Hello everyone!
I have a problem to allow access to a resource only from a specific list of ip addresses. I can specify in application.properties the urls of resources to which I can grant anonymous access, but can I additionally specify which ip addresses can get anonymous access to these resources?
Thank you for your help!
An important addition:
The list of ip addresses should be possible to change dynamically
Hi,
Jmix doesn’t have this functionality out of the box. You may implement in your project.
The most straightforward way is to register a servlet filter that will analyze the IP address, e.g.:
public class MyIpFilter extends OncePerRequestFilter {
@Override
protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws IOException, ServletException {
if (matches(request, "0:0:0:0:0:0:0:1")) {
filterChain.doFilter(request, response);
}
}
private boolean matches(HttpServletRequest request, String ipAddress) {
IpAddressMatcher ipAddressMatcher = new IpAddressMatcher(ipAddress);
return ipAddressMatcher.matches(request);
}
}
@Configuration
public class MyConfiguration {
@Bean
public FilterRegistrationBean<MyIpFilter> loggingFilter(){
FilterRegistrationBean<MyIpFilter> registrationBean = new FilterRegistrationBean<>();
registrationBean.setFilter(new MyIpFilter());
registrationBean.addUrlPatterns("/hello/*");
return registrationBean;
}
}