lprimak commented on code in PR #2900:
URL: https://github.com/apache/shiro/pull/2900#discussion_r4260922800
##########
support/jakarta-ee/src/main/java/org/apache/shiro/ee/filters/FormResubmitSupportCookies.java:
##########
@@ -46,41 +34,47 @@
@NoArgsConstructor(access = AccessLevel.PRIVATE)
@SuppressWarnings("HideUtilityClassConstructor")
public class FormResubmitSupportCookies {
- static final String DONT_ADD_ANY_MORE_COOKIES =
"org.apache.shiro.no-more-cookies";
+ private static final String HOST_PREFIX = "__Host-";
- static void addCookie(@NonNull HttpServletResponse response,
ServletContext servletContext,
- @NonNull String cookieName, @NonNull String cookieValue, int
maxAge, boolean httpOnly) {
- var cookie = new Cookie(cookieName, cookieValue);
- cookie.setPath(servletContext.getContextPath());
+ /**
+ * With secure cookies, the {@code __Host-} prefix makes browsers refuse
the cookie unless this very host
+ * set it over HTTPS, so it can't be planted from another subdomain or
over plain HTTP.
+ * The prefix requires {@code Path=/}, hence the context path moves into
the name, URL-encoded
+ * (cookie-name safe) to keep co-hosted applications apart.
+ */
+ static String cookieName(ServletContext servletContext, @NonNull String
baseName) {
+ return isFormResubmitSecureCookies(servletContext)
+ ? HOST_PREFIX + baseName +
URLEncoder.encode(servletContext.getContextPath(), StandardCharsets.UTF_8)
+ : baseName;
+ }
+
+ private static Cookie newCookie(ServletContext servletContext, String
baseName, String value, int maxAge,
+ boolean useHostPrefix) {
+ var cookie = new Cookie(useHostPrefix ? cookieName(servletContext,
baseName) : baseName, value);
+ boolean secure = useHostPrefix &&
isFormResubmitSecureCookies(servletContext);
+ cookie.setPath(secure ? "/" : servletContext.getContextPath());
+ cookie.setSecure(secure);
cookie.setMaxAge(maxAge);
- cookie.setHttpOnly(httpOnly);
- if
(EnvironmentLoaderListener.isFormResubmitSecureCookies(servletContext)) {
- cookie.setSecure(true);
- }
- response.addCookie(cookie);
+ return cookie;
}
+ /**
+ * @param cookieName base name, see {@link #cookieName}
+ */
static void addCookie(@NonNull HttpServletResponse response,
ServletContext servletContext,
- @NonNull String cookieName, @NonNull HttpCookie
inputCookie) {
- var cookie = new Cookie(cookieName, inputCookie.getValue());
- cookie.setPath(inputCookie.getPath() != null ? inputCookie.getPath() :
servletContext.getContextPath());
- cookie.setMaxAge(Math.toIntExact(inputCookie.getMaxAge()));
- cookie.setHttpOnly(inputCookie.isHttpOnly());
- if
(EnvironmentLoaderListener.isFormResubmitSecureCookies(servletContext)) {
- cookie.setSecure(true);
- }
+ @NonNull String cookieName, @NonNull String cookieValue, int
maxAge, boolean httpOnly) {
+ var cookie = newCookie(servletContext, cookieName, cookieValue,
maxAge, true);
+ cookie.setHttpOnly(httpOnly);
response.addCookie(cookie);
}
+ /**
+ * @param cookieName base name, see {@link #cookieName}
+ * @param useHostPrefix false for a plain-name, context-scoped cookie
regardless of the secure-cookie setting
+ */
static void deleteCookie(@NonNull HttpServletResponse response,
ServletContext servletContext,
- @NonNull String cookieName) {
- var cookieToDelete = new Cookie(cookieName, "tbd");
- cookieToDelete.setPath(servletContext.getContextPath());
- cookieToDelete.setMaxAge(0);
- if
(EnvironmentLoaderListener.isFormResubmitSecureCookies(servletContext)) {
- cookieToDelete.setSecure(true);
- }
- response.addCookie(cookieToDelete);
+ @NonNull String cookieName, boolean useHostPrefix) {
+ response.addCookie(newCookie(servletContext, cookieName, "tbd", 0,
useHostPrefix));
Review Comment:
I dont see any warnings, can you paste them in? Where are you getting the
warnings?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
