Serge Huber created UNOMI-975:
---------------------------------
Summary: Bind a public context request to the profile named by its
own cookie
Key: UNOMI-975
URL: https://issues.apache.org/jira/browse/UNOMI-975
Project: Apache Unomi
Issue Type: Improvement
Components: unomi(-core)
Affects Versions: unomi-3.1.0
Reporter: Serge Huber
Assignee: Serge Huber
Fix For: unomi-3.1.0
h2. Current behaviour
{{/context.json}} and {{/eventcollector}} accept a profile id from the request
body and a session id
from the request, and use them without checking that the caller's own
{{context-profile-id}} cookie
names that profile.
h2. Change
A public caller is bound to the profile its cookie names:
* a body {{profileId}} is ignored unless it matches the cookie;
* a supplied session is continued only when the cookie already owns it;
* a refused session is detached rather than rebound, and the refused id is
*not* echoed back — a
client that saw its own id returned would keep replaying an id the server has
rejected;
* the shipped profile cookie now defaults to {{HttpOnly}}, since the model
rests on that cookie not
being readable from page script.
h2. Compatibility
Deliberately unchanged, and pinned by tests:
* anonymous browsing — a caller with no cookie is still issued a profile;
* personas and profile overrides;
* the trusted server-side path — a caller holding the tenant private key still
overrides the body
{{profileId}}, gated behind a single {{isTrustedProfileCaller()}} seam.
h2. Tests
* {{RestServiceUtilsImplProfileBindingTest}} (20 unit tests).
* {{ContextEndpointBaselineIT}} — a before/after record: its {{compat_*}} tests
pass on {{master}}
and on this branch; its {{hardened_*}} tests fail on {{master}} and pass here.
* Nine binding tests in {{ContextServletIT}} pinning the behaviour that must
not change.
* {{ShippedProfileCookieConfigTest}} pins the shipped {{HttpOnly}} default.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
