Example usage for javax.servlet.http Cookie toString

Introduction

In this page you can find the example usage for javax.servlet.http Cookie toString.

Prototype

public String toString() 

Source Link

Document

Returns a string representation of the object.

Usage

From source file:eu.eidas.node.AbstractNodeServlet.java

/**
 * Sets HTTPOnly Header on the session to prevent cookies from being accessed through
 * client-side script./*from   w ww .  ja  va 2 s  . c  o  m*/
 *
 * @param renewSession indicates that the session cookie will be renewed
 */
protected final void setHTTPOnlyHeaderToSession(final boolean renewSession, HttpServletRequest request,
        HttpServletResponse response) {
    if (request != null && request.getSession(false) != null) {
        // Renewing the session if necessary
        String currentSession = null;
        String messageLog = null;
        if (renewSession) {
            currentSession = sessionIdRegenerationInWebApp(request);
            messageLog = "http session Renewed : {}";
        } else {
            currentSession = request.getSession().getId();
            messageLog = "http session obtained from request : {}";
        }
        MDC.put(LoggingMarkerMDC.MDC_SESSIONID, currentSession);
        getLogger().info(LoggingMarkerMDC.SECURITY_SUCCESS, messageLog, currentSession);
        // changing session cookie to http only cookie
        if (request.getCookies() != null && request.isRequestedSessionIdFromCookie()) {
            //Session Id requested by the client, obtained from the cookie
            final String requestedSessionId = request.getRequestedSessionId();
            for (Cookie cookie : request.getCookies()) {
                getLogger().debug("Treating cookie [domain][path][name][value] : [{}][{}][{}][{}]",
                        cookie.getName(), cookie.getPath(), cookie.getName(), cookie.getValue());
                if (currentSession.equals(requestedSessionId)) {
                    // Removes old version
                    boolean isSecure = request.isSecure();
                    getLogger().debug("Cookie==session : Remove and replacing with HttpOnly {}",
                            cookie.toString());
                    getLogger().debug("Is using SSL?", isSecure);

                    //TODO: when migrating to servlet 3, use the cookie interface calls below instead of writing the http header
                    //
                    //NOSONAR                        cookie.setMaxAge(0);
                    //NOSONAR                        cookie.setPath(getServletContext().getContextPath());
                    //NOSONAR                 cookie.setDomain(request.getServerName());
                    //NOSONAR                 cookie.setSecure(isSecure);
                    //NOSONAR                 cookie.setHttpOnly(true);
                    //NOSONAR                 response.addCookie(cookie);

                    // Create new one httpOnly
                    StringBuilder httpOnlyCookie = new StringBuilder(cookie.getName())
                            .append(EIDASValues.EQUAL.toString()).append(cookie.getValue())
                            .append(EIDASValues.SEMICOLON.toString()).append(" ")
                            .append(EIDASValues.DOMAIN.toString()).append(EIDASValues.EQUAL.toString())
                            .append(request.getServerName()).append(EIDASValues.SEMICOLON.toString())
                            .append(" ").append(EIDASValues.PATH.toString())
                            .append(EIDASValues.EQUAL.toString()).append(getServletContext().getContextPath())
                            .append(EIDASValues.SEMICOLON.toString()).append(" ")
                            .append(EIDASValues.HTTP_ONLY.toString()).append(EIDASValues.SEMICOLON.toString())
                            .append(isSecure ? EIDASValues.SECURE.toString() : "");
                    response.setHeader(EIDASValues.SETCOOKIE.toString(), httpOnlyCookie.toString());
                }
            }
        }
        //cookie _csrf
        //            request.setAttribute("_csrf_header", "X-CSRF-TOKEN");
        //            UUID idOne = UUID.randomUUID();
        //            LOG.info("generate csrf id="+idOne);
        //            request.setAttribute("_csrf", idOne);
        response.setHeader("_csrf_header", "X-CSRF-TOKEN");
        UUID idOne = UUID.randomUUID();
        UUID idTwo = UUID.randomUUID();
        getLogger().info("generate csrf id1=" + idOne + " id2=" + idTwo);
        Cookie gato = new Cookie("_csrf", idOne.toString());
        response.addCookie(gato);
        response.setHeader("X-CSRF-TOKEN", idTwo.toString());

    } else {
        getLogger().warn(LoggingMarkerMDC.SECURITY_FAILURE, "Request or Session is null !");
    }
}

---