Override binding of Authentication class in Shiro with Guice - angularjs

Question

The problem I encountered is connected with message of a type:
OPTIONS http://localhost:8080
XMLHttpRequest cannot load http://localhost:8080/. No 'Access-Control-Allow-Origin' header is present on the requested resource. Origin 'http://localhost:3000' is therefore not allowed access. The response had HTTP status code 401.
So basically it is an issue of our Angular JS 1.4.3 frontend sending OPTIONS request to the server before actual request. Problem occurs, because there is no way to add authentication data to this request and it is being blocked by Apache Shiro as it tries to access protected address.
Since I can not fix it on Angular side, I thought it would be easy on the server side. Would be, but we use Guice 4.
In Guice config we properly set up Shiro:
install(new EEShiroModule(getServletContext()));
filter("/services/*").through(GuiceShiroFilter.class);
so far so good. But now I want to make a hole in the system, allowing the OPTIONS request not to be authenticated. I have found a similar approach here: http://blog.awolski.com/cors-dart-dropwizard-and-shiro/.
At the end I am supposed to override the BasicHttpAuthenticationFilter but it is not so simple as it would be in Spring or Ini configuration because I can not override class binding.
What would be the best approach? Thanks!

Answer 1

Today I meet similar problem here. For CORS requests, the OPTIONS pre-flight request will be regarded as unauthenticated by Apache Shiro since the browser won't add custom headers to the OPTIONS request.
To solve this problem. I overrode the AuthenticatingFilter's isAccessAllowed method to make it always return true when the request's method is OPTIONS.
public class CORSAuthenticationFilter extends AuthenticatingFilter {
#Override
protected boolean isAccessAllowed(ServletRequest request, ServletResponse response, Object mappedValue) {
//Always return true if the request's method is OPTIONS
if(request instanceof HttpServletRequest){
if(((HttpServletRequest) request).getMethod().toUpperCase().equals("OPTIONS")){
return true;
}
}
return super.isAccessAllowed(request, response, mappedValue);
}
}
If you are using PermissionsAuthorizationFilter, you need to override it too.
public class CORSPermissionAuthorizationFilter extends PermissionsAuthorizationFilter {
#Override
public boolean isAccessAllowed(ServletRequest request, ServletResponse response, Object mappedValue) throws IOException {
if(request instanceof HttpServletRequest){
if(((HttpServletRequest) request).getMethod().toUpperCase().equals("OPTIONS")){
return true;
}
}
return super.isAccessAllowed(request, response, mappedValue);
}
}
After having these filters overridden. They should be declared to be the running implementation in shiro's config file.
That is how i get things to work. Hope it helps, a little bit late though.