Web API filter checks if baseUrl of referrer matches (startsWith)

src/main/java/org/genesys2/server/servlet/filter/WebApiFilter.java

@@ -16,6 +16,14 @@
 
 package org.genesys2.server.servlet.filter;
 
+import java.io.IOException;
+import java.util.Set;
+
+import javax.servlet.FilterChain;
+import javax.servlet.ServletException;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
 import org.apache.commons.lang.StringUtils;
 import org.genesys2.server.service.OAuth2ClientDetailsService;
 import org.slf4j.Logger;
@@ -25,13 +33,6 @@ import org.springframework.security.oauth2.provider.ClientDetails;
 import org.springframework.stereotype.Component;
 import org.springframework.web.filter.OncePerRequestFilter;
 
-import javax.servlet.FilterChain;
-import javax.servlet.ServletException;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
-
-import java.io.IOException;
-
 @Component("webApiFilter")
 public class WebApiFilter extends OncePerRequestFilter {
 	private static final Logger _logger = LoggerFactory.getLogger(WebApiFilter.class);
@@ -54,7 +55,8 @@ public class WebApiFilter extends OncePerRequestFilter {
 			if (StringUtils.isBlank(referrer)) {
 				throw new Exception("Referrer not provided by client");
 			}
-			if (!clientDetails.getRegisteredRedirectUri().contains(referrer)) {
+			
+			if (! isRegisteredReferrer(referrer, clientDetails.getRegisteredRedirectUri())) {
 				throw new Exception("Referrer not registered with client " + referrer);
 			}
 
@@ -66,4 +68,13 @@ public class WebApiFilter extends OncePerRequestFilter {
 		}
 
 	}
+
+	private boolean isRegisteredReferrer(String referrer, Set<String> baseUrlSet) {
+		for (String baseUrl : baseUrlSet) {
+			if (referrer.startsWith(baseUrl)) {
+				return true;
+			}
+		}
+		return false;
+	}
 }