com.google.gwt.user.server.rpc.XsrfProtectedServiceServlet.java Source code

Introduction

Here is the source code for com.google.gwt.user.server.rpc.XsrfProtectedServiceServlet.java

Source

/*
 * Copyright 2011 Google Inc.
 *
 * Licensed under the Apache License, Version 2.0 (the "License"); you may not
 * use this file except in compliance with the License. You may obtain a copy of
 * the License at
 *
 * http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
 * License for the specific language governing permissions and limitations under
 * the License.
 */
package com.google.gwt.user.server.rpc;

import com.google.gwt.user.client.rpc.RpcToken;
import com.google.gwt.user.client.rpc.RpcTokenException;
import com.google.gwt.user.client.rpc.XsrfToken;
import com.google.gwt.user.server.Util;
import com.google.gwt.util.tools.Utility;

import java.lang.reflect.Method;

import javax.servlet.ServletException;
import javax.servlet.http.Cookie;

/**
 * EXPERIMENTAL and subject to change. Do not use this in production code.
 * <p>
 * The servlet base class for RPC service implementations using default XSRF
 * protection tied to authentication session cookie.
 * </p>
 *
 * <p>
 * XSRF token validation is performed by generating MD5 hash of the session
 * cookie and comparing supplied {@link XsrfToken} with the generated hash.
 * Session cookie name is specified by the {@value
 * com.google.gwt.user.server.rpc.XsrfTokenServiceServlet#COOKIE_NAME_PARAM}
 * context parameter in {@code web.xml}.
 * </p>
 *
 * <p>
 * {@link com.google.gwt.user.client.rpc.XsrfTokenService} can be used by
 * clients to obtain {@link XsrfToken}s that will pass validation performed by
 * this class.
 * </p>
 *
 * @see XsrfTokenServiceServlet
 * @see AbstractXsrfProtectedServiceServlet
 */
public class XsrfProtectedServiceServlet extends AbstractXsrfProtectedServiceServlet {

    // @VisibleForTesting
    String sessionCookieName = null;

    public XsrfProtectedServiceServlet() {
        this(null);
    }

    public XsrfProtectedServiceServlet(String sessionCookieName) {
        this.sessionCookieName = sessionCookieName;
    }

    public XsrfProtectedServiceServlet(Object delegate) {
        this(delegate, null);
    }

    public XsrfProtectedServiceServlet(Object delegate, String sessionCookieName) {
        super(delegate);
        this.sessionCookieName = sessionCookieName;
    }

    @Override
    public void init() throws ServletException {
        super.init();
        // do not overwrite if value is supplied in constructor
        if (sessionCookieName == null) {
            // servlet configuration precedes context configuration
            sessionCookieName = getServletConfig().getInitParameter(XsrfTokenServiceServlet.COOKIE_NAME_PARAM);
            if (sessionCookieName == null) {
                sessionCookieName = getServletContext().getInitParameter(XsrfTokenServiceServlet.COOKIE_NAME_PARAM);
            }
            if (sessionCookieName == null) {
                throw new IllegalStateException(XsrfTokenServiceServlet.COOKIE_NAME_NOT_SET_ERROR_MSG);
            }
        }
    }

    /**
     * Validates {@link XsrfToken} included with {@link RPCRequest} against XSRF
     * cookie.
     */
    @Override
    protected void validateXsrfToken(RpcToken token, Method method) throws RpcTokenException {
        if (token == null) {
            throw new RpcTokenException("XSRF token missing");
        }
        Cookie sessionCookie = Util.getCookie(getThreadLocalRequest(), sessionCookieName, false);
        if (sessionCookie == null || sessionCookie.getValue() == null || sessionCookie.getValue().length() == 0) {
            throw new RpcTokenException("Session cookie is missing or empty! " + "Unable to verify XSRF cookie");
        }

        String expectedToken = Utility.toHexString(Utility.getMd5Digest(sessionCookie.getValue().getBytes()));
        XsrfToken xsrfToken = (XsrfToken) token;

        if (!expectedToken.equals(xsrfToken.getToken())) {
            throw new RpcTokenException("Invalid XSRF token");
        }
    }
}