class OtpAuthenticationFilter extends NiFiAuthenticationFilter {

    @Override
    public Authentication attemptAuthentication(final HttpServletRequest request) {
        // only support otp login when running securely
        if (!request.isSecure()) {
            return null;
        }

        // get the accessToken out of the query string
        final String accessToken = request.getParameter(ACCESS_TOKEN);

        // if there is no authorization header, we don't know the user
        if (accessToken == null) {
            return null;
        } else {
            if (request.getContextPath().equals("/nifi-api")) {
                if (isDownloadRequest(request.getPathInfo())) {
                    // handle download requests
                    return new OtpAuthenticationRequestToken(accessToken, true, request.getRemoteAddr());
                }
            } else {
                // handle requests to other context paths (other UI extensions)
                return new OtpAuthenticationRequestToken(accessToken, false, request.getRemoteAddr());
            }

            // the path is a support path for otp tokens
            return null;
        }
    }

}