fixes #274 update unified security handler to handle the basic and ap…

…ikey with a boolean return (#275)
networknt · Jan 6, 2023 · 3c74968 · 3c74968
1 parent 6aface3
commit 3c74968
Showing 1 changed file with 15 additions and 5 deletions.
diff --git a/openapi-security/src/main/java/com/networknt/openapi/UnifiedSecurityHandler.java b/openapi-security/src/main/java/com/networknt/openapi/UnifiedSecurityHandler.java
@@ -91,8 +91,13 @@ public void handleRequest(HttpServerExchange exchange) throws Exception {
                                     exchange.endExchange();
                                     return;
                                 } else {
-                                    handler.handleBasicAuth(exchange, reqPath, authorization);
-                                    break;
+                                    if(handler.handleBasicAuth(exchange, reqPath, authorization)) {
+                                        // verification is passed, go to the next handler in the chain
+                                        break;
+                                    } else {
+                                        // verification is not passed and an error is returned. Don't call the next handler.
+                                        return;
+                                    }
                                 }
                             } else if (BEARER_PREFIX.equalsIgnoreCase(authorization.substring(0, 6))) {
                                 Map<String, HttpHandler> handlers = Handler.getHandlers();
@@ -108,7 +113,7 @@ public void handleRequest(HttpServerExchange exchange) throws Exception {
                                         // verification is passed, go to the next handler in the chain.
                                         break;
                                     } else {
-                                        // verification is not passed and an error is returned.
+                                        // verification is not passed and an error is returned. Don't call the next handler.
                                         return;
                                     }
                                 }
@@ -130,8 +135,13 @@ public void handleRequest(HttpServerExchange exchange) throws Exception {
                             exchange.endExchange();
                             return;
                         } else {
-                            handler.handleApiKey(exchange, reqPath);
-                            break;
+                            if(handler.handleApiKey(exchange, reqPath)) {
+                                // the APIKey handler successfully verified the credentials. Need to break here so that the next handler can be called.
+                                break;
+                            } else {
+                                // verification is not passed and an error is returned. need to bypass the next handler.
+                                return;
+                            }
                         }
 
                     }