Example usage for org.springframework.http HttpStatus FORBIDDEN

Introduction

In this page you can find the example usage for org.springframework.http HttpStatus FORBIDDEN.

Prototype

HttpStatus FORBIDDEN

To view the source code for org.springframework.http HttpStatus FORBIDDEN.

Click Source Link

Document

403 Forbidden .

Usage

From source file:org.geowebcache.rest.controller.ByteStreamController.java

@RequestMapping(value = "/web/**", method = RequestMethod.GET)
ResponseEntity<?> doGet(HttpServletRequest request, HttpServletResponse response) {

    final String filename;
    try {//ww w .  j a v  a  2s  .c o  m
        filename = URLDecoder.decode(request.getPathInfo().substring("/rest/web/".length()), "UTF-8");
    } catch (UnsupportedEncodingException e1) {
        throw new IllegalStateException("Cound not decode encoding UTF-8", e1); // Should never happen
    }

    // Just to make sure we don't allow access to arbitrary resources
    if (UNSAFE_RESOURCE.matcher(filename).find()) {
        return new ResponseEntity<Object>(HttpStatus.FORBIDDEN);
    }

    URL resource = getResource(filename);
    if (resource == null) {
        return new ResponseEntity<Object>(HttpStatus.NOT_FOUND);
    }

    String[] filenameParts = filename.split("\\.");
    String extension = filenameParts[filenameParts.length - 1];

    MimeType mime = null;
    try {
        mime = MimeType.createFromExtension(extension);
    } catch (MimeException e) {
        return new ResponseEntity<Object>("Unable to create MimeType for " + extension,
                HttpStatus.INTERNAL_SERVER_ERROR);
    }

    // TODO write ByteArrayOutputStream ResponseEntity

    response.setContentType(mime.getFormat());
    try (InputStream inputStream = resource.openStream();
            ServletOutputStream outputStream = response.getOutputStream();) {
        StreamUtils.copy(inputStream, outputStream);
    } catch (IOException e) {
        return new ResponseEntity<Object>("Internal error", HttpStatus.INTERNAL_SERVER_ERROR);
    }

    return new ResponseEntity<Object>(HttpStatus.OK);
}

---

From source file:org.igov.service.business.action.task.core.ActionTaskService.java

public static List<Map<String, String>> amFieldMessageQuestion(String saField, Boolean bNew)
        throws CommonServiceException {
    if (saField == null || "".equals(saField.trim()) || "[]".equals(saField.trim())) {
        throw new CommonServiceException(ExceptionCommonController.BUSINESS_ERROR_CODE,
                "Can't make task question with no fields! (saField=" + saField + ")", HttpStatus.FORBIDDEN);
    }/*from  w w  w  .  ja va2s  .c o  m*/
    List<Map<String, String>> amReturn = new LinkedList();
    JSONObject oFields = new JSONObject("{ \"soData\":" + saField + "}");
    JSONArray aField = oFields.getJSONArray("soData");
    if (aField.length() == 0) {
        throw new CommonServiceException(ExceptionCommonController.BUSINESS_ERROR_CODE,
                "Can't make task question with no fields! (saField=" + saField + ")", HttpStatus.FORBIDDEN);
    }
    for (int i = 0; i < aField.length(); i++) {
        JSONObject oField = aField.getJSONObject(i);
        Map<String, String> m = new HashMap();

        Object osID;
        if ((osID = oField.opt("sID")) == null) {
            if ((osID = oField.opt("id")) == null) {
                throw new CommonServiceException(ExceptionCommonController.BUSINESS_ERROR_CODE,
                        "Field sID and id of array is null", HttpStatus.FORBIDDEN);
            }
        }
        m.put("sID", osID.toString());

        Object osName;
        if ((osName = oField.opt("sName")) == null) {
            osName = osID.toString();
        }
        m.put("sName", osName.toString());

        Object osValue;
        if ((osValue = oField.opt("sValue")) == null) {
            if ((osValue = oField.opt("value")) == null) {
                throw new CommonServiceException(ExceptionCommonController.BUSINESS_ERROR_CODE,
                        "Field sValue and value of array is null", HttpStatus.FORBIDDEN);
            }
        }
        m.put("sValue", osValue.toString());

        if (bNew) {
            Object osValueNew;
            if ((osValueNew = oField.opt("sValueNew")) == null) {
                throw new CommonServiceException(ExceptionCommonController.BUSINESS_ERROR_CODE,
                        "Field sValueNew of array is null", HttpStatus.FORBIDDEN);
            }
            m.put("sValueNew", osValueNew.toString());
        } else {
            Object osNotify;
            if ((osNotify = oField.opt("sNotify")) == null) {
                throw new CommonServiceException(ExceptionCommonController.BUSINESS_ERROR_CODE,
                        "Field sNotify of array is null", HttpStatus.FORBIDDEN);
            }
            m.put("sNotify", osNotify.toString());
        }
        amReturn.add(m);
    }
    return amReturn;
}

---

From source file:org.kaaproject.kaa.server.control.AbstractTestControlServer.java

/**
 * Check forbidden./*  w  w w. j  a  v a 2 s.com*/
 *
 * @param restCall the rest call
 * @throws Exception the exception
 */
protected void checkForbidden(TestRestCall restCall) throws Exception {
    checkRestErrorStatusCode(restCall, HttpStatus.FORBIDDEN);
}

---

From source file:org.kuali.mobility.writer.controllers.WriterController.java

/**
 * Removes a comment/*  ww  w  .  j  av  a 2s. co m*/
 */
@RequestMapping(value = "/deleteComment", method = RequestMethod.POST)
public ResponseEntity<String> deleteComment(HttpServletRequest request, @RequestParam long commentId,
        @PathVariable("instance") String instance) {

    User user = (User) request.getSession().getAttribute(Constants.KME_USER_KEY);

    // First check if the user may delete comments
    boolean allowDeleteComment = WriterPermissions.getEditorOrAdminExpression(instance).evaluate(user);
    if (!allowDeleteComment) {
        return new ResponseEntity<String>(HttpStatus.FORBIDDEN);
    }

    this.writerService.deleteComment(commentId);

    return new ResponseEntity<String>(HttpStatus.OK);
}

---

From source file:org.kuali.mobility.writer.controllers.WriterController.java

/**
 * Request to mark an article as deleted
 *
 * @return Http 200 is success, Http 401 if user is not admin, Http 404 if the article is not found
 *//*  w  w w.jav a2s. c o  m*/
@RequestMapping(value = "/deleteArticle", method = RequestMethod.GET)
public ResponseEntity<String> deleteArticle(HttpServletRequest request,
        @PathVariable("instance") String instance, @RequestParam("articleId") long articleId) {

    User user = (User) request.getSession().getAttribute(Constants.KME_USER_KEY);

    // Check if the user has admin rigths
    if (!WriterPermissions.getAdminExpression(instance).evaluate(user)) {
        return new ResponseEntity<String>(HttpStatus.FORBIDDEN);
    }

    Article article = writerService.getArticle(articleId);

    // Check if the article existed
    if (article == null) {
        return new ResponseEntity<String>(HttpStatus.NOT_FOUND);
    }

    // Update status and maintain article
    article.setStatus(Article.STATUS_DELETED);
    writerService.maintainArticle(article);

    return new ResponseEntity<String>(HttpStatus.OK);
}

---

From source file:org.mitre.openid.connect.web.ClientDynamicRegistrationEndpoint.java

/**
 * Get the meta information for a client.
 * @param clientId/*from ww w  .  jav a 2  s  . c  o  m*/
 * @param m
 * @param auth
 * @return
 */
@PreAuthorize("hasRole('ROLE_CLIENT') and #oauth2.hasScope('" + SystemScopeService.REGISTRATION_TOKEN_SCOPE
        + "')")
@RequestMapping(value = "/{id}", method = RequestMethod.GET, produces = "application/json")
public String readClientConfiguration(@PathVariable("id") String clientId, Model m, OAuth2Authentication auth) {

    ClientDetailsEntity client = clientService.loadClientByClientId(clientId);

    if (client != null && client.getClientId().equals(auth.getOAuth2Request().getClientId())) {

        // we return the token that we got in
        OAuth2AuthenticationDetails details = (OAuth2AuthenticationDetails) auth.getDetails();
        OAuth2AccessTokenEntity token = tokenService.readAccessToken(details.getTokenValue());

        try {
            RegisteredClient registered = new RegisteredClient(client, token.getValue(), config.getIssuer()
                    + "register/" + UriUtils.encodePathSegment(client.getClientId(), "UTF-8"));

            // send it all out to the view
            m.addAttribute("client", registered);
            m.addAttribute("code", HttpStatus.OK); // http 200

            return "clientInformationResponseView";
        } catch (UnsupportedEncodingException e) {
            logger.error("Unsupported encoding", e);
            m.addAttribute("code", HttpStatus.INTERNAL_SERVER_ERROR);
            return "httpCodeView";
        }
    } else {
        // client mismatch
        logger.error("readClientConfiguration failed, client ID mismatch: " + clientId + " and "
                + auth.getOAuth2Request().getClientId() + " do not match.");
        m.addAttribute("code", HttpStatus.FORBIDDEN); // http 403

        return "httpCodeView";
    }
}

---

From source file:org.mitre.openid.connect.web.ClientDynamicRegistrationEndpoint.java

/**
 * Update the metainformation for a given client.
 * @param clientId//  w  w w .j a v  a  2s. c  o m
 * @param jsonString
 * @param m
 * @param auth
 * @return
 */
@PreAuthorize("hasRole('ROLE_CLIENT') and #oauth2.hasScope('" + SystemScopeService.REGISTRATION_TOKEN_SCOPE
        + "')")
@RequestMapping(value = "/{id}", method = RequestMethod.PUT, produces = "application/json", consumes = "application/json")
public String updateClient(@PathVariable("id") String clientId, @RequestBody String jsonString, Model m,
        OAuth2Authentication auth) {

    ClientDetailsEntity newClient = ClientDetailsEntityJsonProcessor.parse(jsonString);
    ClientDetailsEntity oldClient = clientService.loadClientByClientId(clientId);

    if (newClient != null && oldClient != null // we have an existing client and the new one parsed
            && oldClient.getClientId().equals(auth.getOAuth2Request().getClientId()) // the client passed in the URI matches the one in the auth
            && oldClient.getClientId().equals(newClient.getClientId()) // the client passed in the body matches the one in the URI
    ) {

        // a client can't ask to update its own client secret to any particular value
        newClient.setClientSecret(oldClient.getClientSecret());

        // we need to copy over all of the local and SECOAUTH fields
        newClient.setAccessTokenValiditySeconds(oldClient.getAccessTokenValiditySeconds());
        newClient.setIdTokenValiditySeconds(oldClient.getIdTokenValiditySeconds());
        newClient.setRefreshTokenValiditySeconds(oldClient.getRefreshTokenValiditySeconds());
        newClient.setDynamicallyRegistered(true); // it's still dynamically registered
        newClient.setAllowIntrospection(oldClient.isAllowIntrospection());
        newClient.setAuthorities(oldClient.getAuthorities());
        newClient.setClientDescription(oldClient.getClientDescription());
        newClient.setCreatedAt(oldClient.getCreatedAt());
        newClient.setReuseRefreshToken(oldClient.isReuseRefreshToken());

        // set of scopes that are OK for clients to dynamically register for
        Set<SystemScope> dynScopes = scopeService.getDynReg();

        // scopes that the client is asking for
        Set<SystemScope> requestedScopes = scopeService.fromStrings(newClient.getScope());

        // the scopes that the client can have must be a subset of the dynamically allowed scopes
        Set<SystemScope> allowedScopes = Sets.intersection(dynScopes, requestedScopes);

        // make sure that the client doesn't ask for scopes it can't have
        newClient.setScope(scopeService.toStrings(allowedScopes));

        try {
            // save the client
            ClientDetailsEntity savedClient = clientService.updateClient(oldClient, newClient);

            // we return the token that we got in
            // TODO: rotate this after some set amount of time
            OAuth2AuthenticationDetails details = (OAuth2AuthenticationDetails) auth.getDetails();
            OAuth2AccessTokenEntity token = tokenService.readAccessToken(details.getTokenValue());

            RegisteredClient registered = new RegisteredClient(savedClient, token.getValue(), config.getIssuer()
                    + "register/" + UriUtils.encodePathSegment(savedClient.getClientId(), "UTF-8"));

            // send it all out to the view
            m.addAttribute("client", registered);
            m.addAttribute("code", HttpStatus.OK); // http 200

            return "clientInformationResponseView";
        } catch (IllegalArgumentException e) {
            logger.error("Couldn't save client", e);
            m.addAttribute("code", HttpStatus.BAD_REQUEST);

            return "httpCodeView";
        } catch (UnsupportedEncodingException e) {
            logger.error("Unsupported encoding", e);
            m.addAttribute("code", HttpStatus.INTERNAL_SERVER_ERROR);
            return "httpCodeView";
        }
    } else {
        // client mismatch
        logger.error("readClientConfiguration failed, client ID mismatch: " + clientId + " and "
                + auth.getOAuth2Request().getClientId() + " do not match.");
        m.addAttribute("code", HttpStatus.FORBIDDEN); // http 403

        return "httpCodeView";
    }
}

---

From source file:org.mitre.openid.connect.web.ClientDynamicRegistrationEndpoint.java

/**
 * Delete the indicated client from the system.
 * @param clientId/* w ww .j a  v a  2s. com*/
 * @param m
 * @param auth
 * @return
 */
@PreAuthorize("hasRole('ROLE_CLIENT') and #oauth2.hasScope('" + SystemScopeService.REGISTRATION_TOKEN_SCOPE
        + "')")
@RequestMapping(value = "/{id}", method = RequestMethod.DELETE, produces = "application/json")
public String deleteClient(@PathVariable("id") String clientId, Model m, OAuth2Authentication auth) {

    ClientDetailsEntity client = clientService.loadClientByClientId(clientId);

    if (client != null && client.getClientId().equals(auth.getOAuth2Request().getClientId())) {

        clientService.deleteClient(client);

        m.addAttribute("code", HttpStatus.NO_CONTENT); // http 204

        return "httpCodeView";
    } else {
        // client mismatch
        logger.error("readClientConfiguration failed, client ID mismatch: " + clientId + " and "
                + auth.getOAuth2Request().getClientId() + " do not match.");
        m.addAttribute("code", HttpStatus.FORBIDDEN); // http 403

        return "httpCodeView";
    }
}

---

From source file:org.motechproject.mds.docs.swagger.SwaggerGenerator.java

private void addCommonResponses(PathEntry pathEntry, Locale locale) {
    pathEntry.addResponse(HttpStatus.BAD_REQUEST, badRequestResponse(locale));
    pathEntry.addResponse(HttpStatus.FORBIDDEN, forbiddenResponse(locale));
}

---

From source file:org.opentestsystem.shared.web.AbstractRestController.java

/**
 * Prevent user from accessing secured endpoints via HTTP
 *//*from w ww  . j a  va  2s .  c o m*/
@ExceptionHandler(SecureAccessRequiredException.class)
@ResponseStatus(value = HttpStatus.FORBIDDEN)
@ResponseBody
public ResponseError handleSecureAccessRequiredException(final SecureAccessRequiredException except) {
    LOGGER.error("Secure HTTPS required", except);
    final ResponseError err = new ResponseError("This endpoint is only accessible via secure HTTPS");
    return err;
}

---

• «
• 1
• 2
• 3
• 4
• 5
• 6
• 7
• 8
• 9
• 10
• 11
• 12
• 13
• 14
• 15
• 16
• 17
• 18
• 19
• 20
• 21
• 22
• 23
• 24
• 25
• 26
• 27
• 28
• 29
• 30
• 31
• 32
• 33
• 34
• 35
• 36
• 37
• 38
• 39
• 40
• 41
• 42
• 43
• 44
• 45
• 46
• 47
• 48
• 49
• 50
• »