SecurityContextHolder with AbstractPreAuthenticatedProcessingFilter

Hi,

I’m trying to rate limit my API using an API key from the URL I have my API secured by an API key using this method:

@Configuration
@EnableWebSecurity
public class APISecurityConfig extends WebSecurityConfigurerAdapter {

    @Value("${principal.hashed.key}")
    private String principalHashedKey;

    @Override
    protected void configure(HttpSecurity httpSecurity) throws Exception {
        APIKeyAuthFilter filter = new APIKeyAuthFilter();

        filter.setAuthenticationManager(authentication -> {
            String urlApiKey = (String) authentication.getPrincipal();
            if (!BCrypt.checkpw(urlApiKey, principalHashedKey)) {
                throw new BadCredentialsException("The API key was not found or not the expected value.");
            }
            authentication.setAuthenticated(true);
            return authentication;
        });

        httpSecurity
                .csrf()
                .disable()
                .authorizeRequests()
                .antMatchers("/v3/api-docs/**", "/swagger-ui/**", "/swagger-ui.html", "/documentation.html")
                .permitAll()
                .anyRequest()
                .authenticated()
                .and()
                .addFilter(filter)
                .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);
    }

}

and the filter:

public class APIKeyAuthFilter extends AbstractPreAuthenticatedProcessingFilter {

    @Override
    protected Object getPreAuthenticatedPrincipal(HttpServletRequest request) {
        return request.getParameter("api_key");
    }

    @Override
    protected Object getPreAuthenticatedCredentials(HttpServletRequest request) {
        return "N/A";
    }

}

What is happening is I’m getting the api_key from the url and then check it against the hashed api_key. If they match then the request passes. Everithing works well.

My problem is that when using this: bucket4j.filters[0].rate-limits[0].execute-condition=@securityService.isAuthorized()

@Service
public class SecurityService {

    public boolean isAuthorized() {
        return SecurityContextHolder.getContext().getAuthentication() != null &&
                SecurityContextHolder.getContext().getAuthentication().isAuthenticated();
    }

}

the SecurityContextHolder.getContext().getAuthentication() is always null but if I try to use it in my controller it is not null anymore. I guess it has something to do with the fact that I’m using a filter and not the classic approach with username and pass. Is there something I can do to get the status of auth?

[majoer]

Took me a day to figure it out. This post made me realize that Spring security context is only accessible after some security filter has been applied first. Depending on how many filters you have, filter-order must be high enough, so that Spring security context is available when the Bucket4J filter is applied.

bucket4j:
  enabled: true
  filters:
    - cache-name: requests
      filter-order: 1000 # <-- This must be greater that whatever filter initializes Spring Security Context
      url: .*
      rate-limits:
        - expression: "@authorizationService.subClaim()"
          bandwidths:
            - capacity: 5
              time: 10
              unit: seconds

[cod-r]

I solved my issue by adding this line in spring security config class:

.addFilterAfter(context.getBean(ServletRequestFilter.class), APIKeyAuthFilter.class)

and have the filter order set to a high value. The class looks like this now:

@Configuration
@EnableWebSecurity
public class APISecurityConfig extends WebSecurityConfigurerAdapter {

    @Value("${principal.hashed.key}")
    private String principalHashedKey;

    @Autowired
    private ApplicationContext context;

    @Override
    protected void configure(HttpSecurity httpSecurity) throws Exception {
        APIKeyAuthFilter filter = new APIKeyAuthFilter();

        filter.setAuthenticationManager(authentication -> {
            String urlApiKey = (String) authentication.getPrincipal();
            if (!BCrypt.checkpw(urlApiKey, principalHashedKey)) {
                throw new BadCredentialsException("The API key was not found or not the expected value.");
            }
            authentication.setAuthenticated(true);
            return authentication;
        });

        httpSecurity
                .csrf()
                .disable()
                .authorizeRequests()
                .antMatchers("/v3/api-docs/**", "/swagger-ui/**", "/swagger-ui.html", "/documentation.html")
                .permitAll()
                .anyRequest()
                .authenticated()
                .and()
                .addFilter(filter)
                .addFilterAfter(context.getBean(ServletRequestFilter.class), APIKeyAuthFilter.class)
                .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);
    }

}

So now I have the ServletRequestFilter registered in the springSecurityFilterChain and once again after it. This was the only combination I found that worked for my case. The full code is here: https://github.com/cod-r/docs