Whitelist for anonymous access

Support
1

Hello everyone!

I have a problem to allow access to a resource only from a specific list of ip addresses. I can specify in application.properties the urls of resources to which I can grant anonymous access, but can I additionally specify which ip addresses can get anonymous access to these resources?

Thank you for your help!

3

An important addition:
The list of ip addresses should be possible to change dynamically

4

Hi,

Jmix doesn’t have this functionality out of the box. You may implement in your project.

The most straightforward way is to register a servlet filter that will analyze the IP address, e.g.:

public class MyIpFilter extends OncePerRequestFilter {

    @Override
    protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws IOException, ServletException {
        if (matches(request, "0:0:0:0:0:0:0:1")) {
            filterChain.doFilter(request, response);
        }
    }

    private boolean matches(HttpServletRequest request, String ipAddress) {
        IpAddressMatcher ipAddressMatcher = new IpAddressMatcher(ipAddress);
        return ipAddressMatcher.matches(request);
    }
}

@Configuration
public class MyConfiguration {

    @Bean
    public FilterRegistrationBean<MyIpFilter> loggingFilter(){
        FilterRegistrationBean<MyIpFilter> registrationBean = new FilterRegistrationBean<>();
        registrationBean.setFilter(new MyIpFilter());
        registrationBean.addUrlPatterns("/hello/*");
        return registrationBean;
    }
}