From 366a009c8ea0a49fe220bd7fe5f72a224d4a89e9 Mon Sep 17 00:00:00 2001 From: ravishanigarapu <133210792+ravishanigarapu@users.noreply.github.com> Date: Thu, 25 Sep 2025 18:59:26 +0530 Subject: [PATCH 1/4] Update JwtUserIdValidationFilter.java --- .../java/com/iemr/common/utils/JwtUserIdValidationFilter.java | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/main/java/com/iemr/common/utils/JwtUserIdValidationFilter.java b/src/main/java/com/iemr/common/utils/JwtUserIdValidationFilter.java index 13eaea2f..16466ee5 100644 --- a/src/main/java/com/iemr/common/utils/JwtUserIdValidationFilter.java +++ b/src/main/java/com/iemr/common/utils/JwtUserIdValidationFilter.java @@ -169,7 +169,8 @@ private boolean shouldSkipAuthentication(String path, String contextPath) { || path.startsWith(contextPath + "/user/saveUserSecurityQuesAns") || path.startsWith(contextPath + "/user/userLogout") || path.startsWith(contextPath + "/user/validateSecurityQuestionAndAnswer") - || path.startsWith(contextPath + "/user/logOutUserFromConcurrentSession"); + || path.startsWith(contextPath + "/user/logOutUserFromConcurrentSession") + || path.startsWith(contextPath + "/user/refreshToken"); } private String getJwtTokenFromCookies(HttpServletRequest request) { From 7b9cd2a304f63755dbabfe167a09f0c395c6798d Mon Sep 17 00:00:00 2001 From: ravishanigarapu <133210792+ravishanigarapu@users.noreply.github.com> Date: Thu, 25 Sep 2025 19:10:25 +0530 Subject: [PATCH 2/4] Added new condition for new user status --- .../com/iemr/common/controller/users/IEMRAdminController.java | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/main/java/com/iemr/common/controller/users/IEMRAdminController.java b/src/main/java/com/iemr/common/controller/users/IEMRAdminController.java index bbe70dd4..1838ab5b 100644 --- a/src/main/java/com/iemr/common/controller/users/IEMRAdminController.java +++ b/src/main/java/com/iemr/common/controller/users/IEMRAdminController.java @@ -285,7 +285,8 @@ public ResponseEntity refreshToken(@RequestBody Map request) return ResponseEntity.status(HttpStatus.UNAUTHORIZED).body("Unauthorized."); } - if (user.getM_status() == null || !"Active".equalsIgnoreCase(user.getM_status().getStatus())) { + if (user.getM_status() == null || !("Active".equalsIgnoreCase(user.getM_status().getStatus()) + || "New".equalsIgnoreCase(user.getM_status().getStatus()))) { logger.warn("Token validation failed: user account is inactive or not in 'Active' status."); return ResponseEntity.status(HttpStatus.UNAUTHORIZED).body("Unauthorized."); } From 0847462ce04a18f41c83f902df1ef683e02b5801 Mon Sep 17 00:00:00 2001 From: ravishanigarapu <133210792+ravishanigarapu@users.noreply.github.com> Date: Thu, 25 Sep 2025 19:29:29 +0530 Subject: [PATCH 3/4] Status code changes from 5002 to 401 if it is Auauthorized --- .../utils/http/HTTPRequestInterceptor.java | 36 ++++++++++++++----- 1 file changed, 27 insertions(+), 9 deletions(-) diff --git a/src/main/java/com/iemr/common/utils/http/HTTPRequestInterceptor.java b/src/main/java/com/iemr/common/utils/http/HTTPRequestInterceptor.java index 23b0af62..1c322dc4 100644 --- a/src/main/java/com/iemr/common/utils/http/HTTPRequestInterceptor.java +++ b/src/main/java/com/iemr/common/utils/http/HTTPRequestInterceptor.java @@ -21,7 +21,7 @@ */ package com.iemr.common.utils.http; - +import java.nio.charset.StandardCharsets; import javax.ws.rs.core.MediaType; import org.slf4j.Logger; @@ -32,10 +32,10 @@ import org.springframework.web.servlet.HandlerInterceptor; import org.springframework.web.servlet.ModelAndView; -import com.iemr.common.utils.response.OutputResponse; import com.iemr.common.utils.sessionobject.SessionObject; import com.iemr.common.utils.validator.Validator; +import jakarta.servlet.ServletOutputStream; import jakarta.servlet.http.HttpServletRequest; import jakarta.servlet.http.HttpServletResponse; @Configuration @@ -125,12 +125,30 @@ public boolean preHandle(HttpServletRequest request, HttpServletResponse respons break; } } catch (Exception e) { - OutputResponse output = new OutputResponse(); - output.setError(e); - response.getOutputStream().print(output.toString()); - response.setContentType(MediaType.APPLICATION_JSON); - response.setContentLength(output.toString().length()); - response.setHeader("Access-Control-Allow-Origin", "*"); + logger.error("Authorization failed: {}", e.getMessage(), e); + + String errorMessage = e.getMessage(); + if (errorMessage == null || errorMessage.trim().isEmpty()) { + errorMessage = "Unauthorized access or session expired."; + } + + String jsonErrorResponse = "{" + + "\"status\": \"Unauthorized\"," + + "\"statusCode\": 401," + + "\"errorMessage\": \"" + errorMessage.replace("\"", "\\\"") + "\"" + + "}"; + + response.setStatus(HttpServletResponse.SC_UNAUTHORIZED); // 401 + response.setContentType(MediaType.APPLICATION_JSON); + response.setHeader("Access-Control-Allow-Origin", "*"); + + // Better to use getBytes().length for accurate byte size + byte[] responseBytes = jsonErrorResponse.getBytes(StandardCharsets.UTF_8); + response.setContentLength(responseBytes.length); + + ServletOutputStream out = response.getOutputStream(); + out.write(responseBytes); + out.flush(); status = false; } } @@ -164,4 +182,4 @@ public void afterCompletion(HttpServletRequest request, HttpServletResponse resp throws Exception { logger.debug("In afterCompletion Request Completed"); } -} \ No newline at end of file +} From f9e6056a0ce4923868bfa66f3771590ead68c6b6 Mon Sep 17 00:00:00 2001 From: Ravi Shanigarapu Date: Thu, 25 Sep 2025 19:47:01 +0530 Subject: [PATCH 4/4] logger message changed --- .../com/iemr/common/controller/users/IEMRAdminController.java | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/main/java/com/iemr/common/controller/users/IEMRAdminController.java b/src/main/java/com/iemr/common/controller/users/IEMRAdminController.java index 1838ab5b..1475635a 100644 --- a/src/main/java/com/iemr/common/controller/users/IEMRAdminController.java +++ b/src/main/java/com/iemr/common/controller/users/IEMRAdminController.java @@ -287,7 +287,7 @@ public ResponseEntity refreshToken(@RequestBody Map request) if (user.getM_status() == null || !("Active".equalsIgnoreCase(user.getM_status().getStatus()) || "New".equalsIgnoreCase(user.getM_status().getStatus()))) { - logger.warn("Token validation failed: user account is inactive or not in 'Active' status."); + logger.warn("Token validation failed: user account is neither 'Active' nor 'New'."); return ResponseEntity.status(HttpStatus.UNAUTHORIZED).body("Unauthorized."); } // Generate new tokens