You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@sling.apache.org by Hasini Witharana <ha...@gmail.com> on 2018/06/21 01:49:00 UTC
[Dev] Requesting browser cookie from Sling Servlets.
Hi all,
I am implementing an OpenID Connect(OIDC) handler for Apache Sling. In an
OIDC request there is a parameter called state. Below is the definition
given to state in OIDC specification[1].
state RECOMMENDED. Opaque value used to maintain state between the request
and the callback. Typically, Cross-Site Request Forgery (CSRF, XSRF)
mitigation is done by cryptographically binding the value of this parameter
with a browser cookie.
I want to store the state value in a HashMap against an unique parameter
such as browser cookie. Is there any implementation in Sling to take the
browser cookie or what should I use instead of cookie?
Thank You.
[1] - https://openid.net/specs/openid-connect-basic-1_0.html
--
*Hasini Witharana*
Undergraduate | Department of Computer Science and Engineering
University of Moratuwa
Linkedin <https://www.linkedin.com/in/hasini-witharana-185785109/>
Re: [Dev] Requesting browser cookie from Sling Servlets.
Posted by Robert Munteanu <ro...@apache.org>.
Hi Hasini,
On Thu, 2018-06-21 at 07:19 +0530, Hasini Witharana wrote:
> I want to store the state value in a HashMap against an unique
> parameter
> such as browser cookie. Is there any implementation in Sling to take
> the
> browser cookie or what should I use instead of cookie?
In a Sling Servlet you have the SlingHttpServletResponse object which
does everything that a 'JEE' HttpServletResponse does, including
response.addCookie(...)
So you can definitely use that.
Robert
Re: [Dev] Requesting browser cookie from Sling Servlets.
Posted by Bertrand Delacretaz <bd...@apache.org>.
Hi Hasini,
On Fri, Jun 22, 2018 at 12:09 PM Hasini Witharana
<ha...@gmail.com> wrote:
>... I have attached the diagram below...
Our dev list strips attachments, it's probably easier to put them on a
wiki page or Git ticket.
-Bertrand
Re: [Dev] Requesting browser cookie from Sling Servlets.
Posted by Hasini Witharana <ha...@gmail.com>.
wiki link : https://cwiki.apache.org/confluence/display/SLING/OIDC+Flow
On Fri, Jun 22, 2018 at 3:38 PM, Hasini Witharana <ha...@gmail.com>
wrote:
> Hi Robert,
>
> 1. User access Apache Sling login page
>>
>> - the login page contains a link to an external OAuth provider (Google)
>>
>
> We need to have a cookie on this point. When a user click the link a
> request is send to Google. This request contains a variable called state. I
> need to store this variable on a HashMap against the cookie value.
>
> I have attached the diagram below.
>
> Thank You.
>
> On Fri, Jun 22, 2018 at 2:26 PM, Robert Munteanu <ro...@apache.org>
> wrote:
>
>> On Thu, 2018-06-21 at 21:58 +0530, Hasini Witharana wrote:
>> > Below diagram contains the OIDC flow.
>>
>> (snip)
>>
>> It seems your diagram references a missing image file. But let's do
>> this 'inline'
>>
>>
>> My understanding is that the flow (roughly) is the following
>>
>> 1. User access Apache Sling login page
>>
>> - the login page contains a link to an external OAuth provider (Google)
>>
>> 2. User accesses 'Login with Google' link
>>
>> - the page now changes to Google's
>>
>> 3. User logs in to Google (if needed) and authorizes the sharing of
>> identity and maybe other data
>>
>> 4. Google redirects the user to the Apache Sling page with an encoded
>> message which contains the requested data
>>
>>
>> Is that correct? The question is, in which step do you want to use a
>> cookie and why?
>>
>> Thanks,
>>
>> Robert
>>
>
>
>
> --
> *Hasini Witharana*
> Undergraduate | Department of Computer Science and Engineering
> University of Moratuwa
> Linkedin <https://www.linkedin.com/in/hasini-witharana-185785109/>
>
--
*Hasini Witharana*
Undergraduate | Department of Computer Science and Engineering
University of Moratuwa
Linkedin <https://www.linkedin.com/in/hasini-witharana-185785109/>
Re: [Dev] Requesting browser cookie from Sling Servlets.
Posted by Hasini Witharana <ha...@gmail.com>.
On Fri, Jun 22, 2018, 5:47 PM Robert Munteanu <ro...@apache.org> wrote:
> On Fri, 2018-06-22 at 14:31 +0300, Robert Munteanu wrote:
> > On Fri, 2018-06-22 at 15:38 +0530, Hasini Witharana wrote:
> > > Hi Robert,
> > >
> > > 1. User access Apache Sling login page
> > > >
> > > > - the login page contains a link to an external OAuth provider
> > > > (Google)
> > > >
> > >
> > > We need to have a cookie on this point. When a user click the link
> > > a
> > > request is send to Google. This request contains a variable called
> > > state. I
> > > need to store this variable on a HashMap against the cookie value.
> >
> >
> > Then you can use the API I suggested to add a cookie. The value can
> > be
> > a UUID to make sure it's (practically) unique.
> >
> > In which step will that cookie's value be used?
>
> Based on the diagram from [1] I can now see where it is used. The
> follow-up questions is what are you using it for?
>
> Thanks,
>
> Robert
>
>
> [1]: https://cwiki.apache.org/confluence/display/SLING/OIDC+Flow
>
Re: [Dev] Requesting browser cookie from Sling Servlets.
Posted by Robert Munteanu <ro...@apache.org>.
On Mon, 2018-06-25 at 15:56 +0530, Hasini Witharana wrote:
> >
> > So then you could set a third-party cookie from Sling, i.e. a
> cookie
> > that is set for a different domain, matching whathever the google
> auth
> > endpoint is. Would that work?
> >
>
> I tested with the setCookie method and the same cookie was returned
> from
> Google. So can I use that method?
I don't see why not.
Robert
Re: [Dev] Requesting browser cookie from Sling Servlets.
Posted by Hasini Witharana <ha...@gmail.com>.
>
> So then you could set a third-party cookie from Sling, i.e. a cookie
> that is set for a different domain, matching whathever the google auth
> endpoint is. Would that work?
>
I tested with the setCookie method and the same cookie was returned from
Google. So can I use that method?
On Mon, Jun 25, 2018 at 3:52 PM, Robert Munteanu <ro...@apache.org> wrote:
> On Mon, 2018-06-25 at 15:50 +0530, Hasini Witharana wrote:
> > >
> > > 'Sent from the user' -> I assume that's sent from the user's
> > browser,
> > > but to whom? To the Authorization endpoint? And is that supposed to
> > be
> > > set by the Relying Party?
> > >
> >
> > Sent from users's browser to Google's authorization endpoint. Relying
> > party
> > need to do the state validation hence I think RP should set the
> > cookie
> > value.
>
> So then you could set a third-party cookie from Sling, i.e. a cookie
> that is set for a different domain, matching whathever the google auth
> endpoint is. Would that work?
>
> Robert
>
--
*Hasini Witharana*
Undergraduate | Department of Computer Science and Engineering
University of Moratuwa
Linkedin <https://www.linkedin.com/in/hasini-witharana-185785109/>
Re: [Dev] Requesting browser cookie from Sling Servlets.
Posted by Robert Munteanu <ro...@apache.org>.
On Mon, 2018-06-25 at 15:50 +0530, Hasini Witharana wrote:
> >
> > 'Sent from the user' -> I assume that's sent from the user's
> browser,
> > but to whom? To the Authorization endpoint? And is that supposed to
> be
> > set by the Relying Party?
> >
>
> Sent from users's browser to Google's authorization endpoint. Relying
> party
> need to do the state validation hence I think RP should set the
> cookie
> value.
So then you could set a third-party cookie from Sling, i.e. a cookie
that is set for a different domain, matching whathever the google auth
endpoint is. Would that work?
Robert
Re: [Dev] Requesting browser cookie from Sling Servlets.
Posted by Hasini Witharana <ha...@gmail.com>.
>
> 'Sent from the user' -> I assume that's sent from the user's browser,
> but to whom? To the Authorization endpoint? And is that supposed to be
> set by the Relying Party?
>
Sent from users's browser to Google's authorization endpoint. Relying party
need to do the state validation hence I think RP should set the cookie
value.
On Mon, Jun 25, 2018 at 3:34 PM, Robert Munteanu <ro...@apache.org> wrote:
> On Mon, 2018-06-25 at 15:30 +0530, Hasini Witharana wrote:
> > >
> > > When the auth endpoint calls back to the relying party
> > > (authorization
> > > code request) with a state parameter, we need to check that it is
> > > valid
> > > against a particular user, right? But how do we identify that
> > > specific
> > > user (in Apache Sling), since there is no authentication done?
> > >
> >
> > We need to validate it against the authorization request sent from
> > the
> > user, that is why I need a cookie.
>
>
> 'Sent from the user' -> I assume that's sent from the user's browser,
> but to whom? To the Authorization endpoint? And is that supposed to be
> set by the Relying Party?
>
> Robert
>
--
*Hasini Witharana*
Undergraduate | Department of Computer Science and Engineering
University of Moratuwa
Linkedin <https://www.linkedin.com/in/hasini-witharana-185785109/>
Re: [Dev] Requesting browser cookie from Sling Servlets.
Posted by Robert Munteanu <ro...@apache.org>.
On Mon, 2018-06-25 at 15:30 +0530, Hasini Witharana wrote:
> >
> > When the auth endpoint calls back to the relying party
> > (authorization
> > code request) with a state parameter, we need to check that it is
> > valid
> > against a particular user, right? But how do we identify that
> > specific
> > user (in Apache Sling), since there is no authentication done?
> >
>
> We need to validate it against the authorization request sent from
> the
> user, that is why I need a cookie.
'Sent from the user' -> I assume that's sent from the user's browser,
but to whom? To the Authorization endpoint? And is that supposed to be
set by the Relying Party?
Robert
Re: [Dev] Requesting browser cookie from Sling Servlets.
Posted by Hasini Witharana <ha...@gmail.com>.
>
> When the auth endpoint calls back to the relying party (authorization
> code request) with a state parameter, we need to check that it is valid
> against a particular user, right? But how do we identify that specific
> user (in Apache Sling), since there is no authentication done?
>
We need to validate it against the authorization request sent from the
user, that is why I need a cookie.
Thank You.
On Mon, Jun 25, 2018 at 3:16 PM, Robert Munteanu <ro...@apache.org> wrote:
> On Sat, 2018-06-23 at 00:28 +0530, Hasini Witharana wrote:
> > >
> > > The follow-up questions is what are you using it for?
> > >
> >
> > As I mentioned before the authorization request to Google, contains a
> > variable "state". After user is authenticated Google will send a
> > response
> > with attaching the same "state" value. We need to check the two state
> > variables and validate that both are equal. To do this validation the
> > first
> > state value should be stored against a unique parameter that helps to
> > identify the request from a particular user.
> >
> > The main reason of this state validation is to stop Cross Site
> > Request
> > Forgery. For more information can refer to [1]. For OIDC Basic flow
> > state
> > is Optional. But it is recommended to implement for the security
> > purposes.
> >
> > [1] -
> > http://www.thread-safe.com/2014/05/the-correct-use-of-state-parameter
> > -in.html
>
> OK, so IIUC you need to
>
> a) generate a unique value for a given authentication request
> b) send it via the 'state' parameter to the authentication end point
> c) when the authentication callback is received, validate that the
> 'state' parameter sent is the one that is expected
>
> I'm missing something here I think, also looking at the OIDC flow
> diagram from [2].
>
> When the auth endpoint calls back to the relying party (authorization
> code request) with a state parameter, we need to check that it is valid
> against a particular user, right? But how do we identify that specific
> user (in Apache Sling), since there is no authentication done?
>
> Thanks,
>
> Robert
>
>
> [2]: https://cwiki.apache.org/confluence/display/SLING/OIDC+Flow
>
--
*Hasini Witharana*
Undergraduate | Department of Computer Science and Engineering
University of Moratuwa
Linkedin <https://www.linkedin.com/in/hasini-witharana-185785109/>
Re: [Dev] Requesting browser cookie from Sling Servlets.
Posted by Robert Munteanu <ro...@apache.org>.
On Sat, 2018-06-23 at 00:28 +0530, Hasini Witharana wrote:
> >
> > The follow-up questions is what are you using it for?
> >
>
> As I mentioned before the authorization request to Google, contains a
> variable "state". After user is authenticated Google will send a
> response
> with attaching the same "state" value. We need to check the two state
> variables and validate that both are equal. To do this validation the
> first
> state value should be stored against a unique parameter that helps to
> identify the request from a particular user.
>
> The main reason of this state validation is to stop Cross Site
> Request
> Forgery. For more information can refer to [1]. For OIDC Basic flow
> state
> is Optional. But it is recommended to implement for the security
> purposes.
>
> [1] -
> http://www.thread-safe.com/2014/05/the-correct-use-of-state-parameter
> -in.html
OK, so IIUC you need to
a) generate a unique value for a given authentication request
b) send it via the 'state' parameter to the authentication end point
c) when the authentication callback is received, validate that the
'state' parameter sent is the one that is expected
I'm missing something here I think, also looking at the OIDC flow
diagram from [2].
When the auth endpoint calls back to the relying party (authorization
code request) with a state parameter, we need to check that it is valid
against a particular user, right? But how do we identify that specific
user (in Apache Sling), since there is no authentication done?
Thanks,
Robert
[2]: https://cwiki.apache.org/confluence/display/SLING/OIDC+Flow
Re: [Dev] Requesting browser cookie from Sling Servlets.
Posted by Hasini Witharana <ha...@gmail.com>.
>
> The follow-up questions is what are you using it for?
>
As I mentioned before the authorization request to Google, contains a
variable "state". After user is authenticated Google will send a response
with attaching the same "state" value. We need to check the two state
variables and validate that both are equal. To do this validation the first
state value should be stored against a unique parameter that helps to
identify the request from a particular user.
The main reason of this state validation is to stop Cross Site Request
Forgery. For more information can refer to [1]. For OIDC Basic flow state
is Optional. But it is recommended to implement for the security purposes.
[1] -
http://www.thread-safe.com/2014/05/the-correct-use-of-state-parameter-in.html
Thank You
On Fri, Jun 22, 2018 at 5:47 PM, Robert Munteanu <ro...@apache.org> wrote:
> On Fri, 2018-06-22 at 14:31 +0300, Robert Munteanu wrote:
> > On Fri, 2018-06-22 at 15:38 +0530, Hasini Witharana wrote:
> > > Hi Robert,
> > >
> > > 1. User access Apache Sling login page
> > > >
> > > > - the login page contains a link to an external OAuth provider
> > > > (Google)
> > > >
> > >
> > > We need to have a cookie on this point. When a user click the link
> > > a
> > > request is send to Google. This request contains a variable called
> > > state. I
> > > need to store this variable on a HashMap against the cookie value.
> >
> >
> > Then you can use the API I suggested to add a cookie. The value can
> > be
> > a UUID to make sure it's (practically) unique.
> >
> > In which step will that cookie's value be used?
>
> Based on the diagram from [1] I can now see where it is used. The
> follow-up questions is what are you using it for?
>
> Thanks,
>
> Robert
>
>
> [1]: https://cwiki.apache.org/confluence/display/SLING/OIDC+Flow
>
--
*Hasini Witharana*
Undergraduate | Department of Computer Science and Engineering
University of Moratuwa
Linkedin <https://www.linkedin.com/in/hasini-witharana-185785109/>
Re: [Dev] Requesting browser cookie from Sling Servlets.
Posted by Robert Munteanu <ro...@apache.org>.
On Fri, 2018-06-22 at 14:31 +0300, Robert Munteanu wrote:
> On Fri, 2018-06-22 at 15:38 +0530, Hasini Witharana wrote:
> > Hi Robert,
> >
> > 1. User access Apache Sling login page
> > >
> > > - the login page contains a link to an external OAuth provider
> > > (Google)
> > >
> >
> > We need to have a cookie on this point. When a user click the link
> > a
> > request is send to Google. This request contains a variable called
> > state. I
> > need to store this variable on a HashMap against the cookie value.
>
>
> Then you can use the API I suggested to add a cookie. The value can
> be
> a UUID to make sure it's (practically) unique.
>
> In which step will that cookie's value be used?
Based on the diagram from [1] I can now see where it is used. The
follow-up questions is what are you using it for?
Thanks,
Robert
[1]: https://cwiki.apache.org/confluence/display/SLING/OIDC+Flow
Re: [Dev] Requesting browser cookie from Sling Servlets.
Posted by Robert Munteanu <ro...@apache.org>.
On Fri, 2018-06-22 at 15:38 +0530, Hasini Witharana wrote:
> Hi Robert,
>
> 1. User access Apache Sling login page
> >
> > - the login page contains a link to an external OAuth provider
> > (Google)
> >
>
> We need to have a cookie on this point. When a user click the link a
> request is send to Google. This request contains a variable called
> state. I
> need to store this variable on a HashMap against the cookie value.
Then you can use the API I suggested to add a cookie. The value can be
a UUID to make sure it's (practically) unique.
In which step will that cookie's value be used?
Robert
Re: [Dev] Requesting browser cookie from Sling Servlets.
Posted by Hasini Witharana <ha...@gmail.com>.
Hi Robert,
1. User access Apache Sling login page
>
> - the login page contains a link to an external OAuth provider (Google)
>
We need to have a cookie on this point. When a user click the link a
request is send to Google. This request contains a variable called state. I
need to store this variable on a HashMap against the cookie value.
I have attached the diagram below.
Thank You.
On Fri, Jun 22, 2018 at 2:26 PM, Robert Munteanu <ro...@apache.org> wrote:
> On Thu, 2018-06-21 at 21:58 +0530, Hasini Witharana wrote:
> > Below diagram contains the OIDC flow.
>
> (snip)
>
> It seems your diagram references a missing image file. But let's do
> this 'inline'
>
>
> My understanding is that the flow (roughly) is the following
>
> 1. User access Apache Sling login page
>
> - the login page contains a link to an external OAuth provider (Google)
>
> 2. User accesses 'Login with Google' link
>
> - the page now changes to Google's
>
> 3. User logs in to Google (if needed) and authorizes the sharing of
> identity and maybe other data
>
> 4. Google redirects the user to the Apache Sling page with an encoded
> message which contains the requested data
>
>
> Is that correct? The question is, in which step do you want to use a
> cookie and why?
>
> Thanks,
>
> Robert
>
--
*Hasini Witharana*
Undergraduate | Department of Computer Science and Engineering
University of Moratuwa
Linkedin <https://www.linkedin.com/in/hasini-witharana-185785109/>
Re: [Dev] Requesting browser cookie from Sling Servlets.
Posted by Robert Munteanu <ro...@apache.org>.
On Thu, 2018-06-21 at 21:58 +0530, Hasini Witharana wrote:
> Below diagram contains the OIDC flow.
(snip)
It seems your diagram references a missing image file. But let's do
this 'inline'
My understanding is that the flow (roughly) is the following
1. User access Apache Sling login page
- the login page contains a link to an external OAuth provider (Google)
2. User accesses 'Login with Google' link
- the page now changes to Google's
3. User logs in to Google (if needed) and authorizes the sharing of
identity and maybe other data
4. Google redirects the user to the Apache Sling page with an encoded
message which contains the requested data
Is that correct? The question is, in which step do you want to use a
cookie and why?
Thanks,
Robert
Re: [Dev] Requesting browser cookie from Sling Servlets.
Posted by Hasini Witharana <ha...@gmail.com>.
Below diagram contains the OIDC flow.
On Thu, Jun 21, 2018 at 7:19 AM, Hasini Witharana <ha...@gmail.com>
wrote:
> Hi all,
>
> I am implementing an OpenID Connect(OIDC) handler for Apache Sling. In an
> OIDC request there is a parameter called state. Below is the definition
> given to state in OIDC specification[1].
> state RECOMMENDED. Opaque value used to maintain state between the
> request and the callback. Typically, Cross-Site Request Forgery (CSRF,
> XSRF) mitigation is done by cryptographically binding the value of this
> parameter with a browser cookie.
> I want to store the state value in a HashMap against an unique parameter
> such as browser cookie. Is there any implementation in Sling to take the
> browser cookie or what should I use instead of cookie?
>
> Thank You.
> [1] - https://openid.net/specs/openid-connect-basic-1_0.html
>
>
> --
> *Hasini Witharana*
> Undergraduate | Department of Computer Science and Engineering
> University of Moratuwa
> Linkedin <https://www.linkedin.com/in/hasini-witharana-185785109/>
>
--
*Hasini Witharana*
Undergraduate | Department of Computer Science and Engineering
University of Moratuwa
Linkedin <https://www.linkedin.com/in/hasini-witharana-185785109/>