Tomcat 10.1.19 · org.apache.catalina.valves.RequestFilterValve

Implementation of a Valve that performs filtering based on comparing the appropriate request property (selected based on which subclass you choose to configure into your Container's pipeline) against the regular expressions configured for this Valve.

This valve is configured by setting the allow and/or deny properties to a regular expressions (in the syntax supported by Pattern) to which the appropriate request property will be compared. Evaluation proceeds as follows:

The subclass extracts the request property to be filtered, and calls the common process() method.
If there is a deny expression configured, the property will be compared to the expression. If a match is found, this request will be rejected with a "Forbidden" HTTP response.
If there is a allow expression configured, the property will be compared to each such expression. If a match is found, this request will be allowed to pass through to the next Valve in the current pipeline.
If a deny expression was specified but no allow expression, allow this request to pass through (because none of the deny expressions matched it).
The request will be rejected with a "Forbidden" HTTP response.

As an option the valve can generate an invalid authenticate header instead of denying the request. This can be combined with the context attribute preemptiveAuthentication="true" and an authenticator to force authentication instead of denial.

This Valve may be attached to any Container, depending on the granularity of the filtering you wish to perform.

Field Summary

Modifier and Type	Field and Description
private volatile boolean	addConnectorPort Flag deciding whether we add the server connector port to the property compared in the filtering method.
protected volatile Pattern	allow The regular expression used to test for allowed requests.
protected volatile boolean	allowValid Helper variable to catch configuration errors.
protected volatile String	allowValue The current allow configuration value that may or may not compile into a valid `Pattern`.
protected volatile Pattern	deny The regular expression used to test for denied requests.
protected int	denyStatus The HTTP response status code that is used when rejecting denied request.
protected volatile boolean	denyValid Helper variable to catch configuration errors.
protected volatile String	denyValue The current deny configuration value that may or may not compile into a valid `Pattern`.
private boolean	invalidAuthenticationWhenDeny If `invalidAuthenticationWhenDeny` is true and the context has `preemptiveAuthentication` set, set an invalid authorization header to trigger basic auth instead of denying the request..
private volatile boolean	usePeerAddress Flag deciding whether we use the connection peer address or the remote address.

Inherited from org.apache.catalina.valves.ValveBase:: asyncSupported container containerLog next sm

Constructor Summary

Access	Constructor and Description
public	RequestFilterValve()

Method Summary

Modifier and Type	Method and Description
protected void	denyRequest(Request The servlet request to be processed request, Response The servlet response to be processed response) Reject the request that was denied by this valve.
public boolean	Returns: `true` to add the connector port getAddConnectorPort() Get the flag deciding whether we add the server connector port to the property compared in the filtering method.
public String	Returns: the regular expression getAllow() Return the regular expression used to test for allowed requests for this Valve, if any; otherwise, return `null`.
public String	Returns: the regular expression getDeny() Return the regular expression used to test for denied requests for this Valve, if any; otherwise, return `null`.
public int	Returns: response status code that is used to reject denied request. getDenyStatus()
public boolean	Returns: `true` if a deny is handled by setting an invalid auth header. getInvalidAuthenticationWhenDeny()
protected abstract Log	getLog()
public boolean	Returns: `true` if we use the connection peer address getUsePeerAddress() Get the flag deciding whether we use the connection peer address or the remote address.
protected void	initInternal() Overrides org.apache.catalina.valves.ValveBase.initInternal. Sub-classes wishing to perform additional initialization should override this method, ensuring that super.initInternal() is the first call in the overriding method.
public abstract void	invoke(Request The servlet request to be processed request, Response The servlet response to be created response) Redeclares org.apache.catalina.Valve.invoke. Extract the desired request property, and pass it (along with the specified request and response objects) to the protected `process()` method to perform the actual filtering.
public boolean	Returns: `true` if the request is allowed isAllowed(String The request property value on which to filter property) Perform the test implemented by this Valve, matching against the specified request property value.
public final boolean	Returns: `false` if the current pattern is invalid isAllowValid() Returns `false` if the last change to the `allow` pattern did not apply successfully.
public final boolean	Returns: `false` if the current pattern is invalid isDenyValid() Returns `false` if the last change to the `deny` pattern did not apply successfully.
protected void	process(String The request property on which to filter property, Request The servlet request to be processed request, Response The servlet response to be processed response) Perform the filtering that has been configured for this Valve, matching against the specified request property.
public void	setAddConnectorPort(boolean The new flag addConnectorPort) Set the flag deciding whether we add the server connector port to the property compared in the filtering method.
public void	setAllow(String The new allow expression allow) Set the regular expression used to test for allowed requests for this Valve, if any.
public void	setDeny(String The new deny expression deny) Set the regular expression used to test for denied requests for this Valve, if any.
public void	setDenyStatus(int The status code denyStatus) Set response status code that is used to reject denied request.
public void	setInvalidAuthenticationWhenDeny(boolean `true` to handle a deny by setting an invalid auth header value) Set invalidAuthenticationWhenDeny property.
public void	setUsePeerAddress(boolean The new flag usePeerAddress) Set the flag deciding whether we use the connection peer address or the remote address.
protected void	startInternal() Overrides org.apache.catalina.valves.ValveBase.startInternal. Start this component and implement the requirements of `org.apache.catalina.util.LifecycleBase#startInternal()`.

Inherited from org.apache.catalina.valves.ValveBase:: backgroundProcess getContainer getDomainInternal getNext getObjectNameKeyProperties isAsyncSupported setAsyncSupported setContainer setNext stopInternal toString

Field Detail

addConnectorPort	back to summary
private volatile boolean addConnectorPort Flag deciding whether we add the server connector port to the property compared in the filtering method. The port will be appended using a ";" as a separator.

allow	back to summary
protected volatile Pattern allow The regular expression used to test for allowed requests.

allowValid	back to summary
protected volatile boolean allowValid Helper variable to catch configuration errors. It is `true` by default, but becomes `false` if there was an attempt to assign an invalid value to the `allow` pattern.

allowValue	back to summary
protected volatile String allowValue The current allow configuration value that may or may not compile into a valid `Pattern`.

deny	back to summary
protected volatile Pattern deny The regular expression used to test for denied requests.

denyStatus	back to summary
protected int denyStatus The HTTP response status code that is used when rejecting denied request. It is 403 by default, but may be changed to be 404.

denyValid	back to summary
protected volatile boolean denyValid Helper variable to catch configuration errors. It is `true` by default, but becomes `false` if there was an attempt to assign an invalid value to the `deny` pattern.

denyValue	back to summary
protected volatile String denyValue The current deny configuration value that may or may not compile into a valid `Pattern`.

invalidAuthenticationWhenDeny	back to summary
private boolean invalidAuthenticationWhenDeny If `invalidAuthenticationWhenDeny` is true and the context has `preemptiveAuthentication` set, set an invalid authorization header to trigger basic auth instead of denying the request..

usePeerAddress	back to summary
private volatile boolean usePeerAddress Flag deciding whether we use the connection peer address or the remote address. This makes a dfifference when using AJP or the RemoteIpValve.

Constructor Detail

RequestFilterValve	back to summary
public RequestFilterValve()

Method Detail

denyRequest back to summary

denyRequest	back to summary
protected void denyRequest(Request request, Response response) throws IOException, ServletException Reject the request that was denied by this valve. If `invalidAuthenticationWhenDeny` is true and the context has `preemptiveAuthentication` set, set an invalid authorization header to trigger basic auth. Parameters request:Request The servlet request to be processed response:Response The servlet response to be processed Exceptions IOException: if an input/output error occurs ServletException: if a servlet error occurs

protected void denyRequest(Request request, Response response) throws IOException, ServletException

Reject the request that was denied by this valve.

If invalidAuthenticationWhenDeny is true and the context has preemptiveAuthentication set, set an invalid authorization header to trigger basic auth.

Parameters

request:Request: The servlet request to be processed
response:Response: The servlet response to be processed

Exceptions

IOException:: if an input/output error occurs
ServletException:: if a servlet error occurs

getAddConnectorPort back to summary

getAddConnectorPort	back to summary
public boolean getAddConnectorPort() Get the flag deciding whether we add the server connector port to the property compared in the filtering method. The port will be appended using a ";" as a separator. Returns:boolean `true` to add the connector port

public boolean getAddConnectorPort()

Get the flag deciding whether we add the server connector port to the property compared in the filtering method. The port will be appended using a ";" as a separator.

Returns:boolean: true to add the connector port

getAllow back to summary

getAllow	back to summary
public String getAllow() Return the regular expression used to test for allowed requests for this Valve, if any; otherwise, return `null`. Returns:String the regular expression

public String getAllow()

Return the regular expression used to test for allowed requests for this Valve, if any; otherwise, return null.

Returns:String: the regular expression

getDeny back to summary

getDeny	back to summary
public String getDeny() Return the regular expression used to test for denied requests for this Valve, if any; otherwise, return `null`. Returns:String the regular expression

public String getDeny()

Return the regular expression used to test for denied requests for this Valve, if any; otherwise, return null.

Returns:String: the regular expression

getDenyStatus	back to summary
public int getDenyStatus() Returns:int response status code that is used to reject denied request.

getInvalidAuthenticationWhenDeny	back to summary
public boolean getInvalidAuthenticationWhenDeny() Returns:boolean `true` if a deny is handled by setting an invalid auth header.

getLog	back to summary
protected abstract Log getLog()

getUsePeerAddress back to summary

getUsePeerAddress	back to summary
public boolean getUsePeerAddress() Get the flag deciding whether we use the connection peer address or the remote address. This makes a dfifference when using AJP or the RemoteIpValve. Returns:boolean `true` if we use the connection peer address

public boolean getUsePeerAddress()

Get the flag deciding whether we use the connection peer address or the remote address. This makes a dfifference when using AJP or the RemoteIpValve.

Returns:boolean: true if we use the connection peer address

initInternal	back to summary
protected void initInternal() throws LifecycleException Overrides org.apache.catalina.valves.ValveBase.initInternal. Doc from org.apache.catalina.util.LifecycleMBeanBase.initInternal. Sub-classes wishing to perform additional initialization should override this method, ensuring that super.initInternal() is the first call in the overriding method. Annotations @Override Exceptions LifecycleException: Doc from org.apache.catalina.util.LifecycleBase.initInternal. If the initialisation fails

initInternal

back to summary

protected void initInternal() throws LifecycleException

Overrides org.apache.catalina.valves.ValveBase.initInternal.

Doc from org.apache.catalina.util.LifecycleMBeanBase.initInternal.

Sub-classes wishing to perform additional initialization should override this method, ensuring that super.initInternal() is the first call in the overriding method.

Annotations

@Override

Exceptions

LifecycleException:

Doc from org.apache.catalina.util.LifecycleBase.initInternal.

If the initialisation fails

invoke back to summary

invoke	back to summary
public abstract void invoke(Request request, Response response) throws IOException, ServletException Redeclares org.apache.catalina.Valve.invoke. Extract the desired request property, and pass it (along with the specified request and response objects) to the protected `process()` method to perform the actual filtering. This method must be implemented by a concrete subclass. Parameters request:Request The servlet request to be processed response:Response The servlet response to be created Annotations @Override Exceptions IOException: if an input/output error occurs ServletException: if a servlet error occurs

public abstract void invoke(Request request, Response response) throws IOException, ServletException

Redeclares org.apache.catalina.Valve.invoke.

Extract the desired request property, and pass it (along with the specified request and response objects) to the protected process() method to perform the actual filtering. This method must be implemented by a concrete subclass.

Parameters

request:Request: The servlet request to be processed
response:Response: The servlet response to be created

Annotations

@Override

Exceptions

IOException:: if an input/output error occurs
ServletException:: if a servlet error occurs

isAllowed back to summary

isAllowed	back to summary
public boolean isAllowed(String property) Perform the test implemented by this Valve, matching against the specified request property value. This method is public so that it can be called through JMX, e.g. to test whether certain IP address is allowed or denied by the valve configuration. Parameters property:String The request property value on which to filter Returns:boolean `true` if the request is allowed

public boolean isAllowed(String property)

Perform the test implemented by this Valve, matching against the specified request property value. This method is public so that it can be called through JMX, e.g. to test whether certain IP address is allowed or denied by the valve configuration.

Parameters

property:String: The request property value on which to filter

Returns:boolean

true if the request is allowed

isAllowValid back to summary

isAllowValid	back to summary
public final boolean isAllowValid() Returns `false` if the last change to the `allow` pattern did not apply successfully. E.g. if the pattern is syntactically invalid. Returns:boolean `false` if the current pattern is invalid

public final boolean isAllowValid()

Returns false if the last change to the allow pattern did not apply successfully. E.g. if the pattern is syntactically invalid.

Returns:boolean: false if the current pattern is invalid

isDenyValid back to summary

isDenyValid	back to summary
public final boolean isDenyValid() Returns `false` if the last change to the `deny` pattern did not apply successfully. E.g. if the pattern is syntactically invalid. Returns:boolean `false` if the current pattern is invalid

public final boolean isDenyValid()

Returns false if the last change to the deny pattern did not apply successfully. E.g. if the pattern is syntactically invalid.

Returns:boolean: false if the current pattern is invalid

process	back to summary
protected void process(String property, Request request, Response response) throws IOException, ServletException Perform the filtering that has been configured for this Valve, matching against the specified request property. Parameters property:String The request property on which to filter request:Request The servlet request to be processed response:Response The servlet response to be processed Exceptions IOException: if an input/output error occurs ServletException: if a servlet error occurs

process

back to summary

protected void process(String property, Request request, Response response) throws IOException, ServletException

Perform the filtering that has been configured for this Valve, matching against the specified request property.

Parameters

property:String: The request property on which to filter
request:Request: The servlet request to be processed
response:Response: The servlet response to be processed

Exceptions

IOException:: if an input/output error occurs
ServletException:: if a servlet error occurs

setAddConnectorPort	back to summary
public void setAddConnectorPort(boolean addConnectorPort) Set the flag deciding whether we add the server connector port to the property compared in the filtering method. The port will be appended using a ";" as a separator. Parameters addConnectorPort:boolean The new flag

setAddConnectorPort

back to summary

public void setAddConnectorPort(boolean addConnectorPort)

Set the flag deciding whether we add the server connector port to the property compared in the filtering method. The port will be appended using a ";" as a separator.

Parameters

addConnectorPort:boolean: The new flag

setAllow	back to summary
public void setAllow(String allow) Set the regular expression used to test for allowed requests for this Valve, if any. Parameters allow:String The new allow expression

setAllow

back to summary

public void setAllow(String allow)

Set the regular expression used to test for allowed requests for this Valve, if any.

Parameters

allow:String: The new allow expression

setDeny	back to summary
public void setDeny(String deny) Set the regular expression used to test for denied requests for this Valve, if any. Parameters deny:String The new deny expression

setDeny

back to summary

public void setDeny(String deny)

Set the regular expression used to test for denied requests for this Valve, if any.

Parameters

deny:String: The new deny expression

setDenyStatus	back to summary
public void setDenyStatus(int denyStatus) Set response status code that is used to reject denied request. Parameters denyStatus:int The status code

setDenyStatus

back to summary

public void setDenyStatus(int denyStatus)

Set response status code that is used to reject denied request.

Parameters

denyStatus:int: The status code

setInvalidAuthenticationWhenDeny back to summary

setInvalidAuthenticationWhenDeny	back to summary
public void setInvalidAuthenticationWhenDeny(boolean value) Set invalidAuthenticationWhenDeny property. Parameters value:boolean `true` to handle a deny by setting an invalid auth header

public void setInvalidAuthenticationWhenDeny(boolean value)

Set invalidAuthenticationWhenDeny property.

Parameters

value:boolean: true to handle a deny by setting an invalid auth header

setUsePeerAddress	back to summary
public void setUsePeerAddress(boolean usePeerAddress) Set the flag deciding whether we use the connection peer address or the remote address. This makes a dfifference when using AJP or the RemoteIpValve. Parameters usePeerAddress:boolean The new flag

setUsePeerAddress

back to summary

public void setUsePeerAddress(boolean usePeerAddress)

Set the flag deciding whether we use the connection peer address or the remote address. This makes a dfifference when using AJP or the RemoteIpValve.

Parameters

usePeerAddress:boolean: The new flag

startInternal back to summary

startInternal	back to summary
protected void startInternal() throws LifecycleException Overrides org.apache.catalina.valves.ValveBase.startInternal. Doc from org.apache.catalina.valves.ValveBase.startInternal. Start this component and implement the requirements of `org.apache.catalina.util.LifecycleBase#startInternal()`. Annotations @Override Exceptions LifecycleException: if this component detects a fatal error that prevents this component from being used

protected void startInternal() throws LifecycleException

Overrides org.apache.catalina.valves.ValveBase.startInternal.

Doc from org.apache.catalina.valves.ValveBase.startInternal.

Start this component and implement the requirements of org.apache.catalina.util.LifecycleBase#startInternal().

Annotations

@Override

Exceptions

LifecycleException:: if this component detects a fatal error that prevents this component from being used

public abstract Class RequestFilterValve

Field Summary

Constructor Summary

Method Summary

Field Detail

Constructor Detail

Method Detail