[
https://issues.apache.org/jira/browse/SHINDIG-1768?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13269872#comment-13269872
]
[email protected] commented on SHINDIG-1768:
--------------------------------------------------------
-----------------------------------------------------------
This is an automatically generated e-mail. To reply, visit:
https://reviews.apache.org/r/5013/
-----------------------------------------------------------
(Updated 2012-05-07 18:45:53.595406)
Review request for shindig.
Changes
-------
Added JIRA
Summary
-------
Change to io.js to send the security token as a request header on all requests.
This preserves the ability for the browser to cache the responses.
UrlParameterAuthenticationHandler, if no other token supplied on request,
checks the request header for the field
MakeRequestHandler sets the security token in all HttpRequest objects. This
change does not cause a failure if there is no token, though that could be
considered.
The makeXhrRequest logic was reordered slightly, as the opt_headers were not
included on the request if paramData was null. So for example, if the
makeRequest wanted to set opt_headers in the call parameters, but it was 'GET'
method in makeRequest, the opt_headers would not be added to the request. I
didn't come up with a reason for that restriction, and so reordered the logic
and moved the opt_headers updates to the request outside of the if (paramData
!= null) test.
This addresses bug SHINDIG-1768.
https://issues.apache.org/jira/browse/SHINDIG-1768
Diffs
-----
http://svn.apache.org/repos/asf/shindig/trunk/features/src/main/javascript/features/core.io/io.js
1332240
http://svn.apache.org/repos/asf/shindig/trunk/features/src/test/javascript/features/core.io/iotest.js
1332240
http://svn.apache.org/repos/asf/shindig/trunk/java/common/src/main/java/org/apache/shindig/auth/UrlParameterAuthenticationHandler.java
1304584
http://svn.apache.org/repos/asf/shindig/trunk/java/gadgets/src/main/java/org/apache/shindig/gadgets/servlet/MakeRequestHandler.java
1327569
Diff: https://reviews.apache.org/r/5013/diff
Testing
-------
Existing tests passed.
Thanks,
BrianLillie
> Add shindig security token to makeRequest header
> ------------------------------------------------
>
> Key: SHINDIG-1768
> URL: https://issues.apache.org/jira/browse/SHINDIG-1768
> Project: Shindig
> Issue Type: Improvement
> Components: Java
> Affects Versions: 2.5.0
> Reporter: Brian Lillie
> Fix For: 2.5.0
>
>
> Following on in the same vein as SHINDIG-1756, we want to better identify the
> source of the requests coming into the server via makeRequest. If the
> request authz is not none, then the security token flows. if the authz is
> NONE, the security token is not sent. This change would be to include the
> security token on every request. Since including the token on the URL
> parameter would break the ability to cache, the security token will instead
> be added as a header named X-Shindig-ST on all requests. On the shindig
> server side, the header will be processed if there is not already a token
> supplied as a url parameter or oauth related parameter.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators:
https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
