Open source, commercial support.

Permission Dependent Resources

Community provided content
Register
New page Edit

Normally, a URL identifies a resource in all circumstances. This is largely the intent of the HTTP specification, and Milton is designed to support this approach.

But an often encountered use case is where resources depend on the currently logged in user. Milton can be made to work this way although its a bit tricky.

Start by integrating PreAuthenticationFilter (in com.bradmcevoy.http.http11.auth). This will ensure that the current user is known prior to resource location. PreAuthenticationFilter will use the standard AuthenticationHandler mechanism to authenticate, but since no resource has yet been resolved a null will be passed in its place. So you must use AuthenticationHandler's which don't reference the resource.

Then you can get a reference to the current user in your resource factory using

User user = (User)HttpManager.request().getAuth().getTag(); // Assumes you have some class called User

You can then implement the logic in your resource manager as you see fit. Note that you should ensure that the same logic is used in your CollectionResource.getChildren() method

 

blog comments powered by Disqus