[
https://issues.apache.org/jira/browse/UNOMI-975?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Serge Huber updated UNOMI-975:
------------------------------
Fix Version/s: unomi-3.0.2
> Bind a public context request to the profile named by its own cookie
> --------------------------------------------------------------------
>
> Key: UNOMI-975
> URL: https://issues.apache.org/jira/browse/UNOMI-975
> Project: Apache Unomi
> Issue Type: Improvement
> Components: unomi(-core)
> Affects Versions: unomi-3.1.0, unomi-3.0.1
> Reporter: Serge Huber
> Assignee: Serge Huber
> Priority: Critical
> Fix For: unomi-3.1.0, unomi-3.0.2
>
> Time Spent: 20m
> Remaining Estimate: 0h
>
> h2. Current behaviour
> {{/context.json}} and {{/eventcollector}} accept a profile id from the
> request body and a session id
> from the request, and use them without checking that the caller's own
> {{context-profile-id}} cookie
> names that profile.
> h2. Change
> A public caller is bound to the profile its cookie names:
> * a body {{profileId}} is ignored unless it matches the cookie;
> * a supplied session is continued only when the cookie already owns it;
> * a refused session is detached rather than rebound, and the refused id is
> *not* echoed back — a
> client that saw its own id returned would keep replaying an id the server
> has rejected;
> * the shipped profile cookie now defaults to {{HttpOnly}}, since the model
> rests on that cookie not
> being readable from page script.
> h2. Compatibility
> Deliberately unchanged, and pinned by tests:
> * anonymous browsing — a caller with no cookie is still issued a profile;
> * personas and profile overrides;
> * the trusted server-side path — a caller holding the tenant private key
> still overrides the body
> {{profileId}}, gated behind a single {{isTrustedProfileCaller()}} seam.
> h2. Tests
> * {{RestServiceUtilsImplProfileBindingTest}} (20 unit tests).
> * {{ContextEndpointBaselineIT}} — a before/after record: its {{compat_*}}
> tests pass on {{master}}
> and on this branch; its {{hardened_*}} tests fail on {{master}} and pass
> here.
> * Nine binding tests in {{ContextServletIT}} pinning the behaviour that must
> not change.
> * {{ShippedProfileCookieConfigTest}} pins the shipped {{HttpOnly}} default.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
