io.undertow.server.handlers.Cookie Java Examples

@Test
public void testMultipleRequestCookies() {
    Map<String, Cookie> cookies = Cookies.parseRequestCookies(2, false, Arrays.asList(
            "CUSTOMER=WILE_E_COYOTE; $Domain=LOONEY_TUNES; $Version=1; $Path=/; SHIPPING=FEDEX"));

    Cookie cookie = cookies.get("CUSTOMER");
    Assert.assertEquals("CUSTOMER", cookie.getName());
    Assert.assertEquals("WILE_E_COYOTE", cookie.getValue());
    Assert.assertEquals("LOONEY_TUNES", cookie.getDomain());
    Assert.assertEquals(1, cookie.getVersion());
    Assert.assertEquals("/", cookie.getPath());

    cookie = cookies.get("SHIPPING");
    Assert.assertEquals("SHIPPING", cookie.getName());
    Assert.assertEquals("FEDEX", cookie.getValue());
    Assert.assertEquals("LOONEY_TUNES", cookie.getDomain());
    Assert.assertEquals(1, cookie.getVersion());
    Assert.assertEquals("/", cookie.getPath());
}
 

@Test
public void testCommaSeparatedCookies() {
    Map<String, Cookie> cookies = Cookies.parseRequestCookies(2, false, Arrays.asList("CUSTOMER=\"WILE_E_COYOTE\", SHIPPING=FEDEX" ), true);
    Assert.assertEquals(2, cookies.size());
    Cookie cookie = cookies.get("CUSTOMER");
    Assert.assertNotNull(cookie);
    Assert.assertEquals("WILE_E_COYOTE", cookie.getValue());
    cookie = cookies.get("SHIPPING");
    Assert.assertNotNull(cookie);
    Assert.assertEquals("FEDEX", cookie.getValue());

    //also make sure semi colon works as normal
    cookies = Cookies.parseRequestCookies(2, false, Arrays.asList("CUSTOMER=\"WILE_E_COYOTE\"; SHIPPING=FEDEX" ), true);
    Assert.assertEquals(2, cookies.size());
    cookie = cookies.get("CUSTOMER");
    Assert.assertNotNull(cookie);
    Assert.assertEquals("WILE_E_COYOTE", cookie.getValue());
    cookie = cookies.get("SHIPPING");
    Assert.assertNotNull(cookie);
    Assert.assertEquals("FEDEX", cookie.getValue());
}
 

@Test
public void testSameSiteCookie() {
    Cookie cookie = Cookies.parseSetCookieHeader("CUSTOMER=WILE_E_COYOTE; path=/; SameSite");
    Assert.assertEquals("CUSTOMER", cookie.getName());
    Assert.assertEquals("WILE_E_COYOTE", cookie.getValue());
    Assert.assertEquals("/", cookie.getPath());
    Assert.assertTrue(cookie.isSameSite());
    Assert.assertNull(cookie.getSameSiteMode());

    cookie = Cookies.parseSetCookieHeader("SHIPPING=FEDEX; path=/foo; SameSite=Strict");
    Assert.assertEquals("SHIPPING", cookie.getName());
    Assert.assertEquals("FEDEX", cookie.getValue());
    Assert.assertEquals("/foo", cookie.getPath());
    Assert.assertTrue(cookie.isSameSite());
    Assert.assertEquals("Strict", cookie.getSameSiteMode());

    cookie = Cookies.parseSetCookieHeader("SHIPPING=FEDEX; path=/acme; SameSite=Lax");
    Assert.assertEquals("SHIPPING", cookie.getName());
    Assert.assertEquals("FEDEX", cookie.getValue());
    Assert.assertEquals("/acme", cookie.getPath());
    Assert.assertTrue(cookie.isSameSite());
    Assert.assertEquals("Lax", cookie.getSameSiteMode());
}
 

private Cookie getAdminCookie(boolean includeTwoFactor) {
    PasetoV1LocalBuilder token = Pasetos.V1.LOCAL.builder()
            .setSharedSecret(new SecretKeySpec(this.config.getApplicationSecret().getBytes(StandardCharsets.UTF_8), "AES"))
            .setExpiration(LocalDateTime.now().plusMinutes(30).toInstant(ZoneOffset.UTC))
            .claim("uuid", MangooUtils.randomString(32));
    
    if (includeTwoFactor && StringUtils.isNotBlank(this.config.getApplicationAdminSecret())) {
        token.claim("twofactor", Boolean.TRUE);
    }

    return new CookieImpl(Default.ADMIN_COOKIE_NAME.toString())
            .setValue(token.compact())
            .setHttpOnly(true)
            .setSecure(Application.inProdMode())
            .setPath("/")
            .setSameSite(true)
            .setSameSiteMode("Strict");
}
 

@Override
public void onConnect(WebSocketHttpExchange exchange, WebSocketChannel channel) {
    try {
        Cookie sid = getRequestCookies(exchange).get("PYX-Session");

        User user;
        if (sid == null || (user = Sessions.get().getUser(sid.getValue())) == null) {
            sendConnectionError(exchange, channel, new JsonWrapper(Consts.ErrorCode.NOT_REGISTERED));
        } else if (!user.isValid()) {
            sendConnectionError(exchange, channel, new JsonWrapper(Consts.ErrorCode.SESSION_EXPIRED));
        } else {
            if (user.getEventsSender() == null) user.establishedEventsConnection(new EventsSender(user, channel));
            else user.getEventsSender().addChannel(channel);

            channel.getCloseSetter().set((ChannelListener<AbstractFramedChannel>) newChannel -> {
                if (user.getEventsSender() != null)
                    user.getEventsSender().removeChannel((WebSocketChannel) newChannel);
            });
        }
    } catch (Throwable ex) {
        logger.error("Failed handling incoming connection.", ex);
        throw ex;
    }
}
 

/**
 * Sets a response cookie
 *
 * @param cookie The cookie
 */
public HttpServerExchange setResponseCookie(final Cookie cookie) {
    if(getConnection().getUndertowOptions().get(UndertowOptions.ENABLE_RFC6265_COOKIE_VALIDATION, UndertowOptions.DEFAULT_ENABLE_RFC6265_COOKIE_VALIDATION)) {
        if (cookie.getValue() != null && !cookie.getValue().isEmpty()) {
            Rfc6265CookieSupport.validateCookieValue(cookie.getValue());
        }
        if (cookie.getPath() != null && !cookie.getPath().isEmpty()) {
            Rfc6265CookieSupport.validatePath(cookie.getPath());
        }
        if (cookie.getDomain() != null && !cookie.getDomain().isEmpty()) {
            Rfc6265CookieSupport.validateDomain(cookie.getDomain());
        }
    }
    if (responseCookies == null) {
        responseCookies = new TreeMap<>(); //hashmap is slow to allocate in JDK7
    }
    responseCookies.put(cookie.getName(), cookie);
    return this;
}
 

@Override
protected JsonElement handle(HttpServerExchange exchange) throws StatusException {
    Cookie sid = exchange.getRequestCookies().get("PYX-Session");
    User user = null;
    if (sid != null) user = Sessions.get().getUser(sid.getValue());

    Parameters params;
    try {
        params = Parameters.fromExchange(exchange);
    } catch (IOException ex) {
        ex.printStackTrace();
        throw new StatusException(StatusCodes.INTERNAL_SERVER_ERROR, ex);
    }

    String op = params.getStringNotNull(Consts.GeneralKeys.OP);
    if (!Handlers.skipUserCheck(op) && user == null) {
        throw new CahException(Consts.ErrorCode.NOT_REGISTERED);
    } else if (user != null && !user.isValid()) {
        Sessions.get().invalidate(sid.getValue());
        throw new CahException(Consts.ErrorCode.SESSION_EXPIRED);
    } else {
        return handleRequest(op, user, params, exchange);
    }
}
 

protected Host findStickyHost(HttpServerExchange exchange) {
    Map<String, Cookie> cookies = exchange.getRequestCookies();
    for (String cookieName : sessionCookieNames) {
        Cookie sk = cookies.get(cookieName);
        if (sk != null) {
            int index = sk.getValue().indexOf('.');

            if (index == -1) {
                continue;
            }
            String route = sk.getValue().substring(index + 1);
            index = route.indexOf('.');
            if (index != -1) {
                route = route.substring(0, index);
            }
            return routes.get(route);
        }
    }
    return null;
}
 

/**
 * Sets a response cookie
 *
 * @param cookie The cookie
 */
public HttpServerExchange setResponseCookie(final Cookie cookie) {
    if (delegate.getUndertowOptions().get(UndertowOptions.ENABLE_RFC6265_COOKIE_VALIDATION, UndertowOptions.DEFAULT_ENABLE_RFC6265_COOKIE_VALIDATION)) {
        if (cookie.getValue() != null && !cookie.getValue().isEmpty()) {
            Rfc6265CookieSupport.validateCookieValue(cookie.getValue());
        }
        if (cookie.getPath() != null && !cookie.getPath().isEmpty()) {
            Rfc6265CookieSupport.validatePath(cookie.getPath());
        }
        if (cookie.getDomain() != null && !cookie.getDomain().isEmpty()) {
            Rfc6265CookieSupport.validateDomain(cookie.getDomain());
        }
    }
    if (responseCookies == null) {
        responseCookies = new TreeMap<>(); //hashmap is slow to allocate in JDK7
    }
    responseCookies.put(cookie.getName(), cookie);
    return this;
}
 

@Override
public void handleRequest(HttpServerExchange exchange) throws Exception {
    exchange.startBlocking();
    if (exchange.isInIoThread()) {
        exchange.dispatch(this);
        return;
    }

    exchange.getResponseHeaders().add(Headers.CONTENT_TYPE, "application/json");

    Cookie primaryColor = exchange.getRequestCookies().get("PYX-Theme-Primary");
    if (primaryColor == null) {
        exchange.getResponseSender().send(baseManifestString);
    } else {
        JsonObject manifest = baseManifest.deepCopy();
        manifest.addProperty("theme_color", URLDecoder.decode(primaryColor.getValue(), "UTF-8"));
        exchange.getResponseSender().send(manifest.toString());
    }
}
 

@Test
public void testRequestCookieDomainPathVersion() {
    Map<String, Cookie> cookies = Cookies.parseRequestCookies(1, false, Arrays.asList(
            "CUSTOMER=WILE_E_COYOTE; $Domain=LOONEY_TUNES; $Version=1; $Path=/"));

    Assert.assertFalse(cookies.containsKey("$Domain"));
    Assert.assertFalse(cookies.containsKey("$Version"));
    Assert.assertFalse(cookies.containsKey("$Path"));

    Cookie cookie = cookies.get("CUSTOMER");
    Assert.assertEquals("CUSTOMER", cookie.getName());
    Assert.assertEquals("WILE_E_COYOTE", cookie.getValue());
    Assert.assertEquals("LOONEY_TUNES", cookie.getDomain());
    Assert.assertEquals(1, cookie.getVersion());
    Assert.assertEquals("/", cookie.getPath());
}
 

@Override
public void clearSession(final HttpServerExchange exchange, final String sessionId) {
    Cookie cookie = new CookieImpl(cookieName, sessionId)
            .setPath(path)
            .setDomain(domain)
            .setDiscard(discard)
            .setSecure(secure)
            .setHttpOnly(httpOnly)
            .setMaxAge(0);
    exchange.setResponseCookie(cookie);
    UndertowLogger.SESSION_LOGGER.tracef("Clearing session cookie session id %s on %s", sessionId, exchange);
}
 

@Override
public String findSessionId(final HttpServerExchange exchange) {
    Map<String, Cookie> cookies = exchange.getRequestCookies();
    if (cookies != null) {
        Cookie sessionId = cookies.get(cookieName);
        if (sessionId != null) {
            UndertowLogger.SESSION_LOGGER.tracef("Found session cookie session id %s on %s", sessionId, exchange);
            return sessionId.getValue();
        }
    }
    return null;
}
 

@Test
public void testEqualsInValueAllowed() {
    Map<String, Cookie> cookies = Cookies.parseRequestCookies(1, true, Arrays.asList("CUSTOMER=WILE_E_COYOTE=THE_COYOTE"));
    Cookie cookie = cookies.get("CUSTOMER");
    Assert.assertNotNull(cookie);
    Assert.assertEquals("WILE_E_COYOTE=THE_COYOTE", cookie.getValue());
}
 

static Map<String, Cookie> parseRequestCookies(int maxCookies, boolean allowEqualInValue, List<String> cookies, boolean commaIsSeperator) {
    if (cookies == null) {
        return new TreeMap<>();
    }
    final Map<String, Cookie> parsedCookies = new TreeMap<>();

    for (String cookie : cookies) {
        parseCookie(cookie, parsedCookies, maxCookies, allowEqualInValue, commaIsSeperator);
    }
    return parsedCookies;
}
 

static Map<String, Cookie> parseRequestCookies(int maxCookies, boolean allowEqualInValue, List<String> cookies, boolean commaIsSeperator) {
    if (cookies == null) {
        return new TreeMap<>();
    }
    final Map<String, Cookie> parsedCookies = new TreeMap<>();

    for (String cookie : cookies) {
        parseCookie(cookie, parsedCookies, maxCookies, allowEqualInValue, commaIsSeperator);
    }
    return parsedCookies;
}
 

@Override
public Response execute(Request request, Response response) {
    Config config = Application.getInstance(Config.class);
    Cookie cookie = request.getCookie(Default.ADMIN_COOKIE_NAME.toString());
    
    if (cookie != null) {
        String value = cookie.getValue();
        if (StringUtils.isNotBlank(value)) {
            try {
                Paseto paseto = Pasetos.parserBuilder()
                        .setSharedSecret(config.getApplicationSecret().getBytes(StandardCharsets.UTF_8))
                        .build()
                        .parse(value);

                LocalDateTime expiration = LocalDateTime.ofInstant(paseto.getClaims().getExpiration(), ZoneOffset.UTC);

                if (expiration.isAfter(LocalDateTime.now())) {
                    if (paseto.getClaims().containsKey("twofactor") && paseto.getClaims().get("twofactor", Boolean.class)) {
                        return Response.withRedirect("/@admin/twofactor").andEndResponse();
                    }
                    
                    return response;
                }
            } catch (PasetoException e) {
                //NOSONAR Ignore catch
            }
        }
    }
    
    return Response.withRedirect("/@admin/login").andEndResponse();
}
 

@Test
public void testEqualsInValueNotAllowedInQuotedValue() {
    Map<String, Cookie> cookies = Cookies.parseRequestCookies(2, false, Arrays.asList("CUSTOMER=\"WILE_E_COYOTE=THE_COYOTE\"; SHIPPING=FEDEX" ));
    Assert.assertEquals(2, cookies.size());
    Cookie cookie = cookies.get("CUSTOMER");
    Assert.assertNotNull(cookie);
    Assert.assertEquals("WILE_E_COYOTE=THE_COYOTE", cookie.getValue());
    cookie = cookies.get("SHIPPING");
    Assert.assertNotNull(cookie);
    Assert.assertEquals("FEDEX", cookie.getValue());
}
 

/**
 * Retrieves the value of a cookie with a given name from a HttpServerExchange
 * 
 * @param exchange The exchange containing the cookie
 * @param cookieName The name of the cookie
 * 
 * @return The value of the cookie or null if none found
 */
private String getCookieValue(HttpServerExchange exchange, String cookieName) {
    String value = null;
    Map<String, Cookie> requestCookies = exchange.getRequestCookies();
    if (requestCookies != null) {
        Cookie cookie = exchange.getRequestCookies().get(cookieName);
        if (cookie != null) {
            value = cookie.getValue();
        }  
    }

    return value;
}
 

@Test
public void testComplexJSONObjectInRequestCookies() {
    Map<String, Cookie> cookies = Cookies.parseRequestCookies(2, false, Arrays.asList(
            "CUSTOMER={ \"accounting\" : [ { \"firstName\" : \"John\", \"lastName\" : \"Doe\", \"age\" : 23 },"
            + " { \"firstName\" : \"Mary\",  \"lastName\" : \"Smith\", \"age\" : 32 }], "
            + "\"sales\" : [ { \"firstName\" : \"Sally\", \"lastName\" : \"Green\", \"age\" : 27 }, "
            + "{ \"firstName\" : \"Jim\", \"lastName\" : \"Galley\", \"age\" : 41 } ] };"
            + " $Domain=LOONEY_TUNES; $Version=1; $Path=/; SHIPPING=FEDEX"));

    Cookie cookie = cookies.get("CUSTOMER");
    Assert.assertEquals("CUSTOMER", cookie.getName());
    Assert.assertEquals("{ \"accounting\" : [ { \"firstName\" : \"John\", \"lastName\" : \"Doe\", \"age\" : 23 },"
            + " { \"firstName\" : \"Mary\",  \"lastName\" : \"Smith\", \"age\" : 32 }], "
            + "\"sales\" : [ { \"firstName\" : \"Sally\", \"lastName\" : \"Green\", \"age\" : 27 }, "
            + "{ \"firstName\" : \"Jim\", \"lastName\" : \"Galley\", \"age\" : 41 } ] }",
           cookie.getValue());
    Assert.assertEquals("LOONEY_TUNES", cookie.getDomain());
    Assert.assertEquals(1, cookie.getVersion());
    Assert.assertEquals("/", cookie.getPath());

    cookie = cookies.get("SHIPPING");
    Assert.assertEquals("SHIPPING", cookie.getName());
    Assert.assertEquals("FEDEX", cookie.getValue());
    Assert.assertEquals("LOONEY_TUNES", cookie.getDomain());
    Assert.assertEquals(1, cookie.getVersion());
    Assert.assertEquals("/", cookie.getPath());
}
 

/**
 * @return A mutable map of request cookies
 */
public Map<String, Cookie> getRequestCookies() {
    if (requestCookies == null) {
        requestCookies = Cookies.parseRequestCookies(
                getConnection().getUndertowOptions().get(UndertowOptions.MAX_COOKIES, 200),
                getConnection().getUndertowOptions().get(UndertowOptions.ALLOW_EQUALS_IN_COOKIE_VALUE, false),
                requestHeaders.get(Headers.COOKIE));
    }
    return requestCookies;
}
 

@Override
public Cookie setDiscard(boolean discard) {
    if (discard) {
        hc.maxAge(-1);
    }
    return this;
}
 

protected Iterator<CharSequence> parseRoutes(HttpServerExchange exchange) {
    Map<String, Cookie> cookies = exchange.getRequestCookies();
    for (String cookieName : sessionCookieNames) {
        Cookie sessionCookie = cookies.get(cookieName);
        if (sessionCookie != null) {
            return routeIteratorFactory.iterator(sessionCookie.getValue());
        }
    }
    return routeIteratorFactory.iterator(null);
}
 

@Override
public AuthenticationMechanismOutcome authenticate(HttpServerExchange exchange, SecurityContext securityContext) {
    Cookie cookie = exchange.getRequestCookies().get(cookieName);
    if (cookie != null) {
        final String ssoId = cookie.getValue();
        log.tracef("Found SSO cookie %s", ssoId);
        try (SingleSignOn sso = this.singleSignOnManager.findSingleSignOn(ssoId)) {
            if (sso != null) {
                if(log.isTraceEnabled()) {
                    log.tracef("SSO session with ID: %s found.", ssoId);
                }
                Account verified = getIdentityManager(securityContext).verify(sso.getAccount());
                if (verified == null) {
                    if(log.isTraceEnabled()) {
                        log.tracef("Account not found. Returning 'not attempted' here.");
                    }
                    //we return not attempted here to allow other mechanisms to proceed as normal
                    return AuthenticationMechanismOutcome.NOT_ATTEMPTED;
                }
                final Session session = getSession(exchange);
                registerSessionIfRequired(sso, session);
                securityContext.authenticationComplete(verified, sso.getMechanismName(), false);
                securityContext.registerNotificationReceiver(new NotificationReceiver() {
                    @Override
                    public void handleNotification(SecurityNotification notification) {
                        if (notification.getEventType() == SecurityNotification.EventType.LOGGED_OUT) {
                            singleSignOnManager.removeSingleSignOn(sso);
                        }
                    }
                });
                log.tracef("Authenticated account %s using SSO", verified.getPrincipal().getName());
                return AuthenticationMechanismOutcome.AUTHENTICATED;
            }
        }
        clearSsoCookie(exchange);
    }
    exchange.addResponseWrapper(responseListener);
    return AuthenticationMechanismOutcome.NOT_ATTEMPTED;
}
 

private String getSession(HttpServerExchange exchange) {
    for(String header : sessionCookieNames) {
        Cookie cookie = exchange.getRequestCookies().get(header);
        if(cookie != null) {
            return cookie.getValue();
        }
    }
    return null;
}
 

/**
 * impl of dumping response cookies to result
 * @param result A map you want to put dump information to
 */
@Override
public void dumpResponse(Map<String, Object> result) {
    Map<String, Cookie> cookiesMap = exchange.getResponseCookies();
    dumpCookies(cookiesMap, "responseCookies");
    this.putDumpInfoTo(result);
}
 

@Override
public StreamSinkConduit wrap(ConduitFactory<StreamSinkConduit> factory, HttpServerExchange exchange) {

    Map<String, Cookie> cookies = exchange.getResponseCookiesInternal();
    if (cookies != null) {
        Cookie sessionId = cookies.get(sessionCookieName);
        if (sessionId != null) {
            StringBuilder sb = new StringBuilder(sessionId.getValue());
            sb.append('.');
            sb.append(jvmRoute);
            sessionId.setValue(sb.toString());
        }
    }
    return factory.create();
}
 

private static String getCookieString(final Cookie cookie, boolean enableRfc6265Validation) {
    if(enableRfc6265Validation) {
        return addRfc6265ResponseCookieToExchange(cookie);
    } else {
        switch (LegacyCookieSupport.adjustedCookieVersion(cookie)) {
            case 0:
                return addVersion0ResponseCookieToExchange(cookie);
            case 1:
            default:
                return addVersion1ResponseCookieToExchange(cookie);
        }
    }
}
 

/**
 * Adds an additional Cookie to the response which is passed to the client
 *
 * @param cookie The cookie to add
 * @return A response object {@link io.mangoo.routing.Response}
 */
public Response andCookie(Cookie cookie) {
    Objects.requireNonNull(cookie, Required.COOKIE.toString());
    this.cookies.add(cookie);

    return this;
}
 

@Override
public void clearSession(final HttpServerExchange exchange, final String sessionId) {
    Cookie cookie = new CookieImpl(cookieName, sessionId)
            .setPath(path)
            .setDomain(domain)
            .setDiscard(discard)
            .setSecure(secure)
            .setHttpOnly(httpOnly)
            .setMaxAge(0);
    exchange.setResponseCookie(cookie);
    UndertowLogger.SESSION_LOGGER.tracef("Clearing session cookie session id %s on %s", sessionId, exchange);
}