Jersey ContainerResponseFilter not applied to all responses - filter

Question

I have a Dropwizard 1.0.0 application, using a ContainerResponseFilter I expect to see a series of headers applied to each resource - however I only see them applied to the root level document.
Filter class:
package com.uk.jacob.filters;
import javax.ws.rs.container.ContainerRequestContext;
import javax.ws.rs.container.ContainerResponseContext;
import javax.ws.rs.container.ContainerResponseFilter;
import javax.ws.rs.core.MultivaluedMap;
import java.io.IOException;
public class SecurityFilter implements ContainerResponseFilter {
#Override
public void filter(ContainerRequestContext containerRequestContext, ContainerResponseContext containerResponseContext) throws IOException {
MultivaluedMap<String, Object> headers = containerResponseContext.getHeaders();
headers.add("strict-transport-security", "max-age=31536000");
headers.add("x-content-type-options", "nosniff");
headers.add("x-frame-options", "SAMEORIGIN");
headers.add("x-xss-protection", "1; mode=block");
}
}
Application class:
package com.uk.jacob;
import com.uk.jacob.filters.SecurityFilter;
import com.uk.jacob.resources.HomepageResource;
import io.dropwizard.Application;
import io.dropwizard.assets.AssetsBundle;
import io.dropwizard.client.HttpClientBuilder;
import io.dropwizard.setup.Bootstrap;
import io.dropwizard.setup.Environment;
import io.dropwizard.views.ViewBundle;
import org.apache.http.client.HttpClient;
public class websiteApplication extends Application<websiteConfiguration> {
public static void main(final String[] args) throws Exception {
new websiteApplication().run(args);
}
#Override
public String getName() {
return "website";
}
#Override
public void initialize(final Bootstrap<websiteConfiguration> bootstrap) {
bootstrap.addBundle(new ViewBundle<websiteConfiguration>());
bootstrap.addBundle(new AssetsBundle("/public/", "/public"));
}
#Override
public void run(final websiteConfiguration configuration, final Environment environment) {
final HttpClient httpClient = new HttpClientBuilder(environment).using(configuration.getHttpClientConfiguration()).build(getName());
environment.jersey().register(new SecurityFilter());
environment.jersey().register(new HomepageResource(httpClient));
}
}

Answer 1

your issue is the AssetBundle. AssetBundles are separate servlets, they do not go through the jersey eco-system. From the source:
#Override
public void run(Environment environment) {
LOGGER.info("Registering AssetBundle with name: {} for path {}", assetsName, uriPath + '*');
environment.servlets().addServlet(assetsName, createServlet()).addMapping(uriPath + '*');
}
This is why your filter is not called on an asset resource. The solution to this would be to write an extra ServletFilter (old style) that filters asset requests and adds your headers there.
In Order to also add your headers to your asset bundles you must use a normal servlet filter and register it with DW:
Here is the code for my ServletFilter:
public class ServletRequestFilter implements Filter {
#Override
public void init(FilterConfig filterConfig) throws ServletException {
}
#Override
public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
throws IOException, ServletException {
System.out.println("Asset filter");
HttpServletResponse httpServletResponse = ((HttpServletResponse) response);
httpServletResponse.addHeader("ARTUR", "test");
chain.doFilter(request, httpServletResponse);
}
#Override
public void destroy() {
}
}
This is then register as follows:
public class ViewApplication extends io.dropwizard.Application<Configuration>{
#Override
public void run(Configuration configuration, Environment environment) throws Exception {
environment.jersey().register(ViewResource.class);
environment.jersey().register(HeaderResponseFilter.class);
environment.servlets().addFilter("Custom-Filter-Name", new ServletRequestFilter()).addMappingForUrlPatterns(EnumSet.allOf(DispatcherType.class), true, "/assets/*");
}
#Override
public void initialize(Bootstrap<Configuration> bootstrap) {
super.initialize(bootstrap);
bootstrap.addBundle(new ViewBundle<>());
bootstrap.addBundle(new AssetsBundle("/assets/", "/assets"));
}
public static void main(String[] args) throws Exception {
new ViewApplication().run("server", "/home/artur/dev/repo/sandbox/src/main/resources/config/test.yaml");
}
}
Note: I am registering an asset bundle for the urls in /assets/. This is also noted in the registration of my filter (which filters only assets resources). Alternatively, you can match it on all calls and filter everything through that (that way you can get rid of the jersey counterpart I believe).
Finally the test for my resource:
artur#pandaadb:~/dev/repo/sandbox$ curl -v "http://localhost:9085/assets/test.txt"
* Trying 127.0.0.1...
* Connected to localhost (127.0.0.1) port 9085 (#0)
> GET /assets/test.txt HTTP/1.1
> Host: localhost:9085
> User-Agent: curl/7.47.0
> Accept: */*
>
< HTTP/1.1 200 OK
< Date: Mon, 19 Sep 2016 15:07:13 GMT
< ARTUR: test
< Last-Modified: Mon, 19 Sep 2016 14:52:37 GMT
< ETag: "0d1ae97d61a8900c99abddb8741febaf"
< Content-Type: text/plain;charset=utf-8
< Vary: Accept-Encoding
< Content-Length: 11
<
asd
asd
* Connection #0 to host localhost left intact
Note my custom Header ARTUR: test
Regards,
artur