NFC-47 NFC support for web-eid example

[SanderKondratjevNortal]

Signed-off-by: Sander Kondratjev [email protected]

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[mrts]

There can be two separate problem cases here, either an invalid token or a technical problem with the request reader. These should perhaps throw separate exceptions:

Suggested change

	} catch (IOException e) {
	throw new BadCredentialsException("Unable to authenticate the Web eID authentication token", e);
	} catch (JacksonException e) {
	throw new BadCredentialsException("Unable to parse the Web eID authentication token", e);
	} catch (IOException e) {
	throw new AuthenticationServiceException("I/O error while reading the Web eID authentication token", e);

[mrts]

Suggested change

	private final ObjectReader OBJECT_READER = new ObjectMapper().readerFor(WebEidAuthToken.class);
	private static final ObjectReader OBJECT_READER = new ObjectMapper().readerFor(WebEidAuthToken.class);

[mrts]

Suggested change

	private WebEidAuthToken parseWebEidAuthToken(HttpServletRequest request) {
	private static WebEidAuthToken parseWebEidAuthToken(HttpServletRequest request) {

[mrts]

Let's extract content type validation to separate method as well:

Suggested change

	final String contentType = request.getHeader(HttpHeaders.CONTENT_TYPE);
	if (contentType == null || !contentType.startsWith(MediaType.APPLICATION_JSON_VALUE)) {
	LOG.warn("Content type not supported: {}", contentType);
	throw new AuthenticationServiceException("Content type not supported: " + contentType);
	}
	requireJsonContentType(request);

requireJsonContentType() might look as follows (untested, please verify):

    private static void requireJsonContentType(HttpServletRequest request) {
        try {
            MediaType contentType = MediaType.parseMediaType(request.getContentType());
            if (!MediaType.APPLICATION_JSON.equalsTypeAndSubtype(contentType)) {
                LOG.warn("Content type not supported: {}", contentType);
                throw new AuthenticationServiceException("Content type not supported: " + contentType);
            }
        } catch (InvalidMediaTypeException e) {
            LOG.warn("Invalid content type", e);
            throw new AuthenticationServiceException("Invalid content type", e);
        }
    }