From: Mathieu Baudier Date: Mon, 18 Jul 2022 05:32:25 +0000 (+0200) Subject: Centralise HTTP headers X-Git-Tag: v2.3.10~113 X-Git-Url: https://git.argeo.org/?a=commitdiff_plain;h=0bd819f841b28c7eb869362e67cf424a9e99f862;p=lgpl%2Fargeo-commons.git Centralise HTTP headers --- diff --git a/org.argeo.cms.ee/src/org/argeo/cms/servlet/PrivateWwwAuthServletContext.java b/org.argeo.cms.ee/src/org/argeo/cms/servlet/PrivateWwwAuthServletContext.java index 3bea0b4de..bf1ddcf88 100644 --- a/org.argeo.cms.ee/src/org/argeo/cms/servlet/PrivateWwwAuthServletContext.java +++ b/org.argeo.cms.ee/src/org/argeo/cms/servlet/PrivateWwwAuthServletContext.java @@ -5,7 +5,7 @@ import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; import org.argeo.cms.auth.SpnegoLoginModule; -import org.argeo.cms.servlet.internal.HttpUtils; +import org.argeo.util.http.HttpHeader; /** Servlet context forcing authentication. */ public class PrivateWwwAuthServletContext extends CmsServletContext { @@ -23,9 +23,10 @@ public class PrivateWwwAuthServletContext extends CmsServletContext { // response.setHeader(HttpUtils.HEADER_WWW_AUTHENTICATE, "basic // realm=\"" + httpAuthRealm + "\""); if (SpnegoLoginModule.hasAcceptorCredentials() && !forceBasic)// SPNEGO - response.setHeader(HttpUtils.HEADER_WWW_AUTHENTICATE, "Negotiate"); + response.setHeader(HttpHeader.WWW_AUTHENTICATE.getName(), HttpHeader.NEGOTIATE); else - response.setHeader(HttpUtils.HEADER_WWW_AUTHENTICATE, "Basic realm=\"" + httpAuthRealm + "\""); + response.setHeader(HttpHeader.WWW_AUTHENTICATE.getName(), + HttpHeader.BASIC + " " + HttpHeader.REALM + "=\"" + httpAuthRealm + "\""); // response.setDateHeader("Date", System.currentTimeMillis()); // response.setDateHeader("Expires", System.currentTimeMillis() + (24 * diff --git a/org.argeo.cms.ee/src/org/argeo/cms/servlet/internal/HttpUtils.java b/org.argeo.cms.ee/src/org/argeo/cms/servlet/internal/HttpUtils.java index 70f2cc6b0..f0e11f8b9 100644 --- a/org.argeo.cms.ee/src/org/argeo/cms/servlet/internal/HttpUtils.java +++ b/org.argeo.cms.ee/src/org/argeo/cms/servlet/internal/HttpUtils.java @@ -8,8 +8,8 @@ import javax.servlet.http.HttpServletResponse; import org.argeo.api.cms.CmsLog; public class HttpUtils { - public final static String HEADER_AUTHORIZATION = "Authorization"; - public final static String HEADER_WWW_AUTHENTICATE = "WWW-Authenticate"; +// public final static String HEADER_AUTHORIZATION = "Authorization"; +// public final static String HEADER_WWW_AUTHENTICATE = "WWW-Authenticate"; static boolean isBrowser(String userAgent) { return userAgent.contains("webkit") || userAgent.contains("gecko") || userAgent.contains("firefox") diff --git a/org.argeo.cms/src/org/argeo/cms/auth/CmsAuthUtils.java b/org.argeo.cms/src/org/argeo/cms/auth/CmsAuthUtils.java index 711edba2f..6abaf71f2 100644 --- a/org.argeo.cms/src/org/argeo/cms/auth/CmsAuthUtils.java +++ b/org.argeo.cms/src/org/argeo/cms/auth/CmsAuthUtils.java @@ -34,8 +34,8 @@ class CmsAuthUtils { // Standard final static String SHARED_STATE_NAME = AuthenticatingUser.SHARED_STATE_NAME; final static String SHARED_STATE_PWD = AuthenticatingUser.SHARED_STATE_PWD; - final static String HEADER_AUTHORIZATION = "Authorization"; - final static String HEADER_WWW_AUTHENTICATE = "WWW-Authenticate"; +// final static String HEADER_AUTHORIZATION = "Authorization"; +// final static String HEADER_WWW_AUTHENTICATE = "WWW-Authenticate"; // Argeo specific final static String SHARED_STATE_HTTP_REQUEST = "org.argeo.cms.auth.http.request"; diff --git a/org.argeo.cms/src/org/argeo/cms/auth/RemoteSessionLoginModule.java b/org.argeo.cms/src/org/argeo/cms/auth/RemoteSessionLoginModule.java index 8f0509690..d801b5e57 100644 --- a/org.argeo.cms/src/org/argeo/cms/auth/RemoteSessionLoginModule.java +++ b/org.argeo.cms/src/org/argeo/cms/auth/RemoteSessionLoginModule.java @@ -19,6 +19,7 @@ import org.argeo.cms.CmsDeployProperty; import org.argeo.cms.internal.auth.CmsSessionImpl; import org.argeo.cms.internal.runtime.CmsContextImpl; import org.argeo.cms.internal.runtime.CmsStateImpl; +import org.argeo.util.http.HttpHeader; import org.osgi.service.useradmin.Authorization; /** Use the HTTP session as the basis for authentication. */ @@ -32,8 +33,6 @@ public class RemoteSessionLoginModule implements LoginModule { private RemoteAuthRequest request = null; private RemoteAuthResponse response = null; -// private BundleContext bc; - private Authorization authorization; private Locale locale; @@ -41,8 +40,6 @@ public class RemoteSessionLoginModule implements LoginModule { @Override public void initialize(Subject subject, CallbackHandler callbackHandler, Map sharedState, Map options) { -// bc = FrameworkUtil.getBundle(RemoteSessionLoginModule.class).getBundleContext(); -// assert bc != null; this.subject = subject; this.callbackHandler = callbackHandler; this.sharedState = (Map) sharedState; @@ -117,7 +114,7 @@ public class RemoteSessionLoginModule implements LoginModule { public boolean commit() throws LoginException { byte[] outToken = (byte[]) sharedState.get(CmsAuthUtils.SHARED_STATE_SPNEGO_OUT_TOKEN); if (outToken != null) { - response.setHeader(CmsAuthUtils.HEADER_WWW_AUTHENTICATE, + response.setHeader(HttpHeader.WWW_AUTHENTICATE.getName(), "Negotiate " + java.util.Base64.getEncoder().encodeToString(outToken)); } @@ -155,7 +152,7 @@ public class RemoteSessionLoginModule implements LoginModule { } private void extractHttpAuth(final RemoteAuthRequest httpRequest) { - String authHeader = httpRequest.getHeader(CmsAuthUtils.HEADER_AUTHORIZATION); + String authHeader = httpRequest.getHeader(HttpHeader.AUTHORIZATION.getName()); extractHttpAuth(authHeader); } @@ -164,7 +161,7 @@ public class RemoteSessionLoginModule implements LoginModule { StringTokenizer st = new StringTokenizer(authHeader); if (st.hasMoreTokens()) { String basic = st.nextToken(); - if (basic.equalsIgnoreCase("Basic")) { + if (basic.equalsIgnoreCase(HttpHeader.BASIC)) { try { // TODO manipulate char[] Base64.Decoder decoder = Base64.getDecoder(); @@ -182,7 +179,7 @@ public class RemoteSessionLoginModule implements LoginModule { } catch (Exception e) { throw new IllegalStateException("Couldn't retrieve authentication", e); } - } else if (basic.equalsIgnoreCase("Negotiate")) { + } else if (basic.equalsIgnoreCase(HttpHeader.NEGOTIATE)) { String spnegoToken = st.nextToken(); Base64.Decoder decoder = Base64.getDecoder(); byte[] authToken = decoder.decode(spnegoToken); diff --git a/org.argeo.cms/src/org/argeo/cms/internal/http/CmsAuthenticator.java b/org.argeo.cms/src/org/argeo/cms/internal/http/CmsAuthenticator.java index 04312eca3..e15d074fe 100644 --- a/org.argeo.cms/src/org/argeo/cms/internal/http/CmsAuthenticator.java +++ b/org.argeo.cms/src/org/argeo/cms/internal/http/CmsAuthenticator.java @@ -9,14 +9,15 @@ import org.argeo.api.cms.CmsLog; import org.argeo.cms.auth.CurrentUser; import org.argeo.cms.auth.RemoteAuthCallbackHandler; import org.argeo.cms.auth.SpnegoLoginModule; +import org.argeo.util.http.HttpHeader; import com.sun.net.httpserver.Authenticator; import com.sun.net.httpserver.HttpExchange; import com.sun.net.httpserver.HttpPrincipal; public class CmsAuthenticator extends Authenticator { - final static String HEADER_AUTHORIZATION = "Authorization"; - final static String HEADER_WWW_AUTHENTICATE = "WWW-Authenticate"; +// final static String HEADER_AUTHORIZATION = "Authorization"; +// final static String HEADER_WWW_AUTHENTICATE = "WWW-Authenticate"; private final static CmsLog log = CmsLog.getLog(CmsAuthenticator.class); @@ -96,9 +97,10 @@ public class CmsAuthenticator extends Authenticator { // response.setHeader(HttpUtils.HEADER_WWW_AUTHENTICATE, "basic // realm=\"" + httpAuthRealm + "\""); if (SpnegoLoginModule.hasAcceptorCredentials() && !forceBasic)// SPNEGO - httpExchange.getResponseHeaders().set(HEADER_WWW_AUTHENTICATE, "Negotiate"); + httpExchange.getResponseHeaders().set(HttpHeader.WWW_AUTHENTICATE.getName(), HttpHeader.NEGOTIATE); else - httpExchange.getResponseHeaders().set(HEADER_WWW_AUTHENTICATE, "Basic realm=\"" + httpAuthRealm + "\""); + httpExchange.getResponseHeaders().set(HttpHeader.WWW_AUTHENTICATE.getName(), + HttpHeader.BASIC + " " + HttpHeader.REALM + "=\"" + httpAuthRealm + "\""); // response.setDateHeader("Date", System.currentTimeMillis()); // response.setDateHeader("Expires", System.currentTimeMillis() + (24 * diff --git a/org.argeo.util/src/org/argeo/util/dav/DavClient.java b/org.argeo.util/src/org/argeo/util/dav/DavClient.java index 4fa8648cf..f8a8fa1f0 100644 --- a/org.argeo.util/src/org/argeo/util/dav/DavClient.java +++ b/org.argeo.util/src/org/argeo/util/dav/DavClient.java @@ -64,7 +64,7 @@ public class DavClient { """; HttpRequest request = HttpRequest.newBuilder().uri(uri) // - .header(DavHeader.Depth.name(), "1") // + .header(DavHeader.DEPTH.name(), "1") // .method(DavMethod.PROPFIND.name(), BodyPublishers.ofString(body)) // .build(); @@ -83,7 +83,7 @@ public class DavClient { public boolean exists(URI uri) { try { HttpRequest request = HttpRequest.newBuilder().uri(uri) // - .header(DavHeader.Depth.name(), "0") // + .header(DavHeader.DEPTH.name(), "0") // .method(DavMethod.HEAD.name(), BodyPublishers.noBody()) // .build(); BodyHandler bodyHandler = BodyHandlers.ofString(); @@ -110,7 +110,7 @@ public class DavClient { """; HttpRequest request = HttpRequest.newBuilder().uri(uri) // - .header(DavHeader.Depth.name(), "0") // + .header(DavHeader.DEPTH.name(), "0") // .method(DavMethod.PROPFIND.name(), BodyPublishers.ofString(body)) // .build(); diff --git a/org.argeo.util/src/org/argeo/util/dav/DavHeader.java b/org.argeo.util/src/org/argeo/util/dav/DavHeader.java index e527ba7a8..a1b034bf3 100644 --- a/org.argeo.util/src/org/argeo/util/dav/DavHeader.java +++ b/org.argeo.util/src/org/argeo/util/dav/DavHeader.java @@ -1,5 +1,23 @@ package org.argeo.util.dav; +/** Standard HTTP headers. */ public enum DavHeader { - Depth; + DEPTH("Depth"), // + ; + + private final String name; + + private DavHeader(String headerName) { + this.name = headerName; + } + + public String getName() { + return name; + } + + @Override + public String toString() { + return getName(); + } + } diff --git a/org.argeo.util/src/org/argeo/util/http/HttpHeader.java b/org.argeo.util/src/org/argeo/util/http/HttpHeader.java new file mode 100644 index 000000000..a6d4186c3 --- /dev/null +++ b/org.argeo.util/src/org/argeo/util/http/HttpHeader.java @@ -0,0 +1,28 @@ +package org.argeo.util.http; + +/** HTTP headers which are specific to WebDAV. */ +public enum HttpHeader { + AUTHORIZATION("Authorization"), // + WWW_AUTHENTICATE("WWW-Authenticate"), // + ; + + public final static String BASIC = "Basic"; + public final static String REALM = "realm"; + public final static String NEGOTIATE = "Negotiate"; + + private final String name; + + private HttpHeader(String headerName) { + this.name = headerName; + } + + public String getName() { + return name; + } + + @Override + public String toString() { + return getName(); + } + +}