Skip to content

Commit 6366355

Browse files
stroomdev66stroomdev66
committed
Improve HTTP session creation and usage
1 parent 34dadec commit 6366355

File tree

5 files changed

+39
-132
lines changed

5 files changed

+39
-132
lines changed

‎stroom-core-shared/src/main/java/stroom/security/shared/SessionResource.java‎

Lines changed: 0 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -29,13 +29,6 @@ public interface SessionResource extends RestResource, DirectRestService {
2929
String LIST_PATH_PART = "/list";
3030
String NODE_NAME_PARAM = "nodeName";
3131

32-
@GET
33-
@Path("/noauth/validateSession")
34-
@Operation(
35-
summary = "Validate the current session, return a redirect Uri if invalid.",
36-
operationId = "validateStroomSession")
37-
ValidateSessionResponse validateSession(@QueryParam("redirect_uri") @NotNull String redirectUri);
38-
3932
@GET
4033
@Path("logout")
4134
@Operation(

‎stroom-security/stroom-security-common-impl/src/main/java/stroom/security/common/impl/UserIdentitySessionUtil.java‎

Lines changed: 1 addition & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -4,22 +4,20 @@
44
import stroom.util.logging.LambdaLogger;
55
import stroom.util.logging.LambdaLoggerFactory;
66
import stroom.util.logging.LogUtil;
7-
import stroom.util.servlet.UserAgentSessionUtil;
87
import stroom.util.shared.NullSafe;
98

109
import jakarta.servlet.http.HttpServletRequest;
1110
import jakarta.servlet.http.HttpSession;
1211

1312
import java.util.Arrays;
1413
import java.util.Optional;
14+
import javax.swing.text.html.Option;
1515

1616
public final class UserIdentitySessionUtil {
1717

1818
private static final LambdaLogger LOGGER = LambdaLoggerFactory.getLogger(UserIdentitySessionUtil.class);
1919

2020
private static final String SESSION_USER_IDENTITY = "SESSION_USER_IDENTITY";
21-
private static final String STROOM_SESSION_ID = "STROOM_SESSION_ID";
22-
private static final String JSESSIONID = "JSESSIONID";
2321

2422
private UserIdentitySessionUtil() {
2523
}
@@ -32,41 +30,11 @@ public static void set(final HttpSession session, final UserIdentity userIdentit
3230
userIdentity,
3331
NullSafe.get(userIdentity, UserIdentity::getClass, Class::getSimpleName),
3432
NullSafe.get(session, HttpSession::getId)));
35-
3633
session.setAttribute(SESSION_USER_IDENTITY, userIdentity);
3734
}
3835

39-
/**
40-
* Set the userIdentity on the session, creating the session as required
41-
*/
42-
public static void set(final HttpServletRequest request, final UserIdentity userIdentity) {
43-
// Set the user ref in the session.
44-
final HttpSession session = request.getSession(true);
45-
set(session, userIdentity);
46-
// Now we have the session make note of the user-agent for logging and sessionListServlet duties
47-
UserAgentSessionUtil.setUserAgentInSession(request, session);
48-
}
49-
5036
public static Optional<UserIdentity> get(final HttpSession session) {
5137
return Optional.ofNullable(session)
5238
.map(session2 -> (UserIdentity) session2.getAttribute(SESSION_USER_IDENTITY));
5339
}
54-
55-
public static Optional<UserIdentity> get(final HttpServletRequest request) {
56-
return Optional.ofNullable(request)
57-
.flatMap(req -> get(req.getSession(false)));
58-
}
59-
60-
public static boolean requestHasSessionCookie(final HttpServletRequest request) {
61-
if (request == null || request.getCookies() == null) {
62-
return false;
63-
}
64-
65-
// Find out if we have a session cookie
66-
return Arrays
67-
.stream(request.getCookies())
68-
.anyMatch(cookie ->
69-
cookie.getName().equalsIgnoreCase(STROOM_SESSION_ID) ||
70-
cookie.getName().equalsIgnoreCase(JSESSIONID));
71-
}
7240
}

‎stroom-security/stroom-security-impl/src/main/java/stroom/security/impl/OpenIdManager.java‎

Lines changed: 1 addition & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -113,7 +113,7 @@ private String backChannelOIDC(final HttpServletRequest request,
113113

114114
if (optionalUserIdentity.isPresent()) {
115115
// Set the token in the session.
116-
UserIdentitySessionUtil.set(request, optionalUserIdentity.get());
116+
UserIdentitySessionUtil.set(request.getSession(true), optionalUserIdentity.get());
117117

118118
// Successful login, so redirect to the original URL held in the state.
119119
LOGGER.info(() -> "Redirecting to initiating URI: " + state.getInitiatingUri());
@@ -142,26 +142,6 @@ public Optional<UserIdentity> loginWithRequestToken(final HttpServletRequest req
142142
}
143143
}
144144

145-
public Optional<UserIdentity> getOrSetSessionUser(final HttpServletRequest request,
146-
final Optional<UserIdentity> userIdentity) {
147-
Optional<UserIdentity> result = userIdentity;
148-
149-
if (userIdentity.isEmpty()) {
150-
// Provide identity from the session if we are allowing this to happen.
151-
result = UserIdentitySessionUtil.get(request.getSession(false));
152-
153-
if (LOGGER.isDebugEnabled()) {
154-
LOGGER.debug("User identity from session: [{}]", result.orElse(null));
155-
}
156-
157-
} else if (UserIdentitySessionUtil.requestHasSessionCookie(request)) {
158-
// Set the user ref in the session.
159-
UserIdentitySessionUtil.set(request.getSession(true), userIdentity.get());
160-
}
161-
162-
return result;
163-
}
164-
165145
public String logout(final String postAuthRedirectUri) {
166146
final String endpoint = openIdConfiguration.getLogoutEndpoint();
167147
final String clientId = openIdConfiguration.getClientId();

‎stroom-security/stroom-security-impl/src/main/java/stroom/security/impl/SecurityFilter.java‎

Lines changed: 37 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,7 @@
2626
import stroom.util.logging.LambdaLoggerFactory;
2727
import stroom.util.logging.LogUtil;
2828
import stroom.util.net.UrlUtils;
29+
import stroom.util.servlet.UserAgentSessionUtil;
2930
import stroom.util.shared.AuthenticationBypassChecker;
3031
import stroom.util.shared.NullSafe;
3132
import stroom.util.shared.ResourcePaths;
@@ -62,6 +63,8 @@ class SecurityFilter implements Filter {
6263
".jpg", ".gif", ".ico", ".svg", ".ttf", ".woff", ".woff2");
6364

6465
private static final String SIGN_IN_URL_PATH = ResourcePaths.buildServletPath(ResourcePaths.SIGN_IN_PATH);
66+
private static final String STROOM_SESSION_ID = "STROOM_SESSION_ID";
67+
private static final String JSESSIONID = "JSESSIONID";
6568

6669
private final UriFactory uriFactory;
6770
private final SecurityContext securityContext;
@@ -152,27 +155,35 @@ private void filter(final HttpServletRequest request,
152155
// Need to do this first, so we get a fresh token from AWS ALB rather than using a stale
153156
// one from session.
154157
optUserIdentity = openIdManager.loginWithRequestToken(request);
158+
optUserIdentity.ifPresent(userIdentity ->
159+
ensureSessionIfCookiePresent(request).ifPresent(session -> {
160+
LOGGER.debug(() -> LogUtil.message("Setting user in session, user: {} {}, path: {}",
161+
userIdentity.getClass().getSimpleName(),
162+
userIdentity,
163+
fullPath));
164+
UserIdentitySessionUtil.set(session, userIdentity);
165+
}));
166+
167+
// Log current user.
155168
if (LOGGER.isDebugEnabled()) {
156169
logUserIdentityToDebug(
157170
optUserIdentity, fullPath, "after trying to login with request token");
158171
}
159172

160173
// If no user from header token, see if we have one in session already.
161-
optUserIdentity = openIdManager.getOrSetSessionUser(request, optUserIdentity);
162-
if (LOGGER.isDebugEnabled()) {
163-
logUserIdentityToDebug(optUserIdentity, fullPath, "from session");
174+
if (optUserIdentity.isEmpty()) {
175+
optUserIdentity = UserIdentitySessionUtil.get(request.getSession(false));
176+
if (LOGGER.isDebugEnabled()) {
177+
logUserIdentityToDebug(optUserIdentity, fullPath, "from session");
178+
}
164179
}
165180

166181
if (optUserIdentity.isPresent()) {
167182
final UserIdentity userIdentity = optUserIdentity.get();
168-
LOGGER.debug(() -> LogUtil.message("Setting user in session, user: {} {}, path: {}",
169-
userIdentity.getClass().getSimpleName(),
170-
userIdentity,
171-
fullPath));
172-
// Set the identity in session if we have a session and cookie
173-
if (UserIdentitySessionUtil.requestHasSessionCookie(request)) {
174-
UserIdentitySessionUtil.set(request, userIdentity);
175-
}
183+
184+
// Now we have the session make note of the user-agent for logging and sessionListServlet duties
185+
ensureSessionIfCookiePresent(request).ifPresent(session ->
186+
UserAgentSessionUtil.setUserAgentInSession(request, session));
176187

177188
// Now handle the request as this user
178189
securityContext.asUser(userIdentity, () ->
@@ -319,4 +330,19 @@ private void process(final HttpServletRequest request,
319330
@Override
320331
public void destroy() {
321332
}
333+
334+
private Optional<HttpSession> ensureSessionIfCookiePresent(final HttpServletRequest request) {
335+
if (requestHasSessionCookie(request)) {
336+
return Optional.of(request.getSession(true));
337+
}
338+
return Optional.empty();
339+
}
340+
341+
private boolean requestHasSessionCookie(final HttpServletRequest request) {
342+
// Find out if we have a session cookie
343+
return NullSafe.stream(NullSafe.get(request, HttpServletRequest::getCookies))
344+
.anyMatch(cookie ->
345+
cookie.getName().equalsIgnoreCase(STROOM_SESSION_ID) ||
346+
cookie.getName().equalsIgnoreCase(JSESSIONID));
347+
}
322348
}

‎stroom-security/stroom-security-impl/src/main/java/stroom/security/impl/SessionResourceImpl.java‎

Lines changed: 0 additions & 60 deletions
Original file line numberDiff line numberDiff line change
@@ -2,13 +2,10 @@
22

33
import stroom.event.logging.rs.api.AutoLogged;
44
import stroom.event.logging.rs.api.AutoLogged.OperationType;
5-
import stroom.security.api.UserIdentity;
65
import stroom.security.common.impl.UserIdentitySessionUtil;
7-
import stroom.security.openid.api.OpenId;
86
import stroom.security.shared.SessionListResponse;
97
import stroom.security.shared.SessionResource;
108
import stroom.security.shared.UrlResponse;
11-
import stroom.security.shared.ValidateSessionResponse;
129

1310
import jakarta.inject.Inject;
1411
import jakarta.inject.Provider;
@@ -17,10 +14,6 @@
1714
import org.slf4j.Logger;
1815
import org.slf4j.LoggerFactory;
1916

20-
import java.net.URLDecoder;
21-
import java.nio.charset.StandardCharsets;
22-
import java.util.Optional;
23-
2417
@AutoLogged(OperationType.MANUALLY_LOGGED)
2518
class SessionResourceImpl implements SessionResource {
2619

@@ -45,59 +38,6 @@ class SessionResourceImpl implements SessionResource {
4538
this.stroomUserIdentityFactoryProvider = stroomUserIdentityFactoryProvider;
4639
}
4740

48-
@Override
49-
@AutoLogged(OperationType.UNLOGGED)
50-
public ValidateSessionResponse validateSession(final String postAuthRedirectUri) {
51-
final OpenIdManager openIdManager = openIdManagerProvider.get();
52-
final HttpServletRequest request = httpServletRequestProvider.get();
53-
Optional<UserIdentity> userIdentity = openIdManager.loginWithRequestToken(request);
54-
userIdentity = openIdManager.getOrSetSessionUser(request, userIdentity);
55-
if (userIdentity.isPresent()) {
56-
return new ValidateSessionResponse(true, userIdentity.get().getSubjectId(), null);
57-
}
58-
59-
// If the session doesn't have a user ref then attempt login.
60-
try {
61-
LOGGER.debug("Using postAuthRedirectUri: {}", postAuthRedirectUri);
62-
63-
// We might have completed the back channel authentication now so see if we have a user session.
64-
userIdentity = UserIdentitySessionUtil.get(request.getSession(false));
65-
return userIdentity
66-
.map(identity ->
67-
createValidResponse(identity.getSubjectId()))
68-
.orElseGet(() -> createRedirectResponse(request, postAuthRedirectUri));
69-
70-
} catch (final RuntimeException e) {
71-
LOGGER.error(e.getMessage(), e);
72-
throw e;
73-
}
74-
}
75-
76-
private ValidateSessionResponse createValidResponse(final String userId) {
77-
return new ValidateSessionResponse(true, userId, null);
78-
}
79-
80-
private ValidateSessionResponse createRedirectResponse(final HttpServletRequest request, final String url) {
81-
final OpenIdManager openIdManager = openIdManagerProvider.get();
82-
final String code = getParam(url, OpenId.CODE);
83-
final String stateId = getParam(url, OpenId.STATE);
84-
final String redirectUri = openIdManager.redirect(request, code, stateId, url);
85-
return new ValidateSessionResponse(false, null, redirectUri);
86-
}
87-
88-
private String getParam(final String url, final String param) {
89-
int start = url.indexOf(param + "=");
90-
if (start != -1) {
91-
start += param.length() + 1;
92-
final int end = url.indexOf("&", start);
93-
if (end != -1) {
94-
return URLDecoder.decode(url.substring(start, end), StandardCharsets.UTF_8);
95-
}
96-
return URLDecoder.decode(url.substring(start), StandardCharsets.UTF_8);
97-
}
98-
return null;
99-
}
100-
10141
@Override
10242
@AutoLogged(OperationType.MANUALLY_LOGGED)
10343
public UrlResponse logout(final String redirectUri) {

0 commit comments

Comments
 (0)