Source:
public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException { final HttpServletRequest httpRequest = (HttpServletRequest) request; final HttpSession session = httpRequest.getSession(false); final Subject sessionSubject; if (session != null && (sessionSubject = (Subject) session.getAttribute("principal")) != null) { try { EnvironmentContext.getCurrent().setSubject(sessionSubject); chain.doFilter(request, response); return; } finally { EnvironmentContext.reset(); } } final String token = tokenExtractor.getToken(httpRequest); if (isNullOrEmpty(token)) { sendErr(response, SC_UNAUTHORIZED, "Authentication on machine failed, token is missed."); return; } try { final Jws<Claims> jws = Jwts.parser().setSigningKey(publicKey).parseClaimsJws(token); final Claims claims = jws.getBody(); if (MACHINE_TOKEN_KIND.equals(jws.getHeader().get("kind")) && workspaceId.equals(claims.get(WORKSPACE_ID_CLAIM, String.class))) { final SubjectImpl subject = new SubjectImpl( claims.get(USER_NAME_CLAIM, String.class), claims.get(USER_ID_CLAIM, String.class), null, false); try { EnvironmentContext.getCurrent().setSubject(subject); final HttpSession httpSession = httpRequest.getSession(true); httpSession.setAttribute("principal", subject); chain.doFilter(request, response); } finally { EnvironmentContext.reset(); } } else { sendErr(response, SC_UNAUTHORIZED, "Authentication on machine failed, token is missed."); } } catch (RuntimeException ex) { sendErr( response, SC_UNAUTHORIZED, format("Authentication on machine failed cause: '%s'", ex.getMessage())); } }

Target:
public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException { final HttpServletRequest httpRequest = (HttpServletRequest) request; final HttpSession session = httpRequest.getSession(false); final Subject sessionSubject; if (session != null && (sessionSubject = (Subject) session.getAttribute("principal")) != null) { try { EnvironmentContext.getCurrent().setSubject(sessionSubject); chain.doFilter(request, response); return; } finally { EnvironmentContext.reset(); } } final String token = tokenExtractor.getToken(httpRequest); if (isNullOrEmpty(token)) { sendErr(response, SC_UNAUTHORIZED, "Authentication on machine failed, token is missed."); return; } try { final Jws<Claims> jwt = Jwts.parser().setSigningKey(publicKey).parseClaimsJws(token); final Claims claims = jwt.getBody(); if (!isValidToken(jwt)) { sendErr( response, SC_UNAUTHORIZED, "Authentication on machine failed, invalid token provided."); return; } try { final SubjectImpl subject = new SubjectImpl( claims.get(USER_NAME_CLAIM, String.class), claims.get(USER_ID_CLAIM, String.class), token, false); EnvironmentContext.getCurrent().setSubject(subject); final HttpSession httpSession = httpRequest.getSession(true); httpSession.setAttribute("principal", subject); chain.doFilter(request, response); } finally { EnvironmentContext.reset(); } } catch (ExpiredJwtException | UnsupportedJwtException | MalformedJwtException | SignatureException | IllegalArgumentException ex) { sendErr( response, SC_UNAUTHORIZED, format("Authentication on machine failed cause: '%s'", ex.getMessage())); } }