net.sf.mmm.util.security.api

Class SecurityErrorUserException

java.lang.Object

java.lang.Throwable

java.lang.Exception

java.lang.RuntimeException

net.sf.mmm.util.exception.api.NlsRuntimeException

net.sf.mmm.util.security.api.SecurityErrorUserException

All Implemented Interfaces:

Serializable, Cloneable, NlsThrowable, AttributeReadMessage, AttributeReadMessageCode, AttributeReadUuid, Security, NlsObject

public class SecurityErrorUserException
extends NlsRuntimeException
implements Security

This exception is thrown if an operation or invocation failed due to security restrictions. This can be any form of "permission denied" as well as a (potential) attack that has been detected. The idea of this exception is that the end-user (or potential attacker) shall not receive further details that could help to complete his attack. A typical problem is e.g. if an attacker can distinguish between "account does not exist" and "invalid credentials" he can easily scan for valid accounts. A large list of valid accounts can be the basis for another account wit a standard password and rotating logins what is hard to detect and prevent.
ATTENTION:
When sending security exceptions as response to a remote request you have to ensure ExceptionTruncation. All this is handled by ExceptionUtil.convertForClient(Throwable).

Since:

4.0.0

Author:

Joerg Hohwiller (hohwille at users.sourceforge.net)

See Also:

SecurityException, Serialized Form

Field Summary

Fields

Modifier and Type	Field and Description
static String	CODE
private static long	serialVersionUID UID for serialization.

Fields inherited from interface net.sf.mmm.util.nls.api.NlsObject

KEY_ANNOTATION, KEY_ARGUMENT, KEY_CAPACITY, KEY_CONTAINER, KEY_DEFAULT, KEY_DIRECTORY, KEY_ERROR, KEY_EXISTING, KEY_EXPECTED, KEY_FILE, KEY_FUNCTION, KEY_ID, KEY_KEY, KEY_LOCATION, KEY_MAX, KEY_MIN, KEY_MODE, KEY_NAME, KEY_OBJECT, KEY_OPERAND, KEY_OPERATION, KEY_OPTION, KEY_PATH, KEY_PROPERTY, KEY_QUERY, KEY_RESOURCE, KEY_SIZE, KEY_SOURCE, KEY_TARGET_TYPE, KEY_TITLE, KEY_TYPE, KEY_URI, KEY_USER, KEY_VALUE

Constructor Summary

Constructors

Modifier	Constructor and Description
	SecurityErrorUserException() The constructor.
protected	SecurityErrorUserException(SecurityErrorUserException copySource, ExceptionTruncation truncation) The copy constructor.
	SecurityErrorUserException(Throwable nested) The constructor.

Method Summary

Modifier and Type	Method and Description
SecurityErrorUserException	createCopy(ExceptionTruncation truncation) Returns a copy of the given exception where the specified details are removed.
String	getCode() This method gets the code that identifies the detailed type of this object.
boolean	isForUser()
boolean	isTechnical() Determines if this is a technical exception.

Methods inherited from class net.sf.mmm.util.exception.api.NlsRuntimeException

createBundle, createCopyViaClone, createUuid, getLocalizedMessage, getLocalizedMessage, getLocalizedMessage, getMessage, getNlsMessage, getUuid, printStackTrace, toNlsMessage, toString, toString, toString

Methods inherited from class java.lang.Throwable

addSuppressed, fillInStackTrace, getCause, getStackTrace, getSuppressed, initCause, printStackTrace, printStackTrace, printStackTrace, setStackTrace

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, wait, wait, wait

Methods inherited from interface net.sf.mmm.util.exception.api.NlsThrowable

getCause, getStackTrace

Field Detail

CODE

public static final String CODE

See Also:

getCode(), Constant Field Values

serialVersionUID

private static final long serialVersionUID

UID for serialization.

See Also:

Constant Field Values

Constructor Detail

SecurityErrorUserException

public SecurityErrorUserException()

The constructor.

SecurityErrorUserException

public SecurityErrorUserException(Throwable nested)

The constructor.

Parameters:

nested - is the cause of this exception. E.g. a SecurityException.

SecurityErrorUserException

protected SecurityErrorUserException(SecurityErrorUserException copySource,
                                     ExceptionTruncation truncation)

The copy constructor.

Parameters:

copySource - is the exception to copy.

truncation - is the ExceptionTruncation to configure potential truncations.

See Also:

NlsRuntimeException.NlsRuntimeException(net.sf.mmm.util.exception.api.NlsRuntimeException, ExceptionTruncation)

Method Detail

createCopy

public SecurityErrorUserException createCopy(ExceptionTruncation truncation)

Returns a copy of the given exception where the specified details are removed. See ExceptionUtil for advanced usage and further details.
NOTE:
Implementations/subclasses can override the return type with the subclass. As Java does not support an implicit SELF generic and we do not want to overload all exceptions with a generic type. This default implementation is using clone to create a copy and truncate it as configured. However, a proper implementation would use the appropriate copy constructor instead.

Specified by:

createCopy in interface NlsThrowable

Overrides:

createCopy in class NlsRuntimeException

Parameters:

truncation - the ExceptionTruncation to configure what to remove. E.g. ExceptionTruncation.REMOVE_ALL.

Returns:

a truncated copy of this exception.

getCode

public String getCode()

This method gets the code that identifies the detailed type of this object. While UUID or ID are typically unique per instance of an object the code is unique for all instances of the exact same kind. So e.g. a particular kind of exception or ValidationFailure can be identified by its code. A simple generic implementation may return the classname or the key of the NLS message. However, the code should remain stable after refactoring (so at least after the rename the previous code should be returned as String literal). This code may be used as a compact identifier to reference the related problem or information as well as for automatic tests of error situations that should remain stable even if the message text gets improved or the locale is unknown.

Specified by:

getCode in interface AttributeReadMessageCode

Overrides:

getCode in class NlsRuntimeException

Returns:

the message text.

See Also:

Throwable.getMessage(), NlsThrowable, Message

isForUser

public boolean isForUser()

Specified by:

isForUser in interface NlsThrowable

Overrides:

isForUser in class NlsRuntimeException

Returns:

true if the message of this exception is for end-users (or clients), false otherwise (for internal technical errors).

isTechnical

public boolean isTechnical()

Determines if this is a technical exception.

• A technical exception is an unexpected situation that is to be logged on error level and should be analyzed by the operators or software developers of the system. Further in such case the end-user can typically do nothing about the problem (except to retry his operation) and will typically not understand the problem. Therefore a generic message should be displayed to the end-user in such case. See TechnicalErrorUserException.
• A non technical exception is called user failure. It is an undesired but NOT abnormal situation. It should be logged on a level less than error (typically info). The message is typically intended for to end-users and has to be easy to understand.

This separation is intentionally not done via inheritance of technical and business exception base classes to allow reuse. However, if you want to have it this way, create such classes derived from NlsRuntimeException.

Specified by:

isTechnical in interface NlsThrowable

Overrides:

isTechnical in class NlsRuntimeException

Returns:

true if this is a technical exception, false if this is a user error.

See Also:

NlsThrowable.isForUser()