Send redirect on login and forbid unauthorized access to Rest API.

LoginFilter modified to send redirect when login is done with parameters
and to return a 403 error when accesing Rest API without authorization.

src/main/java/es/uvigo/esei/daa/LoginFilter.java

@@ -25,48 +25,69 @@ public class LoginFilter implements Filter {
 		final HttpServletRequest httpRequest = (HttpServletRequest) request;
 		final HttpServletResponse httpResponse = (HttpServletResponse) response;
 		
+		try {
 			if (isLogoutPath(httpRequest)) {
-			removeCookie(httpResponse);
+				removeTokenCookie(httpResponse);
 				redirectToIndex(httpRequest, httpResponse);
-		} else if (isIndexPath(httpRequest) ||
-			checkLogin(httpRequest, httpResponse) ||
-			checkToken(httpRequest)
-		) {
+			} else if (isIndexPath(httpRequest) || checkToken(httpRequest)) {
 				chain.doFilter(request, response);
+			} else if (checkLogin(httpRequest, httpResponse)) {
+				continueWithRedirect(httpRequest, httpResponse);
+			} else if (isRestPath(httpRequest)) {
+				httpResponse.sendError(HttpServletResponse.SC_FORBIDDEN);				
 			} else {
 				redirectToIndex(httpRequest, httpResponse);
 			}
+		} catch (DAOException e) {
+			httpResponse.sendError(HttpServletResponse.SC_INTERNAL_SERVER_ERROR);
+		}
+	}
+	
+	private boolean isLogoutPath(HttpServletRequest request) {
+		return request.getServletPath().equals("/logout");
+	}
+	
+	private boolean isIndexPath(HttpServletRequest request) {
+		return request.getServletPath().equals("/index.html");
+	}
+	
+	private boolean isRestPath(HttpServletRequest request) {
+		return request.getServletPath().startsWith("/rest");
 	}
 
 	private void redirectToIndex(
-		HttpServletRequest httpRequest,
-		HttpServletResponse httpResponse
+		HttpServletRequest request,
+		HttpServletResponse response
 	) throws IOException {
-		httpResponse.sendRedirect(httpRequest.getContextPath() + "/index.html");
+		response.sendRedirect(request.getContextPath());
 	}
 
-	private void removeCookie(HttpServletResponse httpResponse) {
-		final Cookie cookie = new Cookie("token", "");
-		cookie.setMaxAge(0);
-		httpResponse.addCookie(cookie);
-	}
+	private void continueWithRedirect(
+		HttpServletRequest request,
+		HttpServletResponse response
+	) throws IOException {
+		String redirectPath = request.getRequestURI();
+		if (request.getQueryString() != null)
+			redirectPath += request.getQueryString();
 		
-	private boolean isLogoutPath(HttpServletRequest httpRequest) {
-		return httpRequest.getServletPath().equals("/logout");
+		response.sendRedirect(redirectPath);
 	}
 	
-	private boolean isIndexPath(HttpServletRequest httpRequest) {
-		return httpRequest.getServletPath().equals("/index.html");
+	private void removeTokenCookie(HttpServletResponse response) {
+		final Cookie cookie = new Cookie("token", "");
+		cookie.setMaxAge(0);
+		response.addCookie(cookie);
 	}
 	
-	private boolean checkLogin(HttpServletRequest httpRequest, HttpServletResponse response) {
-		final String login = httpRequest.getParameter("login");
-		final String password = httpRequest.getParameter("password");
+	private boolean checkLogin(
+		HttpServletRequest request, 
+		HttpServletResponse response
+	) throws DAOException {
+		final String login = request.getParameter("login");
+		final String password = request.getParameter("password");
 		
 		if (login != null && password != null) {
-			try {
-				final UsersDAO dao = new UsersDAO();
-				final String token = dao.checkLogin(login, password);
+			final String token = new UsersDAO().checkLogin(login, password);
 			
 			if (token == null) {
 				return false;
@@ -75,27 +96,18 @@ public class LoginFilter implements Filter {
 				
 				return true;
 			}
-			} catch (DAOException e) {
-				e.printStackTrace();
-				return false;
-			}
 		} else {
 			return false;
 		}
 	}
 	
-	private boolean checkToken(HttpServletRequest httpRequest) {
-		final Cookie[] cookies = httpRequest.getCookies();
+	private boolean checkToken(HttpServletRequest request) throws DAOException {
+		final Cookie[] cookies = request.getCookies();
 		
 		if (cookies != null) {
 			for (Cookie cookie : cookies) {
 				if (cookie.getName().equals("token")) {
-					try {
 					return new UsersDAO().checkToken(cookie.getValue()) != null;
-					} catch (DAOException e) {
-						e.printStackTrace();
-						return false;
-					}
 				}
 			}
 		}