Package org.springframework.security.web.authentication.www

# Class DigestAuthenticationFilter

java.lang.Object
org.springframework.web.filter.GenericFilterBean
org.springframework.security.web.authentication.www.DigestAuthenticationFilter

All Implemented Interfaces:
  `jakarta.servlet.Filter`, `org.springframework.beans.factory.Aware`, `org.springframework.beans.factory.BeanNameAware`, `org.springframework.beans.factory.DisposableBean`, `org.springframework.beans.factory.InitializingBean`, `org.springframework.context.EnvironmentAware`, `org.springframework.context.MessageSourceAware`, `org.springframework.core.env.EnvironmentCapable`, `org.springframework.web.context.ServletContextAware`

public class DigestAuthenticationFilter extends org.springframework.web.filter.GenericFilterBean implements org.springframework.context.MessageSourceAware
Processes a HTTP request's Digest authorization headers, putting the result into the `SecurityContextHolder`.

For a detailed background on what this filter is designed to process, refer to RFC 2617 (which superseded RFC 2069, although this filter support clients that implement either RFC 2617 or RFC 2069).

This filter can be used to provide Digest authentication services to both remoting protocol clients (such as Hessian and SOAP) as well as standard user agents (such as Internet Explorer and FireFox).

This Digest implementation has been designed to avoid needing to store session state between invocations. All session management information is stored in the "nonce" that is sent to the client by the `DigestAuthenticationEntryPoint`.

If authentication is successful, the resulting `Authentication` object will be placed into the `SecurityContextHolder`.

If authentication fails, an `AuthenticationEntryPoint` implementation is called. This must always be `DigestAuthenticationEntryPoint`, which will prompt the user to authenticate again via Digest authentication.

Note there are limitations to Digest authentication, although it is a more comprehensive and secure solution than Basic authentication. Please see RFC 2617 section 4 for a full discussion on the advantages of Digest authentication over Basic authentication, including commentary on the limitations that it still imposes.

Since:
  1.0.0

## Field Summary

Fields
Modifier and Type
Field
Description
`protected org.springframework.context.support.MessageSourceAccessor`
`messages`

## Constructor Summary

Constructors
Constructor
Description
`DigestAuthenticationFilter()`

## Method Summary

Modifier and Type
Method
Description
`void`
`afterPropertiesSet()`
`void`
`doFilter(jakarta.servlet.ServletRequest request, jakarta.servlet.ServletResponse response, jakarta.servlet.FilterChain chain)`
`protected final DigestAuthenticationEntryPoint`
`getAuthenticationEntryPoint()`
`org.springframework.security.core.userdetails.UserCache`
`getUserCache()`
`org.springframework.security.core.userdetails.UserDetailsService`
`getUserDetailsService()`
`void`
`setAuthenticationDetailsSource(org.springframework.security.authentication.AuthenticationDetailsSource<jakarta.servlet.http.HttpServletRequest,?> authenticationDetailsSource)`
`void`
`setAuthenticationEntryPoint(DigestAuthenticationEntryPoint authenticationEntryPoint)`
`void`
`setCreateAuthenticatedToken(boolean createAuthenticatedToken)`
If you set this property, the Authentication object, which is created after the successful digest authentication will be marked as authenticated and filled with the authorities loaded by the UserDetailsService.
`void`
`setMessageSource(org.springframework.context.MessageSource messageSource)`
`void`
`setPasswordAlreadyEncoded(boolean passwordAlreadyEncoded)`
`void`
`setSecurityContextHolderStrategy(org.springframework.security.core.context.SecurityContextHolderStrategy securityContextHolderStrategy)`
Sets the `SecurityContextHolderStrategy` to use.
`void`
`setSecurityContextRepository(SecurityContextRepository securityContextRepository)`
Sets the `SecurityContextRepository` to save the `SecurityContext` on authentication success.
`void`
`setUserCache(org.springframework.security.core.userdetails.UserCache userCache)`
`void`
`setUserDetailsService(org.springframework.security.core.userdetails.UserDetailsService userDetailsService)`

### Methods inherited from class org.springframework.web.filter.GenericFilterBean

`addRequiredProperty, createEnvironment, destroy, getEnvironment, getFilterConfig, getFilterName, getServletContext, init, initBeanWrapper, initFilterBean, setBeanName, setEnvironment, setServletContext`

### Methods inherited from class java.lang.Object

`clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait`

## Field Details

### messages

protected org.springframework.context.support.MessageSourceAccessor messages

## Constructor Details

### DigestAuthenticationFilter

public DigestAuthenticationFilter()

## Method Details

### afterPropertiesSet

public void afterPropertiesSet()

Specified by:
  `afterPropertiesSet` in interface `org.springframework.beans.factory.InitializingBean`
Overrides:
  `afterPropertiesSet` in class `org.springframework.web.filter.GenericFilterBean`

### doFilter

public void doFilter(jakarta.servlet.ServletRequest request, jakarta.servlet.ServletResponse response, jakarta.servlet.FilterChain chain) throws IOException, jakarta.servlet.ServletException

Specified by:
  `doFilter` in interface `jakarta.servlet.Filter`
Throws:
  `IOException`
  `jakarta.servlet.ServletException`

### getAuthenticationEntryPoint

protected final DigestAuthenticationEntryPoint getAuthenticationEntryPoint()

### getUserCache

public org.springframework.security.core.userdetails.UserCache getUserCache()

### getUserDetailsService

public org.springframework.security.core.userdetails.UserDetailsService getUserDetailsService()

### setAuthenticationDetailsSource

public void setAuthenticationDetailsSource(org.springframework.security.authentication.AuthenticationDetailsSource<jakarta.servlet.http.HttpServletRequest,?> authenticationDetailsSource)

### setAuthenticationEntryPoint

public void setAuthenticationEntryPoint(DigestAuthenticationEntryPoint authenticationEntryPoint)

### setMessageSource

public void setMessageSource(org.springframework.context.MessageSource messageSource)

Specified by:
  `setMessageSource` in interface `org.springframework.context.MessageSourceAware`

### setPasswordAlreadyEncoded

public void setPasswordAlreadyEncoded(boolean passwordAlreadyEncoded)

### setUserCache

public void setUserCache(org.springframework.security.core.userdetails.UserCache userCache)

### setUserDetailsService

public void setUserDetailsService(org.springframework.security.core.userdetails.UserDetailsService userDetailsService)

### setCreateAuthenticatedToken

public void setCreateAuthenticatedToken(boolean createAuthenticatedToken)
If you set this property, the Authentication object, which is created after the successful digest authentication will be marked as authenticated and filled with the authorities loaded by the UserDetailsService. It therefore will not be re-authenticated by your AuthenticationProvider. This means, that only the password of the user is checked, but not the flags like isEnabled() or isAccountNonExpired(). You will save some time by enabling this flag, as otherwise your UserDetailsService will be called twice. A more secure option would be to introduce a cache around your UserDetailsService, but if you don't use these flags, you can also safely enable this option.

Parameters:
  `createAuthenticatedToken` - default is false

### setSecurityContextRepository

public void setSecurityContextRepository(SecurityContextRepository securityContextRepository)
Sets the `SecurityContextRepository` to save the `SecurityContext` on authentication success. The default action is not to save the `SecurityContext`.

Parameters:
  `securityContextRepository` - the `SecurityContextRepository` to use. Cannot be null.

### setSecurityContextHolderStrategy

public void setSecurityContextHolderStrategy(org.springframework.security.core.context.SecurityContextHolderStrategy securityContextHolderStrategy)
Sets the `SecurityContextHolderStrategy` to use. The default action is to use the `SecurityContextHolderStrategy` stored in `SecurityContextHolder`.

Since:
  5.8