You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@shindig.apache.org by "Brian Lillie (JIRA)" <ji...@apache.org> on 2012/04/23 20:22:36 UTC
[jira] [Created] (SHINDIG-1756) Identify origiation of requests
Brian Lillie created SHINDIG-1756:
-------------------------------------
Summary: Identify origiation of requests
Key: SHINDIG-1756
URL: https://issues.apache.org/jira/browse/SHINDIG-1756
Project: Shindig
Issue Type: Improvement
Components: Java
Affects Versions: 2.5.0
Reporter: Brian Lillie
Fix For: 2.5.0
In order to determine based upon the request whether to honor the request, or whether the request should be restricted, the request needs to identify itself in some way. Some of the requests in the system originate as a result of direct user requests (e.g. makeRequest) while other requests are performed by the server for the server or in order to handle the request (e.g. gadget spec lookups).
The proposal is to better mark the origination of the request either by attaching an Anonymous Security Token containing the gadget URI, or by marking the request as an internal request (one that the server is initiating) so that downstream components (e.g. the HttpFetcher implementation) can make determinations on how to process the request.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (SHINDIG-1756) Identify origiation of requests
Posted by "jiraposter@reviews.apache.org (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/SHINDIG-1756?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13259867#comment-13259867 ]
jiraposter@reviews.apache.org commented on SHINDIG-1756:
--------------------------------------------------------
bq. On 2012-04-23 18:48:33, Henry Saputra wrote:
bq. > How would the isInternalRequest() method is being used with the new flow? I only saw that its used in the test file?
bq.
bq. BrianLillie wrote:
bq. We are using the security token and the additional isInternalRequest in our fetcher implementation to make further determinations on the suitability of requests. Other than tagging the request, there is no current usage of the internalRequest within the flows.
What is the difference between setting AnonymousSecurityToken and call setInternalRequest() to the HttpRequest? Looks like both indicating the request could come from internal Shindig code.
- Henry
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/4750/#review7150
-----------------------------------------------------------
On 2012-04-23 18:22:22, BrianLillie wrote:
bq.
bq. -----------------------------------------------------------
bq. This is an automatically generated e-mail. To reply, visit:
bq. https://reviews.apache.org/r/4750/
bq. -----------------------------------------------------------
bq.
bq. (Updated 2012-04-23 18:22:22)
bq.
bq.
bq. Review request for shindig.
bq.
bq.
bq. Summary
bq. -------
bq.
bq. Update HttpRequest objects to identify a request source. For some requests, SecurityTokens are provided. Others have gadget URI, but this is not always trustworthy as it is set based upon URL parameters.
bq. For requests where a security token was not sent from the client, create and set an AnonymousSecurityToken identifying the gadget URI associated with the request. Also, add a flag to the HttpRequest to indicate a request generated by the server, where this may be set when requesting services, retrieving a template library, or during selected rewrites.
bq.
bq.
bq. This addresses bug SHINDIG-1756.
bq. https://issues.apache.org/jira/browse/SHINDIG-1756
bq.
bq.
bq. Diffs
bq. -----
bq.
bq. http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/main/java/org/apache/shindig/gadgets/AbstractSpecFactory.java 1326861
bq. http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/main/java/org/apache/shindig/gadgets/features/FeatureResourceLoader.java 1304584
bq. http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/main/java/org/apache/shindig/gadgets/http/HttpRequest.java 1304584
bq. http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/main/java/org/apache/shindig/gadgets/oauth/OAuthRequest.java 1304584
bq. http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/main/java/org/apache/shindig/gadgets/oauth2/handler/ClientCredentialsGrantTypeHandler.java 1326858
bq. http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/main/java/org/apache/shindig/gadgets/oauth2/handler/CodeAuthorizationResponseHandler.java 1326858
bq. http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/main/java/org/apache/shindig/gadgets/render/CajaResponseRewriter.java 1304584
bq. http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/main/java/org/apache/shindig/gadgets/render/DefaultServiceFetcher.java 1304584
bq. http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/main/java/org/apache/shindig/gadgets/servlet/CajaContentRewriter.java 1311453
bq. http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/main/java/org/apache/shindig/gadgets/servlet/HttpRequestHandler.java 1304584
bq. http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/main/java/org/apache/shindig/gadgets/templates/TemplateLibraryFactory.java 1304584
bq. http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/test/java/org/apache/shindig/gadgets/http/HttpRequestTest.java 1304584
bq.
bq. Diff: https://reviews.apache.org/r/4750/diff
bq.
bq.
bq. Testing
bq. -------
bq.
bq. Existing tests passed. No tests that I saw specifically examined the request content & state. Should there be consensus on the patch, then I will look at providing additional tests to do some request state verification.
bq.
bq.
bq. Thanks,
bq.
bq. BrianLillie
bq.
bq.
> Identify origiation of requests
> -------------------------------
>
> Key: SHINDIG-1756
> URL: https://issues.apache.org/jira/browse/SHINDIG-1756
> Project: Shindig
> Issue Type: Improvement
> Components: Java
> Affects Versions: 2.5.0
> Reporter: Brian Lillie
> Fix For: 2.5.0
>
>
> In order to determine based upon the request whether to honor the request, or whether the request should be restricted, the request needs to identify itself in some way. Some of the requests in the system originate as a result of direct user requests (e.g. makeRequest) while other requests are performed by the server for the server or in order to handle the request (e.g. gadget spec lookups).
> The proposal is to better mark the origination of the request either by attaching an Anonymous Security Token containing the gadget URI, or by marking the request as an internal request (one that the server is initiating) so that downstream components (e.g. the HttpFetcher implementation) can make determinations on how to process the request.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (SHINDIG-1756) Identify origiation of requests
Posted by "jiraposter@reviews.apache.org (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/SHINDIG-1756?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13259835#comment-13259835 ]
jiraposter@reviews.apache.org commented on SHINDIG-1756:
--------------------------------------------------------
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/4750/#review7150
-----------------------------------------------------------
How would the isInternalRequest() method is being used with the new flow? I only saw that its used in the test file?
- Henry
On 2012-04-23 18:22:22, BrianLillie wrote:
bq.
bq. -----------------------------------------------------------
bq. This is an automatically generated e-mail. To reply, visit:
bq. https://reviews.apache.org/r/4750/
bq. -----------------------------------------------------------
bq.
bq. (Updated 2012-04-23 18:22:22)
bq.
bq.
bq. Review request for shindig.
bq.
bq.
bq. Summary
bq. -------
bq.
bq. Update HttpRequest objects to identify a request source. For some requests, SecurityTokens are provided. Others have gadget URI, but this is not always trustworthy as it is set based upon URL parameters.
bq. For requests where a security token was not sent from the client, create and set an AnonymousSecurityToken identifying the gadget URI associated with the request. Also, add a flag to the HttpRequest to indicate a request generated by the server, where this may be set when requesting services, retrieving a template library, or during selected rewrites.
bq.
bq.
bq. This addresses bug SHINDIG-1756.
bq. https://issues.apache.org/jira/browse/SHINDIG-1756
bq.
bq.
bq. Diffs
bq. -----
bq.
bq. http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/main/java/org/apache/shindig/gadgets/AbstractSpecFactory.java 1326861
bq. http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/main/java/org/apache/shindig/gadgets/features/FeatureResourceLoader.java 1304584
bq. http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/main/java/org/apache/shindig/gadgets/http/HttpRequest.java 1304584
bq. http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/main/java/org/apache/shindig/gadgets/oauth/OAuthRequest.java 1304584
bq. http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/main/java/org/apache/shindig/gadgets/oauth2/handler/ClientCredentialsGrantTypeHandler.java 1326858
bq. http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/main/java/org/apache/shindig/gadgets/oauth2/handler/CodeAuthorizationResponseHandler.java 1326858
bq. http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/main/java/org/apache/shindig/gadgets/render/CajaResponseRewriter.java 1304584
bq. http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/main/java/org/apache/shindig/gadgets/render/DefaultServiceFetcher.java 1304584
bq. http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/main/java/org/apache/shindig/gadgets/servlet/CajaContentRewriter.java 1311453
bq. http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/main/java/org/apache/shindig/gadgets/servlet/HttpRequestHandler.java 1304584
bq. http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/main/java/org/apache/shindig/gadgets/templates/TemplateLibraryFactory.java 1304584
bq. http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/test/java/org/apache/shindig/gadgets/http/HttpRequestTest.java 1304584
bq.
bq. Diff: https://reviews.apache.org/r/4750/diff
bq.
bq.
bq. Testing
bq. -------
bq.
bq. Existing tests passed. No tests that I saw specifically examined the request content & state. Should there be consensus on the patch, then I will look at providing additional tests to do some request state verification.
bq.
bq.
bq. Thanks,
bq.
bq. BrianLillie
bq.
bq.
> Identify origiation of requests
> -------------------------------
>
> Key: SHINDIG-1756
> URL: https://issues.apache.org/jira/browse/SHINDIG-1756
> Project: Shindig
> Issue Type: Improvement
> Components: Java
> Affects Versions: 2.5.0
> Reporter: Brian Lillie
> Fix For: 2.5.0
>
>
> In order to determine based upon the request whether to honor the request, or whether the request should be restricted, the request needs to identify itself in some way. Some of the requests in the system originate as a result of direct user requests (e.g. makeRequest) while other requests are performed by the server for the server or in order to handle the request (e.g. gadget spec lookups).
> The proposal is to better mark the origination of the request either by attaching an Anonymous Security Token containing the gadget URI, or by marking the request as an internal request (one that the server is initiating) so that downstream components (e.g. the HttpFetcher implementation) can make determinations on how to process the request.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (SHINDIG-1756) Identify origiation of requests
Posted by "jiraposter@reviews.apache.org (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/SHINDIG-1756?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13259806#comment-13259806 ]
jiraposter@reviews.apache.org commented on SHINDIG-1756:
--------------------------------------------------------
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/4750/
-----------------------------------------------------------
(Updated 2012-04-23 18:22:22.029714)
Review request for shindig.
Summary
-------
Update HttpRequest objects to identify a request source. For some requests, SecurityTokens are provided. Others have gadget URI, but this is not always trustworthy as it is set based upon URL parameters.
For requests where a security token was not sent from the client, create and set an AnonymousSecurityToken identifying the gadget URI associated with the request. Also, add a flag to the HttpRequest to indicate a request generated by the server, where this may be set when requesting services, retrieving a template library, or during selected rewrites.
This addresses bug SHINDIG-1756.
https://issues.apache.org/jira/browse/SHINDIG-1756
Diffs
-----
http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/main/java/org/apache/shindig/gadgets/AbstractSpecFactory.java 1326861
http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/main/java/org/apache/shindig/gadgets/features/FeatureResourceLoader.java 1304584
http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/main/java/org/apache/shindig/gadgets/http/HttpRequest.java 1304584
http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/main/java/org/apache/shindig/gadgets/oauth/OAuthRequest.java 1304584
http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/main/java/org/apache/shindig/gadgets/oauth2/handler/ClientCredentialsGrantTypeHandler.java 1326858
http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/main/java/org/apache/shindig/gadgets/oauth2/handler/CodeAuthorizationResponseHandler.java 1326858
http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/main/java/org/apache/shindig/gadgets/render/CajaResponseRewriter.java 1304584
http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/main/java/org/apache/shindig/gadgets/render/DefaultServiceFetcher.java 1304584
http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/main/java/org/apache/shindig/gadgets/servlet/CajaContentRewriter.java 1311453
http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/main/java/org/apache/shindig/gadgets/servlet/HttpRequestHandler.java 1304584
http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/main/java/org/apache/shindig/gadgets/templates/TemplateLibraryFactory.java 1304584
http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/test/java/org/apache/shindig/gadgets/http/HttpRequestTest.java 1304584
Diff: https://reviews.apache.org/r/4750/diff
Testing
-------
Existing tests passed. No tests that I saw specifically examined the request content & state. Should there be consensus on the patch, then I will look at providing additional tests to do some request state verification.
Thanks,
BrianLillie
> Identify origiation of requests
> -------------------------------
>
> Key: SHINDIG-1756
> URL: https://issues.apache.org/jira/browse/SHINDIG-1756
> Project: Shindig
> Issue Type: Improvement
> Components: Java
> Affects Versions: 2.5.0
> Reporter: Brian Lillie
> Fix For: 2.5.0
>
>
> In order to determine based upon the request whether to honor the request, or whether the request should be restricted, the request needs to identify itself in some way. Some of the requests in the system originate as a result of direct user requests (e.g. makeRequest) while other requests are performed by the server for the server or in order to handle the request (e.g. gadget spec lookups).
> The proposal is to better mark the origination of the request either by attaching an Anonymous Security Token containing the gadget URI, or by marking the request as an internal request (one that the server is initiating) so that downstream components (e.g. the HttpFetcher implementation) can make determinations on how to process the request.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (SHINDIG-1756) Identify origiation of requests
Posted by "jiraposter@reviews.apache.org (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/SHINDIG-1756?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13259902#comment-13259902 ]
jiraposter@reviews.apache.org commented on SHINDIG-1756:
--------------------------------------------------------
bq. On 2012-04-23 18:48:33, Henry Saputra wrote:
bq. > How would the isInternalRequest() method is being used with the new flow? I only saw that its used in the test file?
bq.
bq. BrianLillie wrote:
bq. We are using the security token and the additional isInternalRequest in our fetcher implementation to make further determinations on the suitability of requests. Other than tagging the request, there is no current usage of the internalRequest within the flows.
bq.
bq. Henry Saputra wrote:
bq. What is the difference between setting AnonymousSecurityToken and call setInternalRequest() to the HttpRequest? Looks like both indicating the request could come from internal Shindig code.
The difference between the two was that setInternalRequest() was used when it wasn't really associated with a gadget initiated request. For example, the rpc to listMethods, and feature loads, which would be done by the server independent of the gadgets that are being deployed. The AnonymousSecurityToken was used to identify that the request is really on behalf of the gadget, for example, a spec request, or a template request. The gray area included the rewriters - where the new HttpRequests appeared to be going back through the server to the content proxy to be resolved. These were marked with setInternalRequest for that reason.
- BrianLillie
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/4750/#review7150
-----------------------------------------------------------
On 2012-04-23 18:22:22, BrianLillie wrote:
bq.
bq. -----------------------------------------------------------
bq. This is an automatically generated e-mail. To reply, visit:
bq. https://reviews.apache.org/r/4750/
bq. -----------------------------------------------------------
bq.
bq. (Updated 2012-04-23 18:22:22)
bq.
bq.
bq. Review request for shindig.
bq.
bq.
bq. Summary
bq. -------
bq.
bq. Update HttpRequest objects to identify a request source. For some requests, SecurityTokens are provided. Others have gadget URI, but this is not always trustworthy as it is set based upon URL parameters.
bq. For requests where a security token was not sent from the client, create and set an AnonymousSecurityToken identifying the gadget URI associated with the request. Also, add a flag to the HttpRequest to indicate a request generated by the server, where this may be set when requesting services, retrieving a template library, or during selected rewrites.
bq.
bq.
bq. This addresses bug SHINDIG-1756.
bq. https://issues.apache.org/jira/browse/SHINDIG-1756
bq.
bq.
bq. Diffs
bq. -----
bq.
bq. http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/main/java/org/apache/shindig/gadgets/AbstractSpecFactory.java 1326861
bq. http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/main/java/org/apache/shindig/gadgets/features/FeatureResourceLoader.java 1304584
bq. http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/main/java/org/apache/shindig/gadgets/http/HttpRequest.java 1304584
bq. http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/main/java/org/apache/shindig/gadgets/oauth/OAuthRequest.java 1304584
bq. http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/main/java/org/apache/shindig/gadgets/oauth2/handler/ClientCredentialsGrantTypeHandler.java 1326858
bq. http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/main/java/org/apache/shindig/gadgets/oauth2/handler/CodeAuthorizationResponseHandler.java 1326858
bq. http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/main/java/org/apache/shindig/gadgets/render/CajaResponseRewriter.java 1304584
bq. http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/main/java/org/apache/shindig/gadgets/render/DefaultServiceFetcher.java 1304584
bq. http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/main/java/org/apache/shindig/gadgets/servlet/CajaContentRewriter.java 1311453
bq. http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/main/java/org/apache/shindig/gadgets/servlet/HttpRequestHandler.java 1304584
bq. http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/main/java/org/apache/shindig/gadgets/templates/TemplateLibraryFactory.java 1304584
bq. http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/test/java/org/apache/shindig/gadgets/http/HttpRequestTest.java 1304584
bq.
bq. Diff: https://reviews.apache.org/r/4750/diff
bq.
bq.
bq. Testing
bq. -------
bq.
bq. Existing tests passed. No tests that I saw specifically examined the request content & state. Should there be consensus on the patch, then I will look at providing additional tests to do some request state verification.
bq.
bq.
bq. Thanks,
bq.
bq. BrianLillie
bq.
bq.
> Identify origiation of requests
> -------------------------------
>
> Key: SHINDIG-1756
> URL: https://issues.apache.org/jira/browse/SHINDIG-1756
> Project: Shindig
> Issue Type: Improvement
> Components: Java
> Affects Versions: 2.5.0
> Reporter: Brian Lillie
> Fix For: 2.5.0
>
>
> In order to determine based upon the request whether to honor the request, or whether the request should be restricted, the request needs to identify itself in some way. Some of the requests in the system originate as a result of direct user requests (e.g. makeRequest) while other requests are performed by the server for the server or in order to handle the request (e.g. gadget spec lookups).
> The proposal is to better mark the origination of the request either by attaching an Anonymous Security Token containing the gadget URI, or by marking the request as an internal request (one that the server is initiating) so that downstream components (e.g. the HttpFetcher implementation) can make determinations on how to process the request.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Updated] (SHINDIG-1756) Identify origination of requests
Posted by "Brian Lillie (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/SHINDIG-1756?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Brian Lillie updated SHINDIG-1756:
----------------------------------
Attachment: origination5.patch
Patch file
> Identify origination of requests
> --------------------------------
>
> Key: SHINDIG-1756
> URL: https://issues.apache.org/jira/browse/SHINDIG-1756
> Project: Shindig
> Issue Type: Improvement
> Components: Java
> Affects Versions: 2.5.0
> Reporter: Brian Lillie
> Fix For: 2.5.0
>
> Attachments: origination5.patch
>
>
> In order to determine based upon the request whether to honor the request, or whether the request should be restricted, the request needs to identify itself in some way. Some of the requests in the system originate as a result of direct user requests (e.g. makeRequest) while other requests are performed by the server for the server or in order to handle the request (e.g. gadget spec lookups).
> The proposal is to better mark the origination of the request either by attaching an Anonymous Security Token containing the gadget URI, or by marking the request as an internal request (one that the server is initiating) so that downstream components (e.g. the HttpFetcher implementation) can make determinations on how to process the request.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (SHINDIG-1756) Identify origination of requests
Posted by "Stanton Sievers (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/SHINDIG-1756?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13263738#comment-13263738 ]
Stanton Sievers commented on SHINDIG-1756:
------------------------------------------
Missed TemplateLibraryFactoryTest.java during the initial commit. Committed revision 1331466.
> Identify origination of requests
> --------------------------------
>
> Key: SHINDIG-1756
> URL: https://issues.apache.org/jira/browse/SHINDIG-1756
> Project: Shindig
> Issue Type: Improvement
> Components: Java
> Affects Versions: 2.5.0
> Reporter: Brian Lillie
> Fix For: 2.5.0
>
> Attachments: origination5.patch
>
>
> In order to determine based upon the request whether to honor the request, or whether the request should be restricted, the request needs to identify itself in some way. Some of the requests in the system originate as a result of direct user requests (e.g. makeRequest) while other requests are performed by the server for the server or in order to handle the request (e.g. gadget spec lookups).
> The proposal is to better mark the origination of the request either by attaching an Anonymous Security Token containing the gadget URI, or by marking the request as an internal request (one that the server is initiating) so that downstream components (e.g. the HttpFetcher implementation) can make determinations on how to process the request.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (SHINDIG-1756) Identify origiation of requests
Posted by "jiraposter@reviews.apache.org (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/SHINDIG-1756?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13262058#comment-13262058 ]
jiraposter@reviews.apache.org commented on SHINDIG-1756:
--------------------------------------------------------
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/4750/
-----------------------------------------------------------
(Updated 2012-04-25 20:41:33.077958)
Review request for shindig.
Changes
-------
1) Added comments to HttpRequest.setInternalRequest
2) Changed OAuthRequest setting for AnonymousSecurityToken - was incorrectly using app id instead of app url
3) Added tests
Summary
-------
Update HttpRequest objects to identify a request source. For some requests, SecurityTokens are provided. Others have gadget URI, but this is not always trustworthy as it is set based upon URL parameters.
For requests where a security token was not sent from the client, create and set an AnonymousSecurityToken identifying the gadget URI associated with the request. Also, add a flag to the HttpRequest to indicate a request generated by the server, where this may be set when requesting services, retrieving a template library, or during selected rewrites.
This addresses bug SHINDIG-1756.
https://issues.apache.org/jira/browse/SHINDIG-1756
Diffs (updated)
-----
http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/main/java/org/apache/shindig/gadgets/AbstractSpecFactory.java 1326861
http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/main/java/org/apache/shindig/gadgets/features/FeatureResourceLoader.java 1304584
http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/main/java/org/apache/shindig/gadgets/http/HttpRequest.java 1304584
http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/main/java/org/apache/shindig/gadgets/oauth/OAuthRequest.java 1304584
http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/main/java/org/apache/shindig/gadgets/oauth2/handler/ClientCredentialsGrantTypeHandler.java 1326858
http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/main/java/org/apache/shindig/gadgets/oauth2/handler/CodeAuthorizationResponseHandler.java 1326858
http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/main/java/org/apache/shindig/gadgets/render/CajaResponseRewriter.java 1304584
http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/main/java/org/apache/shindig/gadgets/render/DefaultServiceFetcher.java 1304584
http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/main/java/org/apache/shindig/gadgets/servlet/CajaContentRewriter.java 1311453
http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/main/java/org/apache/shindig/gadgets/servlet/HttpRequestHandler.java 1304584
http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/main/java/org/apache/shindig/gadgets/templates/TemplateLibraryFactory.java 1304584
http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/test/java/org/apache/shindig/gadgets/DefaultGadgetSpecFactoryTest.java 1304584
http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/test/java/org/apache/shindig/gadgets/features/FeatureResourceLoaderTest.java 1304584
http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/test/java/org/apache/shindig/gadgets/http/HttpRequestTest.java 1304584
http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/test/java/org/apache/shindig/gadgets/oauth/OAuthRequestTest.java 1304584
http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/test/java/org/apache/shindig/gadgets/oauth/testing/FakeOAuthServiceProvider.java 1304584
http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/test/java/org/apache/shindig/gadgets/oauth2/MockUtils.java 1304584
http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/test/java/org/apache/shindig/gadgets/oauth2/handler/ClientCredentialsGrantTypeHandlerTest.java 1304584
http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/test/java/org/apache/shindig/gadgets/oauth2/handler/CodeAuthorizationResponseHandlerTest.java 1304584
http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/test/java/org/apache/shindig/gadgets/render/DefaultServiceFetcherTest.java 1304584
http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/test/java/org/apache/shindig/gadgets/servlet/CajaContentRewriterTest.java 1304584
http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/test/java/org/apache/shindig/gadgets/servlet/HttpRequestHandlerTest.java 1304584
http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/test/java/org/apache/shindig/gadgets/templates/TemplateLibraryFactoryTest.java PRE-CREATION
Diff: https://reviews.apache.org/r/4750/diff
Testing (updated)
-------
Existing tests passed. Added additional tests to verify internal request state or token on requests.
Thanks,
BrianLillie
> Identify origiation of requests
> -------------------------------
>
> Key: SHINDIG-1756
> URL: https://issues.apache.org/jira/browse/SHINDIG-1756
> Project: Shindig
> Issue Type: Improvement
> Components: Java
> Affects Versions: 2.5.0
> Reporter: Brian Lillie
> Fix For: 2.5.0
>
>
> In order to determine based upon the request whether to honor the request, or whether the request should be restricted, the request needs to identify itself in some way. Some of the requests in the system originate as a result of direct user requests (e.g. makeRequest) while other requests are performed by the server for the server or in order to handle the request (e.g. gadget spec lookups).
> The proposal is to better mark the origination of the request either by attaching an Anonymous Security Token containing the gadget URI, or by marking the request as an internal request (one that the server is initiating) so that downstream components (e.g. the HttpFetcher implementation) can make determinations on how to process the request.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Updated] (SHINDIG-1756) Identify origination of requests
Posted by "Brian Lillie (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/SHINDIG-1756?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Brian Lillie updated SHINDIG-1756:
----------------------------------
Summary: Identify origination of requests (was: Identify origiation of requests)
> Identify origination of requests
> --------------------------------
>
> Key: SHINDIG-1756
> URL: https://issues.apache.org/jira/browse/SHINDIG-1756
> Project: Shindig
> Issue Type: Improvement
> Components: Java
> Affects Versions: 2.5.0
> Reporter: Brian Lillie
> Fix For: 2.5.0
>
>
> In order to determine based upon the request whether to honor the request, or whether the request should be restricted, the request needs to identify itself in some way. Some of the requests in the system originate as a result of direct user requests (e.g. makeRequest) while other requests are performed by the server for the server or in order to handle the request (e.g. gadget spec lookups).
> The proposal is to better mark the origination of the request either by attaching an Anonymous Security Token containing the gadget URI, or by marking the request as an internal request (one that the server is initiating) so that downstream components (e.g. the HttpFetcher implementation) can make determinations on how to process the request.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (SHINDIG-1756) Identify origination of requests
Posted by "jiraposter@reviews.apache.org (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/SHINDIG-1756?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13262545#comment-13262545 ]
jiraposter@reviews.apache.org commented on SHINDIG-1756:
--------------------------------------------------------
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/4750/#review7258
-----------------------------------------------------------
Ship it!
> Identify origination of requests
> --------------------------------
>
> Key: SHINDIG-1756
> URL: https://issues.apache.org/jira/browse/SHINDIG-1756
> Project: Shindig
> Issue Type: Improvement
> Components: Java
> Affects Versions: 2.5.0
> Reporter: Brian Lillie
> Fix For: 2.5.0
>
>
> In order to determine based upon the request whether to honor the request, or whether the request should be restricted, the request needs to identify itself in some way. Some of the requests in the system originate as a result of direct user requests (e.g. makeRequest) while other requests are performed by the server for the server or in order to handle the request (e.g. gadget spec lookups).
> The proposal is to better mark the origination of the request either by attaching an Anonymous Security Token containing the gadget URI, or by marking the request as an internal request (one that the server is initiating) so that downstream components (e.g. the HttpFetcher implementation) can make determinations on how to process the request.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Updated] (SHINDIG-1756) Identify origination of requests
Posted by "Ryan Baxter (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/SHINDIG-1756?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Ryan Baxter updated SHINDIG-1756:
---------------------------------
Fix Version/s: (was: 2.5.0)
2.5.0-beta2
> Identify origination of requests
> --------------------------------
>
> Key: SHINDIG-1756
> URL: https://issues.apache.org/jira/browse/SHINDIG-1756
> Project: Shindig
> Issue Type: Improvement
> Components: Java
> Affects Versions: 2.5.0
> Reporter: Brian Lillie
> Fix For: 2.5.0-beta2
>
> Attachments: origination5.patch
>
>
> In order to determine based upon the request whether to honor the request, or whether the request should be restricted, the request needs to identify itself in some way. Some of the requests in the system originate as a result of direct user requests (e.g. makeRequest) while other requests are performed by the server for the server or in order to handle the request (e.g. gadget spec lookups).
> The proposal is to better mark the origination of the request either by attaching an Anonymous Security Token containing the gadget URI, or by marking the request as an internal request (one that the server is initiating) so that downstream components (e.g. the HttpFetcher implementation) can make determinations on how to process the request.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (SHINDIG-1756) Identify origiation of requests
Posted by "jiraposter@reviews.apache.org (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/SHINDIG-1756?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13260230#comment-13260230 ]
jiraposter@reviews.apache.org commented on SHINDIG-1756:
--------------------------------------------------------
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/4750/#review7167
-----------------------------------------------------------
Ship it!
Other than request for extra comments looks good for the issue. +1
http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/main/java/org/apache/shindig/gadgets/http/HttpRequest.java
<https://reviews.apache.org/r/4750/#comment15822>
Please add some comments on how these accessor methods should be used by the creator of HttpRequest objects to help explaining why an HttpRequest instance could be internal but does not have security token set
- Henry
On 2012-04-23 18:22:22, BrianLillie wrote:
bq.
bq. -----------------------------------------------------------
bq. This is an automatically generated e-mail. To reply, visit:
bq. https://reviews.apache.org/r/4750/
bq. -----------------------------------------------------------
bq.
bq. (Updated 2012-04-23 18:22:22)
bq.
bq.
bq. Review request for shindig.
bq.
bq.
bq. Summary
bq. -------
bq.
bq. Update HttpRequest objects to identify a request source. For some requests, SecurityTokens are provided. Others have gadget URI, but this is not always trustworthy as it is set based upon URL parameters.
bq. For requests where a security token was not sent from the client, create and set an AnonymousSecurityToken identifying the gadget URI associated with the request. Also, add a flag to the HttpRequest to indicate a request generated by the server, where this may be set when requesting services, retrieving a template library, or during selected rewrites.
bq.
bq.
bq. This addresses bug SHINDIG-1756.
bq. https://issues.apache.org/jira/browse/SHINDIG-1756
bq.
bq.
bq. Diffs
bq. -----
bq.
bq. http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/main/java/org/apache/shindig/gadgets/AbstractSpecFactory.java 1326861
bq. http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/main/java/org/apache/shindig/gadgets/features/FeatureResourceLoader.java 1304584
bq. http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/main/java/org/apache/shindig/gadgets/http/HttpRequest.java 1304584
bq. http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/main/java/org/apache/shindig/gadgets/oauth/OAuthRequest.java 1304584
bq. http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/main/java/org/apache/shindig/gadgets/oauth2/handler/ClientCredentialsGrantTypeHandler.java 1326858
bq. http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/main/java/org/apache/shindig/gadgets/oauth2/handler/CodeAuthorizationResponseHandler.java 1326858
bq. http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/main/java/org/apache/shindig/gadgets/render/CajaResponseRewriter.java 1304584
bq. http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/main/java/org/apache/shindig/gadgets/render/DefaultServiceFetcher.java 1304584
bq. http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/main/java/org/apache/shindig/gadgets/servlet/CajaContentRewriter.java 1311453
bq. http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/main/java/org/apache/shindig/gadgets/servlet/HttpRequestHandler.java 1304584
bq. http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/main/java/org/apache/shindig/gadgets/templates/TemplateLibraryFactory.java 1304584
bq. http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/test/java/org/apache/shindig/gadgets/http/HttpRequestTest.java 1304584
bq.
bq. Diff: https://reviews.apache.org/r/4750/diff
bq.
bq.
bq. Testing
bq. -------
bq.
bq. Existing tests passed. No tests that I saw specifically examined the request content & state. Should there be consensus on the patch, then I will look at providing additional tests to do some request state verification.
bq.
bq.
bq. Thanks,
bq.
bq. BrianLillie
bq.
bq.
> Identify origiation of requests
> -------------------------------
>
> Key: SHINDIG-1756
> URL: https://issues.apache.org/jira/browse/SHINDIG-1756
> Project: Shindig
> Issue Type: Improvement
> Components: Java
> Affects Versions: 2.5.0
> Reporter: Brian Lillie
> Fix For: 2.5.0
>
>
> In order to determine based upon the request whether to honor the request, or whether the request should be restricted, the request needs to identify itself in some way. Some of the requests in the system originate as a result of direct user requests (e.g. makeRequest) while other requests are performed by the server for the server or in order to handle the request (e.g. gadget spec lookups).
> The proposal is to better mark the origination of the request either by attaching an Anonymous Security Token containing the gadget URI, or by marking the request as an internal request (one that the server is initiating) so that downstream components (e.g. the HttpFetcher implementation) can make determinations on how to process the request.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (SHINDIG-1756) Identify origiation of requests
Posted by "jiraposter@reviews.apache.org (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/SHINDIG-1756?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13259857#comment-13259857 ]
jiraposter@reviews.apache.org commented on SHINDIG-1756:
--------------------------------------------------------
bq. On 2012-04-23 18:48:33, Henry Saputra wrote:
bq. > How would the isInternalRequest() method is being used with the new flow? I only saw that its used in the test file?
We are using the security token and the additional isInternalRequest in our fetcher implementation to make further determinations on the suitability of requests. Other than tagging the request, there is no current usage of the internalRequest within the flows.
- BrianLillie
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/4750/#review7150
-----------------------------------------------------------
On 2012-04-23 18:22:22, BrianLillie wrote:
bq.
bq. -----------------------------------------------------------
bq. This is an automatically generated e-mail. To reply, visit:
bq. https://reviews.apache.org/r/4750/
bq. -----------------------------------------------------------
bq.
bq. (Updated 2012-04-23 18:22:22)
bq.
bq.
bq. Review request for shindig.
bq.
bq.
bq. Summary
bq. -------
bq.
bq. Update HttpRequest objects to identify a request source. For some requests, SecurityTokens are provided. Others have gadget URI, but this is not always trustworthy as it is set based upon URL parameters.
bq. For requests where a security token was not sent from the client, create and set an AnonymousSecurityToken identifying the gadget URI associated with the request. Also, add a flag to the HttpRequest to indicate a request generated by the server, where this may be set when requesting services, retrieving a template library, or during selected rewrites.
bq.
bq.
bq. This addresses bug SHINDIG-1756.
bq. https://issues.apache.org/jira/browse/SHINDIG-1756
bq.
bq.
bq. Diffs
bq. -----
bq.
bq. http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/main/java/org/apache/shindig/gadgets/AbstractSpecFactory.java 1326861
bq. http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/main/java/org/apache/shindig/gadgets/features/FeatureResourceLoader.java 1304584
bq. http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/main/java/org/apache/shindig/gadgets/http/HttpRequest.java 1304584
bq. http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/main/java/org/apache/shindig/gadgets/oauth/OAuthRequest.java 1304584
bq. http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/main/java/org/apache/shindig/gadgets/oauth2/handler/ClientCredentialsGrantTypeHandler.java 1326858
bq. http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/main/java/org/apache/shindig/gadgets/oauth2/handler/CodeAuthorizationResponseHandler.java 1326858
bq. http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/main/java/org/apache/shindig/gadgets/render/CajaResponseRewriter.java 1304584
bq. http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/main/java/org/apache/shindig/gadgets/render/DefaultServiceFetcher.java 1304584
bq. http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/main/java/org/apache/shindig/gadgets/servlet/CajaContentRewriter.java 1311453
bq. http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/main/java/org/apache/shindig/gadgets/servlet/HttpRequestHandler.java 1304584
bq. http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/main/java/org/apache/shindig/gadgets/templates/TemplateLibraryFactory.java 1304584
bq. http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/test/java/org/apache/shindig/gadgets/http/HttpRequestTest.java 1304584
bq.
bq. Diff: https://reviews.apache.org/r/4750/diff
bq.
bq.
bq. Testing
bq. -------
bq.
bq. Existing tests passed. No tests that I saw specifically examined the request content & state. Should there be consensus on the patch, then I will look at providing additional tests to do some request state verification.
bq.
bq.
bq. Thanks,
bq.
bq. BrianLillie
bq.
bq.
> Identify origiation of requests
> -------------------------------
>
> Key: SHINDIG-1756
> URL: https://issues.apache.org/jira/browse/SHINDIG-1756
> Project: Shindig
> Issue Type: Improvement
> Components: Java
> Affects Versions: 2.5.0
> Reporter: Brian Lillie
> Fix For: 2.5.0
>
>
> In order to determine based upon the request whether to honor the request, or whether the request should be restricted, the request needs to identify itself in some way. Some of the requests in the system originate as a result of direct user requests (e.g. makeRequest) while other requests are performed by the server for the server or in order to handle the request (e.g. gadget spec lookups).
> The proposal is to better mark the origination of the request either by attaching an Anonymous Security Token containing the gadget URI, or by marking the request as an internal request (one that the server is initiating) so that downstream components (e.g. the HttpFetcher implementation) can make determinations on how to process the request.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (SHINDIG-1756) Identify origination of requests
Posted by "jiraposter@reviews.apache.org (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/SHINDIG-1756?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13262597#comment-13262597 ]
jiraposter@reviews.apache.org commented on SHINDIG-1756:
--------------------------------------------------------
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/4750/
-----------------------------------------------------------
(Updated 2012-04-26 13:10:16.263814)
Review request for shindig.
Changes
-------
Fixed the nits on the braces.
Summary
-------
Update HttpRequest objects to identify a request source. For some requests, SecurityTokens are provided. Others have gadget URI, but this is not always trustworthy as it is set based upon URL parameters.
For requests where a security token was not sent from the client, create and set an AnonymousSecurityToken identifying the gadget URI associated with the request. Also, add a flag to the HttpRequest to indicate a request generated by the server, where this may be set when requesting services, retrieving a template library, or during selected rewrites.
This addresses bug SHINDIG-1756.
https://issues.apache.org/jira/browse/SHINDIG-1756
Diffs (updated)
-----
http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/test/java/org/apache/shindig/gadgets/render/DefaultServiceFetcherTest.java 1304584
http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/test/java/org/apache/shindig/gadgets/servlet/CajaContentRewriterTest.java 1304584
http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/test/java/org/apache/shindig/gadgets/servlet/HttpRequestHandlerTest.java 1304584
http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/test/java/org/apache/shindig/gadgets/templates/TemplateLibraryFactoryTest.java PRE-CREATION
http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/test/java/org/apache/shindig/gadgets/oauth/testing/FakeOAuthServiceProvider.java 1304584
http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/test/java/org/apache/shindig/gadgets/oauth2/MockUtils.java 1304584
http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/test/java/org/apache/shindig/gadgets/oauth2/handler/ClientCredentialsGrantTypeHandlerTest.java 1304584
http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/test/java/org/apache/shindig/gadgets/oauth2/handler/CodeAuthorizationResponseHandlerTest.java 1304584
http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/main/java/org/apache/shindig/gadgets/servlet/CajaContentRewriter.java 1311453
http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/main/java/org/apache/shindig/gadgets/servlet/HttpRequestHandler.java 1304584
http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/main/java/org/apache/shindig/gadgets/templates/TemplateLibraryFactory.java 1304584
http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/test/java/org/apache/shindig/gadgets/DefaultGadgetSpecFactoryTest.java 1304584
http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/test/java/org/apache/shindig/gadgets/features/FeatureResourceLoaderTest.java 1304584
http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/test/java/org/apache/shindig/gadgets/http/HttpRequestTest.java 1304584
http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/test/java/org/apache/shindig/gadgets/oauth/OAuthRequestTest.java 1304584
http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/main/java/org/apache/shindig/gadgets/oauth2/handler/ClientCredentialsGrantTypeHandler.java 1326858
http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/main/java/org/apache/shindig/gadgets/oauth2/handler/CodeAuthorizationResponseHandler.java 1326858
http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/main/java/org/apache/shindig/gadgets/render/CajaResponseRewriter.java 1304584
http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/main/java/org/apache/shindig/gadgets/render/DefaultServiceFetcher.java 1304584
http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/main/java/org/apache/shindig/gadgets/oauth/OAuthRequest.java 1304584
http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/main/java/org/apache/shindig/gadgets/http/HttpRequest.java 1304584
http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/main/java/org/apache/shindig/gadgets/features/FeatureResourceLoader.java 1304584
http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/main/java/org/apache/shindig/gadgets/AbstractSpecFactory.java 1326861
Diff: https://reviews.apache.org/r/4750/diff
Testing
-------
Existing tests passed. Added additional tests to verify internal request state or token on requests.
Thanks,
BrianLillie
> Identify origination of requests
> --------------------------------
>
> Key: SHINDIG-1756
> URL: https://issues.apache.org/jira/browse/SHINDIG-1756
> Project: Shindig
> Issue Type: Improvement
> Components: Java
> Affects Versions: 2.5.0
> Reporter: Brian Lillie
> Fix For: 2.5.0
>
>
> In order to determine based upon the request whether to honor the request, or whether the request should be restricted, the request needs to identify itself in some way. Some of the requests in the system originate as a result of direct user requests (e.g. makeRequest) while other requests are performed by the server for the server or in order to handle the request (e.g. gadget spec lookups).
> The proposal is to better mark the origination of the request either by attaching an Anonymous Security Token containing the gadget URI, or by marking the request as an internal request (one that the server is initiating) so that downstream components (e.g. the HttpFetcher implementation) can make determinations on how to process the request.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Resolved] (SHINDIG-1756) Identify origination of requests
Posted by "Stanton Sievers (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/SHINDIG-1756?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Stanton Sievers resolved SHINDIG-1756.
--------------------------------------
Resolution: Fixed
Committed revision 1331083. Thanks Brian!
> Identify origination of requests
> --------------------------------
>
> Key: SHINDIG-1756
> URL: https://issues.apache.org/jira/browse/SHINDIG-1756
> Project: Shindig
> Issue Type: Improvement
> Components: Java
> Affects Versions: 2.5.0
> Reporter: Brian Lillie
> Fix For: 2.5.0
>
> Attachments: origination5.patch
>
>
> In order to determine based upon the request whether to honor the request, or whether the request should be restricted, the request needs to identify itself in some way. Some of the requests in the system originate as a result of direct user requests (e.g. makeRequest) while other requests are performed by the server for the server or in order to handle the request (e.g. gadget spec lookups).
> The proposal is to better mark the origination of the request either by attaching an Anonymous Security Token containing the gadget URI, or by marking the request as an internal request (one that the server is initiating) so that downstream components (e.g. the HttpFetcher implementation) can make determinations on how to process the request.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
[jira] [Commented] (SHINDIG-1756) Identify origination of requests
Posted by "jiraposter@reviews.apache.org (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/SHINDIG-1756?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13263137#comment-13263137 ]
jiraposter@reviews.apache.org commented on SHINDIG-1756:
--------------------------------------------------------
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/4750/#review7279
-----------------------------------------------------------
Ship it!
Committed revision 1331083. Thanks Brian!
- Stanton
On 2012-04-26 13:10:16, BrianLillie wrote:
bq.
bq. -----------------------------------------------------------
bq. This is an automatically generated e-mail. To reply, visit:
bq. https://reviews.apache.org/r/4750/
bq. -----------------------------------------------------------
bq.
bq. (Updated 2012-04-26 13:10:16)
bq.
bq.
bq. Review request for shindig.
bq.
bq.
bq. Summary
bq. -------
bq.
bq. Update HttpRequest objects to identify a request source. For some requests, SecurityTokens are provided. Others have gadget URI, but this is not always trustworthy as it is set based upon URL parameters.
bq. For requests where a security token was not sent from the client, create and set an AnonymousSecurityToken identifying the gadget URI associated with the request. Also, add a flag to the HttpRequest to indicate a request generated by the server, where this may be set when requesting services, retrieving a template library, or during selected rewrites.
bq.
bq.
bq. This addresses bug SHINDIG-1756.
bq. https://issues.apache.org/jira/browse/SHINDIG-1756
bq.
bq.
bq. Diffs
bq. -----
bq.
bq. http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/test/java/org/apache/shindig/gadgets/render/DefaultServiceFetcherTest.java 1304584
bq. http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/test/java/org/apache/shindig/gadgets/servlet/CajaContentRewriterTest.java 1304584
bq. http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/test/java/org/apache/shindig/gadgets/servlet/HttpRequestHandlerTest.java 1304584
bq. http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/test/java/org/apache/shindig/gadgets/templates/TemplateLibraryFactoryTest.java PRE-CREATION
bq. http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/test/java/org/apache/shindig/gadgets/oauth/testing/FakeOAuthServiceProvider.java 1304584
bq. http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/test/java/org/apache/shindig/gadgets/oauth2/MockUtils.java 1304584
bq. http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/test/java/org/apache/shindig/gadgets/oauth2/handler/ClientCredentialsGrantTypeHandlerTest.java 1304584
bq. http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/test/java/org/apache/shindig/gadgets/oauth2/handler/CodeAuthorizationResponseHandlerTest.java 1304584
bq. http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/main/java/org/apache/shindig/gadgets/servlet/CajaContentRewriter.java 1311453
bq. http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/main/java/org/apache/shindig/gadgets/servlet/HttpRequestHandler.java 1304584
bq. http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/main/java/org/apache/shindig/gadgets/templates/TemplateLibraryFactory.java 1304584
bq. http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/test/java/org/apache/shindig/gadgets/DefaultGadgetSpecFactoryTest.java 1304584
bq. http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/test/java/org/apache/shindig/gadgets/features/FeatureResourceLoaderTest.java 1304584
bq. http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/test/java/org/apache/shindig/gadgets/http/HttpRequestTest.java 1304584
bq. http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/test/java/org/apache/shindig/gadgets/oauth/OAuthRequestTest.java 1304584
bq. http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/main/java/org/apache/shindig/gadgets/oauth2/handler/ClientCredentialsGrantTypeHandler.java 1326858
bq. http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/main/java/org/apache/shindig/gadgets/oauth2/handler/CodeAuthorizationResponseHandler.java 1326858
bq. http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/main/java/org/apache/shindig/gadgets/render/CajaResponseRewriter.java 1304584
bq. http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/main/java/org/apache/shindig/gadgets/render/DefaultServiceFetcher.java 1304584
bq. http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/main/java/org/apache/shindig/gadgets/oauth/OAuthRequest.java 1304584
bq. http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/main/java/org/apache/shindig/gadgets/http/HttpRequest.java 1304584
bq. http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/main/java/org/apache/shindig/gadgets/features/FeatureResourceLoader.java 1304584
bq. http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/main/java/org/apache/shindig/gadgets/AbstractSpecFactory.java 1326861
bq.
bq. Diff: https://reviews.apache.org/r/4750/diff
bq.
bq.
bq. Testing
bq. -------
bq.
bq. Existing tests passed. Added additional tests to verify internal request state or token on requests.
bq.
bq.
bq. Thanks,
bq.
bq. BrianLillie
bq.
bq.
> Identify origination of requests
> --------------------------------
>
> Key: SHINDIG-1756
> URL: https://issues.apache.org/jira/browse/SHINDIG-1756
> Project: Shindig
> Issue Type: Improvement
> Components: Java
> Affects Versions: 2.5.0
> Reporter: Brian Lillie
> Fix For: 2.5.0
>
> Attachments: origination5.patch
>
>
> In order to determine based upon the request whether to honor the request, or whether the request should be restricted, the request needs to identify itself in some way. Some of the requests in the system originate as a result of direct user requests (e.g. makeRequest) while other requests are performed by the server for the server or in order to handle the request (e.g. gadget spec lookups).
> The proposal is to better mark the origination of the request either by attaching an Anonymous Security Token containing the gadget URI, or by marking the request as an internal request (one that the server is initiating) so that downstream components (e.g. the HttpFetcher implementation) can make determinations on how to process the request.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators: https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira