You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@brooklyn.apache.org by he...@apache.org on 2019/02/11 11:08:43 UTC
[brooklyn-server] branch master updated (da7db69 -> 6ec9a74)
This is an automated email from the ASF dual-hosted git repository.
heneveld pushed a change to branch master
in repository https://gitbox.apache.org/repos/asf/brooklyn-server.git.
from da7db69 update license/notice for new deps
new d84efa6 change scavenge interval to 1 hour
new 8496f71 CSRF and sessionAdapter changes
new 29e4acb CSRF creates token if isn't present
new fd0670c preferredSession max interval updated
new 9a183da This closes #1036
new 6ec9a74 dampen CSRF logging
The 6 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
Summary of changes:
karaf/jetty-config/src/main/resources/jetty.xml | 15 +++++++++++++++
.../brooklyn/rest/filter/CsrfTokenFilter.java | 21 ++++++++++++---------
.../rest/util/MultiSessionAttributeAdapter.java | 9 ++++++++-
3 files changed, 35 insertions(+), 10 deletions(-)
[brooklyn-server] 02/06: CSRF and sessionAdapter changes
Posted by he...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
heneveld pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/brooklyn-server.git
commit 8496f718739c035dfaae0d7b99ac136cb2191989
Author: Juan Cabrerizo <ju...@cloudsoft.io>
AuthorDate: Fri Feb 8 13:39:10 2019 +0000
CSRF and sessionAdapter changes
---
.../brooklyn/rest/filter/CsrfTokenFilter.java | 23 +++++++++++-----------
.../rest/util/MultiSessionAttributeAdapter.java | 4 ++++
2 files changed, 16 insertions(+), 11 deletions(-)
diff --git a/rest/rest-resources/src/main/java/org/apache/brooklyn/rest/filter/CsrfTokenFilter.java b/rest/rest-resources/src/main/java/org/apache/brooklyn/rest/filter/CsrfTokenFilter.java
index ac00c14..3c7ff3c 100644
--- a/rest/rest-resources/src/main/java/org/apache/brooklyn/rest/filter/CsrfTokenFilter.java
+++ b/rest/rest-resources/src/main/java/org/apache/brooklyn/rest/filter/CsrfTokenFilter.java
@@ -217,9 +217,9 @@ public class CsrfTokenFilter implements ContainerRequestFilter, ContainerRespons
public void filter(ContainerRequestContext requestContext, ContainerResponseContext responseContext) throws IOException {
log.debug("CSRF FILTER finishing - "+MultiSessionAttributeAdapter.info(request));
MultiSessionAttributeAdapter session = MultiSessionAttributeAdapter.of(request, false);
- String token = (String) (session==null ? null : session.getAttribute(CSRF_TOKEN_VALUE_ATTR));
+ String previousToken = (String) (session==null ? null : session.getAttribute(CSRF_TOKEN_VALUE_ATTR));
String requiredWhenS = request.getHeader(CSRF_TOKEN_REQUIRED_HEADER);
-
+
if (session==null) {
if (Strings.isBlank(requiredWhenS)) {
// no session and no requirement specified, bail out
@@ -232,19 +232,26 @@ public class CsrfTokenFilter implements ContainerRequestFilter, ContainerRespons
}
session = MultiSessionAttributeAdapter.of(request, true);
}
-
+
+ // create the token
+ String newToken = Identifiers.makeRandomId(16);
+ session.setAttribute(CSRF_TOKEN_VALUE_ATTR, newToken);
+
+ addCookie(responseContext, CSRF_TOKEN_VALUE_COOKIE, newToken, "Clients should send this value in header "+CSRF_TOKEN_VALUE_HEADER+" for validation");
+ addCookie(responseContext, CSRF_TOKEN_VALUE_COOKIE_ANGULAR_NAME, newToken, "Compatibility cookie for "+CSRF_TOKEN_VALUE_COOKIE+" following AngularJS conventions");
+
CsrfTokenRequiredForRequests requiredWhen;
if (Strings.isNonBlank(requiredWhenS)) {
requiredWhen = getRequiredForRequests(requiredWhenS, DEFAULT_REQUIRED_FOR_REQUESTS);
session.setAttribute(CSRF_TOKEN_REQUIRED_ATTR, requiredWhen);
- if (Strings.isNonBlank(token)) {
+ if (Strings.isNonBlank(previousToken)) {
// already set csrf token, and the client got it
// (with the session token if they are in a session;
// or if client didn't get it it isn't in a session)
return;
}
} else {
- if (Strings.isNonBlank(token)) {
+ if (Strings.isNonBlank(previousToken)) {
// already set csrf token, and the client got it
// (with the session token if they are in a session;
// or if client didn't get it it isn't in a session)
@@ -262,12 +269,6 @@ public class CsrfTokenFilter implements ContainerRequestFilter, ContainerRespons
return;
}
- // create the token
- token = Identifiers.makeRandomId(16);
- session.setAttribute(CSRF_TOKEN_VALUE_ATTR, token);
-
- addCookie(responseContext, CSRF_TOKEN_VALUE_COOKIE, token, "Clients should send this value in header "+CSRF_TOKEN_VALUE_HEADER+" for validation");
- addCookie(responseContext, CSRF_TOKEN_VALUE_COOKIE_ANGULAR_NAME, token, "Compatibility cookie for "+CSRF_TOKEN_VALUE_COOKIE+" following AngularJS conventions");
}
protected NewCookie addCookie(ContainerResponseContext responseContext, String cookieName, String token, String comment) {
diff --git a/rest/rest-resources/src/main/java/org/apache/brooklyn/rest/util/MultiSessionAttributeAdapter.java b/rest/rest-resources/src/main/java/org/apache/brooklyn/rest/util/MultiSessionAttributeAdapter.java
index 3e178f2..6099b0e 100644
--- a/rest/rest-resources/src/main/java/org/apache/brooklyn/rest/util/MultiSessionAttributeAdapter.java
+++ b/rest/rest-resources/src/main/java/org/apache/brooklyn/rest/util/MultiSessionAttributeAdapter.java
@@ -140,6 +140,9 @@ public class MultiSessionAttributeAdapter {
if (preferredHandler!=null) {
if (optionalRequest!=null) {
HttpSession result = preferredHandler.newHttpSession(optionalRequest);
+ // bigger than HouseKeeper.sessionScavengeInterval: 3600
+ // https://www.eclipse.org/jetty/documentation/9.4.x/session-configuration-housekeeper.html
+ result.setMaxInactiveInterval(3601);
if (log.isTraceEnabled()) {
log.trace("Creating new session "+info(result)+" to be preferred for " + info(optionalRequest, localSession));
}
@@ -148,6 +151,7 @@ public class MultiSessionAttributeAdapter {
// the server has a preferred handler, but no session yet; fall back to marking on the session
log.warn("No request so cannot create preferred session at preferred handler "+info(preferredHandler)+" for "+info(optionalRequest, localSession)+"; will exceptionally mark the calling session as the preferred one");
markSessionAsPreferred(localSession, " (request came in for "+info(optionalRequest, localSession)+")");
+ localSession.setMaxInactiveInterval(3601);
return localSession;
} else {
// shouldn't come here; at minimum it should have returned the local session's handler
[brooklyn-server] 01/06: change scavenge interval to 1 hour
Posted by he...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
heneveld pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/brooklyn-server.git
commit d84efa678afc789cbf0aac3f84eb7ca43813656f
Author: Juan Cabrerizo <ju...@cloudsoft.io>
AuthorDate: Thu Feb 7 15:08:59 2019 +0000
change scavenge interval to 1 hour
---
karaf/jetty-config/src/main/resources/jetty.xml | 15 +++++++++++++++
1 file changed, 15 insertions(+)
diff --git a/karaf/jetty-config/src/main/resources/jetty.xml b/karaf/jetty-config/src/main/resources/jetty.xml
index 90dc129..42677ac 100644
--- a/karaf/jetty-config/src/main/resources/jetty.xml
+++ b/karaf/jetty-config/src/main/resources/jetty.xml
@@ -20,4 +20,19 @@
<!DOCTYPE Configure PUBLIC "-//Jetty//Configure//EN" "http://www.eclipse.org/jetty/configure_9_0.dtd">
<Configure id="Server" class="org.eclipse.jetty.server.Server">
+
+ <!--Config Jetty HouseKeeper scavenge interval for invalidate session to one hour to avoid losing authentication-->
+ <!--token -->
+ <Set name="sessionIdManager">
+ <New id="idMgr" class="org.eclipse.jetty.server.session.DefaultSessionIdManager">
+ <Arg><Ref refid="Server"/></Arg>
+ <Set name="sessionHouseKeeper">
+ <New class="org.eclipse.jetty.server.session.HouseKeeper">
+ <Set name="intervalSec"><Property name="jetty.sessionScavengeInterval.seconds" default="3600"/></Set>
+ </New>
+ </Set>
+ </New>
+ </Set>
+
</Configure>
+
[brooklyn-server] 03/06: CSRF creates token if isn't present
Posted by he...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
heneveld pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/brooklyn-server.git
commit 29e4acbb38f53e8ab6b0a6a259c1990a017ecba8
Author: Juan Cabrerizo <ju...@cloudsoft.io>
AuthorDate: Fri Feb 8 14:47:07 2019 +0000
CSRF creates token if isn't present
---
.../apache/brooklyn/rest/filter/CsrfTokenFilter.java | 19 +++++++++++--------
1 file changed, 11 insertions(+), 8 deletions(-)
diff --git a/rest/rest-resources/src/main/java/org/apache/brooklyn/rest/filter/CsrfTokenFilter.java b/rest/rest-resources/src/main/java/org/apache/brooklyn/rest/filter/CsrfTokenFilter.java
index 3c7ff3c..8a4de71 100644
--- a/rest/rest-resources/src/main/java/org/apache/brooklyn/rest/filter/CsrfTokenFilter.java
+++ b/rest/rest-resources/src/main/java/org/apache/brooklyn/rest/filter/CsrfTokenFilter.java
@@ -217,7 +217,7 @@ public class CsrfTokenFilter implements ContainerRequestFilter, ContainerRespons
public void filter(ContainerRequestContext requestContext, ContainerResponseContext responseContext) throws IOException {
log.debug("CSRF FILTER finishing - "+MultiSessionAttributeAdapter.info(request));
MultiSessionAttributeAdapter session = MultiSessionAttributeAdapter.of(request, false);
- String previousToken = (String) (session==null ? null : session.getAttribute(CSRF_TOKEN_VALUE_ATTR));
+ String token = (String) (session==null ? null : session.getAttribute(CSRF_TOKEN_VALUE_ATTR));
String requiredWhenS = request.getHeader(CSRF_TOKEN_REQUIRED_HEADER);
if (session==null) {
@@ -233,25 +233,28 @@ public class CsrfTokenFilter implements ContainerRequestFilter, ContainerRespons
session = MultiSessionAttributeAdapter.of(request, true);
}
- // create the token
- String newToken = Identifiers.makeRandomId(16);
- session.setAttribute(CSRF_TOKEN_VALUE_ATTR, newToken);
+ if (token==null) {
+ // create the token
+ token = Identifiers.makeRandomId(16);
+ log.trace("Created new token {} for {}", token, session);
+ }
+ session.setAttribute(CSRF_TOKEN_VALUE_ATTR, token);
- addCookie(responseContext, CSRF_TOKEN_VALUE_COOKIE, newToken, "Clients should send this value in header "+CSRF_TOKEN_VALUE_HEADER+" for validation");
- addCookie(responseContext, CSRF_TOKEN_VALUE_COOKIE_ANGULAR_NAME, newToken, "Compatibility cookie for "+CSRF_TOKEN_VALUE_COOKIE+" following AngularJS conventions");
+ addCookie(responseContext, CSRF_TOKEN_VALUE_COOKIE, token, "Clients should send this value in header "+CSRF_TOKEN_VALUE_HEADER+" for validation");
+ addCookie(responseContext, CSRF_TOKEN_VALUE_COOKIE_ANGULAR_NAME, token, "Compatibility cookie for "+CSRF_TOKEN_VALUE_COOKIE+" following AngularJS conventions");
CsrfTokenRequiredForRequests requiredWhen;
if (Strings.isNonBlank(requiredWhenS)) {
requiredWhen = getRequiredForRequests(requiredWhenS, DEFAULT_REQUIRED_FOR_REQUESTS);
session.setAttribute(CSRF_TOKEN_REQUIRED_ATTR, requiredWhen);
- if (Strings.isNonBlank(previousToken)) {
+ if (Strings.isNonBlank(token)) {
// already set csrf token, and the client got it
// (with the session token if they are in a session;
// or if client didn't get it it isn't in a session)
return;
}
} else {
- if (Strings.isNonBlank(previousToken)) {
+ if (Strings.isNonBlank(token)) {
// already set csrf token, and the client got it
// (with the session token if they are in a session;
// or if client didn't get it it isn't in a session)
[brooklyn-server] 05/06: This closes #1036
Posted by he...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
heneveld pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/brooklyn-server.git
commit 9a183dafedea77fa61b439cd297b6b5a15ba7a9f
Merge: da7db69 fd0670c
Author: Alex Heneveld <al...@cloudsoftcorp.com>
AuthorDate: Mon Feb 11 11:07:32 2019 +0000
This closes #1036
karaf/jetty-config/src/main/resources/jetty.xml | 15 +++++++++++++++
.../apache/brooklyn/rest/filter/CsrfTokenFilter.java | 20 ++++++++++++--------
.../rest/util/MultiSessionAttributeAdapter.java | 9 ++++++++-
3 files changed, 35 insertions(+), 9 deletions(-)
[brooklyn-server] 06/06: dampen CSRF logging
Posted by he...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
heneveld pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/brooklyn-server.git
commit 6ec9a74f07188281fd5ceeec0d6c67a514016b28
Author: Alex Heneveld <al...@cloudsoftcorp.com>
AuthorDate: Mon Feb 11 11:08:25 2019 +0000
dampen CSRF logging
---
.../src/main/java/org/apache/brooklyn/rest/filter/CsrfTokenFilter.java | 1 -
1 file changed, 1 deletion(-)
diff --git a/rest/rest-resources/src/main/java/org/apache/brooklyn/rest/filter/CsrfTokenFilter.java b/rest/rest-resources/src/main/java/org/apache/brooklyn/rest/filter/CsrfTokenFilter.java
index 8a4de71..93344f9 100644
--- a/rest/rest-resources/src/main/java/org/apache/brooklyn/rest/filter/CsrfTokenFilter.java
+++ b/rest/rest-resources/src/main/java/org/apache/brooklyn/rest/filter/CsrfTokenFilter.java
@@ -215,7 +215,6 @@ public class CsrfTokenFilter implements ContainerRequestFilter, ContainerRespons
@Override
public void filter(ContainerRequestContext requestContext, ContainerResponseContext responseContext) throws IOException {
- log.debug("CSRF FILTER finishing - "+MultiSessionAttributeAdapter.info(request));
MultiSessionAttributeAdapter session = MultiSessionAttributeAdapter.of(request, false);
String token = (String) (session==null ? null : session.getAttribute(CSRF_TOKEN_VALUE_ATTR));
String requiredWhenS = request.getHeader(CSRF_TOKEN_REQUIRED_HEADER);
[brooklyn-server] 04/06: preferredSession max interval updated
Posted by he...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
heneveld pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/brooklyn-server.git
commit fd0670c56df5077f24ddb743f6a27c237e82d81e
Author: Juan Cabrerizo <ju...@cloudsoft.io>
AuthorDate: Mon Feb 11 10:45:14 2019 +0000
preferredSession max interval updated
---
.../apache/brooklyn/rest/util/MultiSessionAttributeAdapter.java | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
diff --git a/rest/rest-resources/src/main/java/org/apache/brooklyn/rest/util/MultiSessionAttributeAdapter.java b/rest/rest-resources/src/main/java/org/apache/brooklyn/rest/util/MultiSessionAttributeAdapter.java
index 6099b0e..9d5556c 100644
--- a/rest/rest-resources/src/main/java/org/apache/brooklyn/rest/util/MultiSessionAttributeAdapter.java
+++ b/rest/rest-resources/src/main/java/org/apache/brooklyn/rest/util/MultiSessionAttributeAdapter.java
@@ -80,6 +80,8 @@ public class MultiSessionAttributeAdapter {
private static final String KEY_PREFERRED_SESSION_HANDLER_INSTANCE = "org.apache.brooklyn.server.PreferredSessionHandlerInstance";
private static final String KEY_IS_PREFERRED = "org.apache.brooklyn.server.IsPreferred";
+ private static final int MAX_INACTIVE_INTERVAL = 3601;
+
private static final Object PREFERRED_SYMBOLIC_NAME =
"org.apache.cxf.cxf-rt-transports-http";
//// our bundle here doesn't have a session handler; sessions to the REST API get the handler from CXF
@@ -135,6 +137,7 @@ public class MultiSessionAttributeAdapter {
(preferredSession!=null ? info(preferredSession) : "none, willl make new session in "+info(preferredHandler)));
}
if (preferredSession!=null) {
+ preferredSession.setMaxInactiveInterval(MAX_INACTIVE_INTERVAL);
return preferredSession;
}
if (preferredHandler!=null) {
@@ -142,7 +145,7 @@ public class MultiSessionAttributeAdapter {
HttpSession result = preferredHandler.newHttpSession(optionalRequest);
// bigger than HouseKeeper.sessionScavengeInterval: 3600
// https://www.eclipse.org/jetty/documentation/9.4.x/session-configuration-housekeeper.html
- result.setMaxInactiveInterval(3601);
+ result.setMaxInactiveInterval(MAX_INACTIVE_INTERVAL);
if (log.isTraceEnabled()) {
log.trace("Creating new session "+info(result)+" to be preferred for " + info(optionalRequest, localSession));
}
@@ -151,7 +154,7 @@ public class MultiSessionAttributeAdapter {
// the server has a preferred handler, but no session yet; fall back to marking on the session
log.warn("No request so cannot create preferred session at preferred handler "+info(preferredHandler)+" for "+info(optionalRequest, localSession)+"; will exceptionally mark the calling session as the preferred one");
markSessionAsPreferred(localSession, " (request came in for "+info(optionalRequest, localSession)+")");
- localSession.setMaxInactiveInterval(3601);
+ localSession.setMaxInactiveInterval(MAX_INACTIVE_INTERVAL);
return localSession;
} else {
// shouldn't come here; at minimum it should have returned the local session's handler
@@ -240,7 +243,7 @@ public class MultiSessionAttributeAdapter {
if (preferredHandler==null) {
preferredHandler = sh;
server.setAttribute(KEY_PREFERRED_SESSION_HANDLER_INSTANCE, sh);
- log.debug("Recording "+info(sh)+" as server-wide preferred session handler");
+ log.trace("Recording "+info(sh)+" as server-wide preferred session handler");
} else {
log.warn("Multiple preferred session handlers detected; keeping "+info(preferredHandler)+", ignoring "+info(sh));
}