Thoughts About

Exclude Url Pattern in Filter Mapping

Yeah, sorry, there isn't an exclude pattern in the servlet spec. Well I'm stupid and stubborn (the worst combination I guess), so of course I had to figure out some way to overcome this limitation. Even though you can basically do everything with include patterns and by examining the url in the filter code itself, the thing is that exclude url pattern would be very useful in various situations. Consider url authorization implemented with a filter for example. You might only have one or a few URLs, like the login page, that you want to be accessible to everyone, and for security reasons, you want say "check authorization to all URLs except for this one". If you just used include, there's a always a chance that you forget to add that new directory you just created into your filter mapping. If you included everything and then bypassed the one URL in you filter code, you'd essentially have to hard-code the URL in. However, you could take the bypass idea a bit further and implement a simple exclude filter that would bypass all the subsequent filters in your filter chain by forwarding the request. Your whole doFilter() method in your BypassFilter could be just two lines of code (or even one):

HttpServletRequest httpRequest = (HttpServletRequest)request;
// consider if you'd like to add request parameters into the
// forwarded request (+ httpRequest.getQueryString() )
request.getRequestDispatcher( httpRequest.getRequestURI().substring(httpRequest.getContextPath().length()) ).forward(request, response);


Bypassing the filter chain also works well for loading static resources, such as images etc. for which you likely won't want to do any extra processing in filters.

And btw, Resin supports excludes in filter mapping.