You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@qpid.apache.org by lq...@apache.org on 2016/07/05 08:47:39 UTC
svn commit: r1751421 - in
/qpid/java/trunk/broker-plugins/management-http/src:
main/java/org/apache/qpid/server/management/plugin/
main/java/org/apache/qpid/server/management/plugin/filter/
test/java/org/apache/qpid/server/management/plugin/filter/
Author: lquack
Date: Tue Jul 5 08:47:38 2016
New Revision: 1751421
URL: http://svn.apache.org/viewvc?rev=1751421&view=rev
Log:
QPID-7046: [Java Broker] Move invalidation of preemptive authenticated sessions into separate filter
Added:
qpid/java/trunk/broker-plugins/management-http/src/main/java/org/apache/qpid/server/management/plugin/filter/PreemptiveSessionInvalidationFilter.java
- copied, changed from r1751224, qpid/java/trunk/broker-plugins/management-http/src/main/java/org/apache/qpid/server/management/plugin/filter/ForbiddingAuthorisationFilter.java
qpid/java/trunk/broker-plugins/management-http/src/test/java/org/apache/qpid/server/management/plugin/filter/
qpid/java/trunk/broker-plugins/management-http/src/test/java/org/apache/qpid/server/management/plugin/filter/PreemptiveSessionInvalidationFilterTest.java
Modified:
qpid/java/trunk/broker-plugins/management-http/src/main/java/org/apache/qpid/server/management/plugin/HttpManagement.java
qpid/java/trunk/broker-plugins/management-http/src/main/java/org/apache/qpid/server/management/plugin/filter/ForbiddingAuthorisationFilter.java
Modified: qpid/java/trunk/broker-plugins/management-http/src/main/java/org/apache/qpid/server/management/plugin/HttpManagement.java
URL: http://svn.apache.org/viewvc/qpid/java/trunk/broker-plugins/management-http/src/main/java/org/apache/qpid/server/management/plugin/HttpManagement.java?rev=1751421&r1=1751420&r2=1751421&view=diff
==============================================================================
--- qpid/java/trunk/broker-plugins/management-http/src/main/java/org/apache/qpid/server/management/plugin/HttpManagement.java (original)
+++ qpid/java/trunk/broker-plugins/management-http/src/main/java/org/apache/qpid/server/management/plugin/HttpManagement.java Tue Jul 5 08:47:38 2016
@@ -74,6 +74,7 @@ import org.apache.qpid.server.management
import org.apache.qpid.server.management.plugin.filter.ForbiddingTraceFilter;
import org.apache.qpid.server.management.plugin.filter.LoggingFilter;
import org.apache.qpid.server.management.plugin.filter.RedirectingAuthorisationFilter;
+import org.apache.qpid.server.management.plugin.filter.PreemptiveSessionInvalidationFilter;
import org.apache.qpid.server.management.plugin.servlet.FileServlet;
import org.apache.qpid.server.management.plugin.servlet.RootServlet;
import org.apache.qpid.server.management.plugin.servlet.rest.ApiDocsServlet;
@@ -263,6 +264,8 @@ public class HttpManagement extends Abst
root.addFilter(loggingFilter, "/api/*", EnumSet.of(DispatcherType.REQUEST));
root.addFilter(loggingFilter, "/service/*", EnumSet.of(DispatcherType.REQUEST));
+ root.addFilter(new FilterHolder(new PreemptiveSessionInvalidationFilter()), "/api/*", EnumSet.of(DispatcherType.REQUEST));
+
root.addFilter(new FilterHolder(new ForbiddingTraceFilter()), "/*", EnumSet.of(DispatcherType.REQUEST));
FilterHolder restAuthorizationFilter = new FilterHolder(new ForbiddingAuthorisationFilter());
restAuthorizationFilter.setInitParameter(ForbiddingAuthorisationFilter.INIT_PARAM_ALLOWED, "/service/sasl");
Modified: qpid/java/trunk/broker-plugins/management-http/src/main/java/org/apache/qpid/server/management/plugin/filter/ForbiddingAuthorisationFilter.java
URL: http://svn.apache.org/viewvc/qpid/java/trunk/broker-plugins/management-http/src/main/java/org/apache/qpid/server/management/plugin/filter/ForbiddingAuthorisationFilter.java?rev=1751421&r1=1751420&r2=1751421&view=diff
==============================================================================
--- qpid/java/trunk/broker-plugins/management-http/src/main/java/org/apache/qpid/server/management/plugin/filter/ForbiddingAuthorisationFilter.java (original)
+++ qpid/java/trunk/broker-plugins/management-http/src/main/java/org/apache/qpid/server/management/plugin/filter/ForbiddingAuthorisationFilter.java Tue Jul 5 08:47:38 2016
@@ -71,8 +71,6 @@ public class ForbiddingAuthorisationFilt
HttpServletRequest httpRequest = (HttpServletRequest) request;
HttpServletResponse httpResponse = (HttpServletResponse) response;
String servletPath = httpRequest.getServletPath();
- final boolean hasPreexistingSession = (httpRequest.getSession(false) != null);
-
if (_allowed == null || "".equals(_allowed) || servletPath.indexOf(_allowed) == -1)
{
try
@@ -94,11 +92,6 @@ public class ForbiddingAuthorisationFilt
}
chain.doFilter(request, response);
-
- if (!hasPreexistingSession && httpRequest.getServletPath().startsWith("/api/"))
- {
- invalidateSession(httpRequest);
- }
}
private void invalidateSession(final HttpServletRequest httpRequest)
Copied: qpid/java/trunk/broker-plugins/management-http/src/main/java/org/apache/qpid/server/management/plugin/filter/PreemptiveSessionInvalidationFilter.java (from r1751224, qpid/java/trunk/broker-plugins/management-http/src/main/java/org/apache/qpid/server/management/plugin/filter/ForbiddingAuthorisationFilter.java)
URL: http://svn.apache.org/viewvc/qpid/java/trunk/broker-plugins/management-http/src/main/java/org/apache/qpid/server/management/plugin/filter/PreemptiveSessionInvalidationFilter.java?p2=qpid/java/trunk/broker-plugins/management-http/src/main/java/org/apache/qpid/server/management/plugin/filter/PreemptiveSessionInvalidationFilter.java&p1=qpid/java/trunk/broker-plugins/management-http/src/main/java/org/apache/qpid/server/management/plugin/filter/ForbiddingAuthorisationFilter.java&r1=1751224&r2=1751421&rev=1751421&view=diff
==============================================================================
--- qpid/java/trunk/broker-plugins/management-http/src/main/java/org/apache/qpid/server/management/plugin/filter/ForbiddingAuthorisationFilter.java (original)
+++ qpid/java/trunk/broker-plugins/management-http/src/main/java/org/apache/qpid/server/management/plugin/filter/PreemptiveSessionInvalidationFilter.java Tue Jul 5 08:47:38 2016
@@ -21,31 +21,18 @@
package org.apache.qpid.server.management.plugin.filter;
import java.io.IOException;
-import java.security.AccessControlException;
import javax.servlet.Filter;
import javax.servlet.FilterChain;
import javax.servlet.FilterConfig;
-import javax.servlet.ServletContext;
import javax.servlet.ServletException;
import javax.servlet.ServletRequest;
import javax.servlet.ServletResponse;
import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;
-import org.apache.qpid.server.management.plugin.HttpManagementConfiguration;
-import org.apache.qpid.server.management.plugin.HttpManagementUtil;
-import org.apache.qpid.server.model.Broker;
-
-public class ForbiddingAuthorisationFilter implements Filter
+public class PreemptiveSessionInvalidationFilter implements Filter
{
- public static String INIT_PARAM_ALLOWED = "allowed";
- private String _allowed = null;
-
- private Broker _broker;
- private HttpManagementConfiguration _managementConfiguration;
-
@Override
public void destroy()
{
@@ -54,48 +41,18 @@ public class ForbiddingAuthorisationFilt
@Override
public void init(FilterConfig config) throws ServletException
{
- String allowed = config.getInitParameter(INIT_PARAM_ALLOWED);
- if (allowed != null)
- {
- _allowed = allowed;
- }
- ServletContext servletContext = config.getServletContext();
- _broker = HttpManagementUtil.getBroker(servletContext);
- _managementConfiguration = HttpManagementUtil.getManagementConfiguration(servletContext);
}
@Override
public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException,
- ServletException
+ ServletException
{
HttpServletRequest httpRequest = (HttpServletRequest) request;
- HttpServletResponse httpResponse = (HttpServletResponse) response;
- String servletPath = httpRequest.getServletPath();
final boolean hasPreexistingSession = (httpRequest.getSession(false) != null);
- if (_allowed == null || "".equals(_allowed) || servletPath.indexOf(_allowed) == -1)
- {
- try
- {
- HttpManagementUtil.checkRequestAuthenticatedAndAccessAuthorized(httpRequest, _broker, _managementConfiguration);
- }
- catch(AccessControlException e)
- {
- httpResponse.sendError(HttpServletResponse.SC_FORBIDDEN);
- invalidateSession(httpRequest);
- return;
- }
- catch(SecurityException e)
- {
- httpResponse.sendError(HttpServletResponse.SC_UNAUTHORIZED);
- invalidateSession(httpRequest);
- return;
- }
- }
-
chain.doFilter(request, response);
- if (!hasPreexistingSession && httpRequest.getServletPath().startsWith("/api/"))
+ if (!hasPreexistingSession)
{
invalidateSession(httpRequest);
}
Added: qpid/java/trunk/broker-plugins/management-http/src/test/java/org/apache/qpid/server/management/plugin/filter/PreemptiveSessionInvalidationFilterTest.java
URL: http://svn.apache.org/viewvc/qpid/java/trunk/broker-plugins/management-http/src/test/java/org/apache/qpid/server/management/plugin/filter/PreemptiveSessionInvalidationFilterTest.java?rev=1751421&view=auto
==============================================================================
--- qpid/java/trunk/broker-plugins/management-http/src/test/java/org/apache/qpid/server/management/plugin/filter/PreemptiveSessionInvalidationFilterTest.java (added)
+++ qpid/java/trunk/broker-plugins/management-http/src/test/java/org/apache/qpid/server/management/plugin/filter/PreemptiveSessionInvalidationFilterTest.java Tue Jul 5 08:47:38 2016
@@ -0,0 +1,61 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.qpid.server.management.plugin.filter;
+
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.never;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+import javax.servlet.FilterChain;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpSession;
+
+import org.apache.qpid.test.utils.QpidTestCase;
+
+public class PreemptiveSessionInvalidationFilterTest extends QpidTestCase
+{
+ public void testDoFilterNoSession() throws Exception
+ {
+ FilterChain filterChain = mock(FilterChain.class);
+ HttpSession session = mock(HttpSession.class);
+ HttpServletRequest request = mock(HttpServletRequest.class);
+ when(request.getSession(false)).thenReturn(null).thenReturn(session);
+
+ final PreemptiveSessionInvalidationFilter filter = new PreemptiveSessionInvalidationFilter();
+ filter.doFilter(request, null, filterChain);
+
+ verify(filterChain).doFilter(request, null);
+ verify(session).invalidate();
+ }
+
+ public void testDoFilterWithSession() throws Exception
+ {
+ FilterChain filterChain = mock(FilterChain.class);
+ HttpSession session = mock(HttpSession.class);
+ HttpServletRequest request = mock(HttpServletRequest.class);
+ when(request.getSession(false)).thenReturn(session);
+
+ final PreemptiveSessionInvalidationFilter filter = new PreemptiveSessionInvalidationFilter();
+ filter.doFilter(request, null, filterChain);
+
+ verify(filterChain).doFilter(request, null);
+ verify(session, never()).invalidate();
+ }
+}
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@qpid.apache.org
For additional commands, e-mail: commits-help@qpid.apache.org