salesforce/events{/privacy}","received_events_url":"https://api.github.com/users/salesforce/received_events","type":"Organization","site_admin":false},"repo":{"id":44994636,"name":"Argus","full_name":"salesforce/Argus","owner":{"login":"salesforce","id":453694,"avatar_url":"https://avatars0.githubusercontent.com/u/453694?v=3","gravatar_id":"","url":"https://api.github.com/users/salesforce","html_url":"https://github.com/salesforce","followers_url":"https://api.github.com/users/salesforce/followers","following_url":"https://api.github.com/users/salesforce/following{/other_user}","gists_url":"https://api.github.com/users/salesforce/gists{/gist_id}","starred_url":"https://api.github.com/users/salesforce/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/salesforce/subscriptions","organizations_url":"https://api.github.com/users/salesforce/orgs","repos_url":"https://api.github.com/users/salesforce/repos","events_url":"https://api.github.com/users/salesforce/events{/privacy}","received_events_url":"https://api.github.com/users/salesforce/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/salesforce/Argus","description":"Time series monitoring and alerting platform.","fork":false,"url":"https://api.github.com/repos/salesforce/Argus","forks_url":"https://api.github.com/repos/salesforce/Argus/forks","keys_url":"https://api.github.com/repos/salesforce/Argus/keys{/key_id}","collaborators_url":"https://api.github.com/repos/salesforce/Argus/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/salesforce/Argus/teams","hooks_url":"https://api.github.com/repos/salesforce/Argus/hooks","issue_events_url":"https://api.github.com/repos/salesforce/Argus/issues/events{/number}","events_url":"https://api.github.com/repos/salesforce/Argus/events","assignees_url":"https://api.github.com/repos/salesforce/Argus/assignees{/user}","branches_url":"https://api.github.com/repos/salesforce/Argus/branches{/branch}","tags_url":"https://api.github.com/repos/salesforce/Argus/tags","blobs_url":"https://api.github.com/repos/salesforce/Argus/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/salesforce/Argus/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/salesforce/Argus/git/refs{/sha}","trees_url":"https://api.github.com/repos/salesforce/Argus/git/trees{/sha}","statuses_url":"https://api.github.com/repos/salesforce/Argus/statuses/{sha}","languages_url":"https://api.github.com/repos/salesforce/Argus/languages","stargazers_url":"https://api.github.com/repos/salesforce/Argus/stargazers","contributors_url":"https://api.github.com/repos/salesforce/Argus/contributors","subscribers_url":"https://api.github.com/repos/salesforce/Argus/subscribers","subscription_url":"https://api.github.com/repos/salesforce/Argus/subscription","commits_url":"https://api.github.com/repos/salesforce/Argus/commits{/sha}","git_commits_url":"https://api.github.com/repos/salesforce/Argus/git/commits{/sha}","comments_url":"https://api.github.com/repos/salesforce/Argus/comments{/number}","issue_comment_url":"https://api.github.com/repos/salesforce/Argus/issues/comments{/number}","contents_url":"https://api.github.com/repos/salesforce/Argus/contents/{+path}","compare_url":"https://api.github.com/repos/salesforce/Argus/compare/{base}...{head}","merges_url":"https://api.github.com/repos/salesforce/Argus/merges","archive_url":"https://api.github.com/repos/salesforce/Argus/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/salesforce/Argus/downloads","issues_url":"https://api.github.com/repos/salesforce/Argus/issues{/number}","pulls_url":"https://api.github.com/repos/salesforce/Argus/pulls{/number}","milestones_url":"https://api.github.com/repos/salesforce/Argus/milestones{/number}","notifications_url":"https://api.github.com/repos/salesforce/Argus/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/salesforce/Argus/labels{/name}","releases_url":"https://api.github.com/repos/salesforce/Argus/releases{/id}","deployments_url":"https://api.github.com/repos/salesforce/Argus/deployments","created_at":"2015-10-26T20:17:17Z","updated_at":"2017-04-09T08:13:02Z","pushed_at":"2017-04-12T21:29:26Z","git_url":"git://github.com/salesforce/Argus.git","ssh_url":"git@github.com:salesforce/Argus.git","clone_url":"https://github.com/salesforce/Argus.git","svn_url":"https://github.com/salesforce/Argus","homepage":"","size":5389,"stargazers_count":227,"watchers_count":227,"language":"Java","has_issues":true,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":true,"forks_count":63,"mirror_url":null,"open_issues_count":17,"forks":63,"open_issues":17,"watchers":227,"default_branch":"develop"}},"_links":{"self":{"href":"https://api.github.com/repos/salesforce/Argus/pulls/518"},"html":{"href":"https://github.com/salesforce/Argus/pull/518"},"issue":{"href":"https://api.github.com/repos/salesforce/Argus/issues/518"},"comments":{"href":"https://api.github.com/repos/salesforce/Argus/issues/518/comments"},"review_comments":{"href":"https://api.github.com/repos/salesforce/Argus/pulls/518/comments"},"review_comment":{"href":"https://api.github.com/repos/salesforce/Argus/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/salesforce/Argus/pulls/518/commits"},"statuses":{"href":"https://api.github.com/repos/salesforce/Argus/statuses/2038c3da97d453106973bf0dc3be4b7f7444d700"}}}}
{"actor":{"display_login":"dilipdevaraj-sfdc"}}