fix: allow authenticating with query string in asset preview url

teamwize · Sep 21, 2024 · 84e28f4 · 84e28f4
1 parent f23a7c3
commit 84e28f4
Showing 1 changed file with 11 additions and 2 deletions.
diff --git a/src/main/java/app/teamwize/api/auth/interceptor/JwtAuthorizationFilter.java b/src/main/java/app/teamwize/api/auth/interceptor/JwtAuthorizationFilter.java
@@ -26,9 +26,11 @@ public class JwtAuthorizationFilter extends OncePerRequestFilter {
     private final AuthenticationService detailsService;
     private final TokenService tokenService;
 
-    private String jwtHeaderName = "Authorization";
+    private final String jwtHeaderName = "Authorization";
 
-    private String apiKeyHeaderName = "API-Key";
+    private final String apiKeyHeaderName = "API-Key";
+
+    private final String tokenQueryStringName = "token";
 
 
     @Override
@@ -60,7 +62,14 @@ private boolean apiKeyHeaderExist(HttpServletRequest request) {
         return StringUtils.hasText(request.getHeader(apiKeyHeaderName));
     }
 
+    private boolean tokenQueryParamExist(HttpServletRequest request) {
+        return StringUtils.hasText(request.getParameter(tokenQueryStringName));
+    }
+
     private String getJwtToken(HttpServletRequest request) {
+        if (tokenQueryParamExist(request)) {
+            return request.getParameter(tokenQueryStringName);
+        }
         return tokenService.getJwtFromRequest(request.getHeader(jwtHeaderName));
     }