Package org.atmosphere.interceptor

Class AuthInterceptor

java.lang.Object
org.atmosphere.cpr.AtmosphereInterceptorAdapter
org.atmosphere.interceptor.AuthInterceptor
All Implemented Interfaces:
AtmosphereInterceptor, AtmosphereConfigAware, InvokationOrder
public class AuthInterceptor extends AtmosphereInterceptorAdapter
Authentication interceptor that validates tokens on every inbound request. Supports all Atmosphere transports (WebSocket, SSE, long-polling, streaming).

Tokens are extracted from:

  • The X-Atmosphere-Auth HTTP header (long-polling, streaming)
  • The query parameter (configurable, defaults to X-Atmosphere-Auth) — all transports, especially WebSocket and SSE where custom headers are not supported

On token expiration, if a TokenRefresher is configured, the interceptor attempts a server-side refresh and sends the new token to the client via the X-Atmosphere-Auth-Refresh response header.

Programmatic usage


 framework.interceptor(new AuthInterceptor(token -> {
     var claims = jwt.verify(token);
     return new TokenValidator.Valid(claims.getSubject(), claims);
 }));

Configuration (init-params)

  • org.atmosphere.auth.tokenValidator — FQCN of a TokenValidator
  • org.atmosphere.auth.tokenRefresher — FQCN of a TokenRefresher (optional)
  • org.atmosphere.auth.queryParam — query param name (default: X-Atmosphere-Auth)
  • org.atmosphere.auth.disconnectOnFailure — disconnect on auth failure (default: true)
Since:
4.0