Skip to content

Commit 517d89c

Browse files
malaqueueitmalaqueueit
committed
Cookie expiration
1 parent 1566fcd commit 517d89c

File tree

5 files changed

+181
-173
lines changed

5 files changed

+181
-173
lines changed

‎Build/Build.bat‎

Lines changed: 18 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -1,17 +1,19 @@
1-
@echo off
2-
SET ANT_HOME=%CD%\apache-ant-1.9.3
3-
4-
apache-ant-1.9.3/bin/ant.bat -f "..\QueueIT.Security" clean jar
5-
IF %ERRORLEVEL% NEQ 0 GOTO Error
6-
7-
xcopy ..\QueueIT.Security\dist\QueueIt.Security.jar /Y
8-
IF %ERRORLEVEL% NEQ 0 GOTO Error
9-
10-
GOTO End
11-
12-
:Error
13-
echo ###########################################
14-
echo # ERROR OCCURED WHILE COMPILING / TESTING #
15-
echo ###########################################
16-
1+
@echo off
2+
3+
SET ANT_HOME=%CD%\apache-ant-1.9.3
4+
5+
apache-ant-1.9.3/bin/ant.bat -f "..\QueueIT.Security" clean jar
6+
7+
IF %ERRORLEVEL% NEQ 0 GOTO Error
8+
9+
xcopy ..\QueueIT.Security\dist\QueueIt.Security.jar /Y
10+
IF %ERRORLEVEL% NEQ 0 GOTO Error
11+
12+
GOTO End
13+
14+
:Error
15+
echo ###########################################
16+
echo # ERROR OCCURED WHILE COMPILING / TESTING #
17+
echo ###########################################
18+
1719
:End

‎Build/QueueIt.Security.jar‎

481 Bytes
Binary file not shown.

‎QueueIT.Security.Examples/web/WEB-INF/classes/queueit.properties‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
11
secretKey = a774b1e2-8da7-4d51-b1a9-7647147bb13bace77210-a488-4b6f-afc9-8ba94551a7d7
22
queryStringPrefix =
3-
ticketExpiration = 180
3+
ticketExpiration = 180
4+
cookieExpiration = 1200

‎QueueIT.Security.Examples/web/simple.jsp‎

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -3,11 +3,6 @@
33
<%@page contentType="text/html" pageEncoding="UTF-8"%>
44
<%@taglib prefix="t" tagdir="/WEB-INF/tags" %>
55
<%
6-
SessionValidationController.Configure(null, new Callable<IValidateResultRepository>() {
7-
public IValidateResultRepository call() {
8-
return new SessionValidateResultRepository();
9-
}
10-
});
116
try
127
{
138
IValidateResult result = SessionValidationController.validateRequest();

‎QueueIT.Security/src/queueit/security/CookieValidateResultRepository.java‎

Lines changed: 161 additions & 151 deletions
Original file line numberDiff line numberDiff line change
@@ -1,151 +1,161 @@
1-
package queueit.security;
2-
3-
import java.io.InputStream;
4-
import java.io.UnsupportedEncodingException;
5-
import java.net.URI;
6-
import java.security.MessageDigest;
7-
import java.security.NoSuchAlgorithmException;
8-
import java.util.Date;
9-
import java.util.Properties;
10-
import java.util.UUID;
11-
import java.util.concurrent.Callable;
12-
import javax.servlet.http.*;
13-
import javax.xml.bind.DatatypeConverter;
14-
15-
public class CookieValidateResultRepository extends ValidateResultRepositoryBase {
16-
17-
static String defaultCookieDomain;
18-
19-
static {
20-
loadConfiguration();
21-
}
22-
23-
private static void loadConfiguration()
24-
{
25-
try {
26-
// Load the properties
27-
Properties props = new Properties();
28-
ClassLoader classLoader = CookieValidateResultRepository.class.getClassLoader();
29-
InputStream configFile = classLoader.getResourceAsStream("queueit.properties");
30-
if (configFile != null) {
31-
props.load(configFile);
32-
defaultCookieDomain = props.getProperty("cookieDomain", null);
33-
}
34-
} catch (Exception e) {
35-
// no need to handle exception
36-
}
37-
}
38-
@Override
39-
public IValidateResult getValidationResult(IQueue queue) {
40-
41-
String key = generateKey(queue.getCustomerId(), queue.getEventId());
42-
HttpServletRequest request = RequestContext.getCurrentInstance().getRequest();
43-
44-
String queueId = null;
45-
String originalUrl = null;
46-
String encryptedPlaceInQueue = null;
47-
String redirectType = null;
48-
String timeStamp = null;
49-
String actualHash = null;
50-
Integer placeInQueue = 0;
51-
52-
Cookie[] cookies = request.getCookies();
53-
for (int i = 0; i < cookies.length; i++)
54-
{
55-
if (cookies[i].getName().equals(key + "-QueueId"))
56-
queueId = cookies[i].getValue();
57-
if (cookies[i].getName().equals(key + "-OriginalUrl"))
58-
originalUrl = cookies[i].getValue();
59-
if (cookies[i].getName().equals(key + "-PlaceInQueue"))
60-
encryptedPlaceInQueue = cookies[i].getValue();
61-
if (cookies[i].getName().equals(key + "-RedirectType"))
62-
redirectType = cookies[i].getValue();
63-
if (cookies[i].getName().equals(key + "-TimeStamp"))
64-
timeStamp = cookies[i].getValue();
65-
if (cookies[i].getName().equals(key + "-Hash"))
66-
actualHash = cookies[i].getValue();
67-
}
68-
69-
if (queueId == null || originalUrl == null || encryptedPlaceInQueue == null || redirectType == null || timeStamp == null)
70-
return null;
71-
72-
try
73-
{
74-
placeInQueue = Hashing.decryptPlaceInQueue(encryptedPlaceInQueue);
75-
} catch (InvalidKnownUserUrlException ex) {
76-
return null;
77-
}
78-
79-
String expectedHash = generateHash(queueId, originalUrl, placeInQueue.toString(), redirectType, timeStamp);
80-
81-
if (!expectedHash.equals(actualHash))
82-
return null;
83-
84-
return new AcceptedConfirmedResult(
85-
queue,
86-
new Md5KnownUser(
87-
UUID.fromString(queueId),
88-
placeInQueue,
89-
new Date(Integer.parseInt(timeStamp)),
90-
queue.getCustomerId(),
91-
queue.getEventId(),
92-
RedirectType.valueOf(redirectType),
93-
URI.create(originalUrl)),
94-
false);
95-
}
96-
97-
@Override
98-
public void setValidationResult(IQueue queue, IValidateResult validationResult) {
99-
100-
if (validationResult instanceof AcceptedConfirmedResult)
101-
{
102-
AcceptedConfirmedResult confirmedResult = (AcceptedConfirmedResult)validationResult;
103-
104-
String key = generateKey(queue.getCustomerId(), queue.getEventId());
105-
HttpServletResponse response = RequestContext.getCurrentInstance().getResponse();
106-
107-
String queueId = confirmedResult.getKnownUser().getQueueId().toString();
108-
String originalUrl = confirmedResult.getKnownUser().getOriginalUrl().toString();
109-
Integer placeInQueue = confirmedResult.getKnownUser().getPlaceInQueue();
110-
String redirectType = confirmedResult.getKnownUser().getRedirectType().toString();
111-
Long timeStamp = confirmedResult.getKnownUser().getTimeStamp().getTime() / 1000;
112-
113-
String hash = generateHash(queueId, originalUrl, placeInQueue.toString(), redirectType, timeStamp.toString());
114-
115-
addCookie(new Cookie(key + "-QueueId", queueId), response);
116-
addCookie(new Cookie(key + "-OriginalUrl", originalUrl), response);
117-
addCookie(new Cookie(key + "-PlaceInQueue", Hashing.encryptPlaceInQueue(placeInQueue)), response);
118-
addCookie(new Cookie(key + "-RedirectType", redirectType), response);
119-
addCookie(new Cookie(key + "-TimeStamp", timeStamp.toString()), response);
120-
addCookie(new Cookie(key + "-Hash", hash), response);
121-
}
122-
}
123-
124-
private void addCookie(Cookie cookie, HttpServletResponse response)
125-
{
126-
cookie.setHttpOnly(true);
127-
if (defaultCookieDomain != null)
128-
cookie.setDomain(defaultCookieDomain);
129-
130-
response.addCookie(cookie);
131-
}
132-
133-
private String generateHash(String queueId, String originalUrl, String placeInQueue, String redirectType, String timeStamp) {
134-
try {
135-
StringBuilder sb = new StringBuilder();
136-
sb.append(queueId).append(originalUrl).append(placeInQueue).append(redirectType).append(timeStamp).append(KnownUserFactory.getSecretKey());
137-
138-
MessageDigest digest = MessageDigest.getInstance("SHA-256");
139-
byte[] hash = digest.digest(sb.toString().getBytes("UTF-8"));
140-
141-
return DatatypeConverter.printHexBinary(hash).toLowerCase();
142-
143-
} catch (NoSuchAlgorithmException ex) {
144-
// No such exception
145-
return null;
146-
} catch (UnsupportedEncodingException ex) {
147-
// No such exception
148-
return null;
149-
}
150-
}
151-
}
1+
package queueit.security;
2+
3+
import java.io.InputStream;
4+
import java.io.UnsupportedEncodingException;
5+
import java.net.URI;
6+
import java.security.MessageDigest;
7+
import java.security.NoSuchAlgorithmException;
8+
import java.util.Date;
9+
import java.util.Properties;
10+
import java.util.UUID;
11+
import java.util.concurrent.Callable;
12+
import javax.servlet.http.*;
13+
import javax.xml.bind.DatatypeConverter;
14+
15+
public class CookieValidateResultRepository extends ValidateResultRepositoryBase {
16+
17+
static String defaultCookieDomain;
18+
static int defaultCookieExpiration = 1200;
19+
20+
static {
21+
loadConfiguration();
22+
}
23+
24+
private static void loadConfiguration()
25+
{
26+
try {
27+
// Load the properties
28+
Properties props = new Properties();
29+
ClassLoader classLoader = CookieValidateResultRepository.class.getClassLoader();
30+
InputStream configFile = classLoader.getResourceAsStream("queueit.properties");
31+
if (configFile != null) {
32+
props.load(configFile);
33+
defaultCookieDomain = props.getProperty("cookieDomain", null);
34+
defaultCookieExpiration = Integer.parseInt(props.getProperty("cookieExpiration", "1200"));
35+
}
36+
} catch (Exception e) {
37+
// no need to handle exception
38+
}
39+
}
40+
@Override
41+
public IValidateResult getValidationResult(IQueue queue) {
42+
43+
String key = generateKey(queue.getCustomerId(), queue.getEventId());
44+
HttpServletRequest request = RequestContext.getCurrentInstance().getRequest();
45+
46+
String queueId = null;
47+
String originalUrl = null;
48+
String encryptedPlaceInQueue = null;
49+
String redirectType = null;
50+
String timeStamp = null;
51+
String actualHash = null;
52+
Integer placeInQueue = 0;
53+
54+
Cookie[] cookies = request.getCookies();
55+
for (int i = 0; i < cookies.length; i++)
56+
{
57+
if (cookies[i].getName().equals(key + "-QueueId"))
58+
queueId = cookies[i].getValue();
59+
if (cookies[i].getName().equals(key + "-OriginalUrl"))
60+
originalUrl = cookies[i].getValue();
61+
if (cookies[i].getName().equals(key + "-PlaceInQueue"))
62+
encryptedPlaceInQueue = cookies[i].getValue();
63+
if (cookies[i].getName().equals(key + "-RedirectType"))
64+
redirectType = cookies[i].getValue();
65+
if (cookies[i].getName().equals(key + "-TimeStamp"))
66+
timeStamp = cookies[i].getValue();
67+
if (cookies[i].getName().equals(key + "-Hash"))
68+
actualHash = cookies[i].getValue();
69+
}
70+
71+
if (queueId == null || originalUrl == null || encryptedPlaceInQueue == null || redirectType == null || timeStamp == null)
72+
return null;
73+
74+
try
75+
{
76+
placeInQueue = Hashing.decryptPlaceInQueue(encryptedPlaceInQueue);
77+
} catch (InvalidKnownUserUrlException ex) {
78+
return null;
79+
}
80+
81+
String expectedHash = generateHash(queueId, originalUrl, placeInQueue.toString(), redirectType, timeStamp);
82+
83+
if (!expectedHash.equals(actualHash))
84+
return null;
85+
86+
setCookie(queue, queueId, originalUrl, placeInQueue, redirectType, timeStamp, actualHash);
87+
88+
return new AcceptedConfirmedResult(
89+
queue,
90+
new Md5KnownUser(
91+
UUID.fromString(queueId),
92+
placeInQueue,
93+
new Date(Integer.parseInt(timeStamp)),
94+
queue.getCustomerId(),
95+
queue.getEventId(),
96+
RedirectType.valueOf(redirectType),
97+
URI.create(originalUrl)),
98+
false);
99+
}
100+
101+
@Override
102+
public void setValidationResult(IQueue queue, IValidateResult validationResult) {
103+
104+
if (validationResult instanceof AcceptedConfirmedResult)
105+
{
106+
AcceptedConfirmedResult confirmedResult = (AcceptedConfirmedResult)validationResult;
107+
108+
String queueId = confirmedResult.getKnownUser().getQueueId().toString();
109+
String originalUrl = confirmedResult.getKnownUser().getOriginalUrl().toString();
110+
Integer placeInQueue = confirmedResult.getKnownUser().getPlaceInQueue();
111+
String redirectType = confirmedResult.getKnownUser().getRedirectType().toString();
112+
Long timeStamp = confirmedResult.getKnownUser().getTimeStamp().getTime() / 1000;
113+
114+
String hash = generateHash(queueId, originalUrl, placeInQueue.toString(), redirectType, timeStamp.toString());
115+
116+
setCookie(queue, queueId, originalUrl, placeInQueue, redirectType, timeStamp.toString(), hash);
117+
}
118+
}
119+
120+
private void setCookie(IQueue queue, String queueId, String originalUrl, Integer placeInQueue, String redirectType, String timeStamp, String hash)
121+
{
122+
String key = generateKey(queue.getCustomerId(), queue.getEventId());
123+
HttpServletResponse response = RequestContext.getCurrentInstance().getResponse();
124+
125+
addCookie(new Cookie(key + "-QueueId", queueId), response);
126+
addCookie(new Cookie(key + "-OriginalUrl", originalUrl), response);
127+
addCookie(new Cookie(key + "-PlaceInQueue", Hashing.encryptPlaceInQueue(placeInQueue)), response);
128+
addCookie(new Cookie(key + "-RedirectType", redirectType), response);
129+
addCookie(new Cookie(key + "-TimeStamp", timeStamp.toString()), response);
130+
addCookie(new Cookie(key + "-Hash", hash), response);
131+
}
132+
133+
private void addCookie(Cookie cookie, HttpServletResponse response)
134+
{
135+
cookie.setHttpOnly(true);
136+
cookie.setMaxAge(defaultCookieExpiration);
137+
if (defaultCookieDomain != null)
138+
cookie.setDomain(defaultCookieDomain);
139+
140+
response.addCookie(cookie);
141+
}
142+
143+
private String generateHash(String queueId, String originalUrl, String placeInQueue, String redirectType, String timeStamp) {
144+
try {
145+
StringBuilder sb = new StringBuilder();
146+
sb.append(queueId).append(originalUrl).append(placeInQueue).append(redirectType).append(timeStamp).append(KnownUserFactory.getSecretKey());
147+
148+
MessageDigest digest = MessageDigest.getInstance("SHA-256");
149+
byte[] hash = digest.digest(sb.toString().getBytes("UTF-8"));
150+
151+
return DatatypeConverter.printHexBinary(hash).toLowerCase();
152+
153+
} catch (NoSuchAlgorithmException ex) {
154+
// No such exception
155+
return null;
156+
} catch (UnsupportedEncodingException ex) {
157+
// No such exception
158+
return null;
159+
}
160+
}
161+
}

0 commit comments

Comments
 (0)