|
230
|
1 package IMPL::Web::Handler::SecureCookie;
|
|
196
|
2 use strict;
|
|
|
3
|
|
230
|
4
|
|
196
|
5 use Digest::MD5 qw(md5_hex);
|
|
230
|
6 use IMPL::Const qw(:prop);
|
|
|
7 use IMPL::Security::Auth qw(:Const GenSSID);
|
|
|
8 use IMPL::declare {
|
|
|
9 require => {
|
|
|
10 SecurityContext => 'IMPL::Security::Context',
|
|
|
11 User => 'IMPL::Security::User',
|
|
|
12 AuthSimple => 'IMPL::Security::Auth::Simple',
|
|
231
|
13 Exception => 'IMPL::Exception',
|
|
|
14 OperationException => '-IMPL::InvalidOperationException',
|
|
|
15 HttpResponse => '-IMPL::Web::HttpResponse'
|
|
230
|
16 },
|
|
|
17 base => {
|
|
|
18 'IMPL::Object' => undef,
|
|
|
19 'IMPL::Object::Autofill' => '@_',
|
|
|
20 'IMPL::Object::Serializable' => undef
|
|
|
21 },
|
|
|
22 props => [
|
|
|
23 salt => PROP_RO,
|
|
|
24 manager => PROP_RO,
|
|
|
25 _cookies => PROP_RW
|
|
|
26 ]
|
|
|
27 };
|
|
196
|
28
|
|
|
29 sub CTOR {
|
|
|
30 my ($this) = @_;
|
|
|
31
|
|
|
32 $this->salt('DeadBeef') unless $this->salt;
|
|
|
33 }
|
|
|
34
|
|
230
|
35 sub Invoke {
|
|
196
|
36 my ($this,$action,$nextHandler) = @_;
|
|
|
37
|
|
230
|
38 return unless $nextHandler;
|
|
|
39
|
|
|
40 my $context;
|
|
196
|
41
|
|
230
|
42
|
|
|
43 my $sid = $action->cookie('sid',qr/(\w+)/);
|
|
|
44 my $cookie = $action->cookie('sdata',qr/(\w+)/);
|
|
|
45 my $sign = $action->cookie('sign',qw/(\w+)/);
|
|
196
|
46
|
|
230
|
47 if (
|
|
|
48 $sid and
|
|
|
49 $cookie and
|
|
|
50 $sign and
|
|
|
51 $sign eq md5_hex(
|
|
|
52 $this->salt,
|
|
|
53 $sid,
|
|
|
54 $cookie,
|
|
|
55 $this->salt
|
|
|
56 )
|
|
|
57 ) {
|
|
|
58 # TODO: add a DefferedProxy to deffer a request to a data source
|
|
|
59 if ( $context = $this->manager->GetSession($sid) ) {
|
|
196
|
60
|
|
230
|
61 if ( eval { $context->auth->isa(AuthSimple) } ) {
|
|
|
62 my ($result,$challenge) = $context->auth->DoAuth($cookie);
|
|
|
63
|
|
|
64 $action->manager->SaveSession($context);
|
|
|
65
|
|
|
66 if ($result == AUTH_FAIL) {
|
|
|
67 $context = undef;
|
|
|
68 }
|
|
196
|
69 }
|
|
|
70 }
|
|
230
|
71
|
|
196
|
72 }
|
|
230
|
73
|
|
231
|
74 $context ||= SecurityContext->new(principal => User->nobody, authority => $this);
|
|
230
|
75
|
|
|
76 my $httpResponse = $context->Impersonate($nextHandler);
|
|
|
77
|
|
231
|
78 die OperationException->new("A HttpResponse instance is expected")
|
|
|
79 unless ref $httpResponse && eval { $httpResponse->isa(HttpResponse) };
|
|
230
|
80
|
|
231
|
81 return $this->WriteResponse($httpResponse);
|
|
230
|
82 }
|
|
|
83
|
|
231
|
84 sub InitSession {
|
|
230
|
85 my ($this,$user,$auth,$roles) = @_;
|
|
|
86
|
|
|
87 my $sid = GenSSID();
|
|
|
88 my $cookie = GenSSID();
|
|
|
89
|
|
|
90 $this->_cookies({
|
|
|
91 sid => $sid,
|
|
|
92 sdata => $cookie
|
|
|
93 })
|
|
|
94
|
|
|
95 my $context = $this->$manager->CreateSession(
|
|
|
96 sessionId => $sid,
|
|
|
97 principal => $user,
|
|
233
|
98 auth => AuthSimple->Create(password => $cookie),
|
|
230
|
99 authority => $this,
|
|
|
100 assignedRoles => $roles
|
|
|
101 );
|
|
|
102
|
|
|
103 $context->Apply();
|
|
|
104
|
|
|
105 return $context;
|
|
196
|
106 }
|
|
|
107
|
|
|
108 sub WriteResponse {
|
|
230
|
109 my ($this,$response) = @_;
|
|
|
110
|
|
|
111 if (my $data $this->_cookies) {
|
|
196
|
112
|
|
230
|
113 my $sign = md5_hex(
|
|
|
114 $this->salt,
|
|
|
115 $data->{sid},
|
|
|
116 $data->{sdata},
|
|
|
117 $this->salt
|
|
|
118 );
|
|
|
119
|
|
|
120 $response->cookies->{sid} = $data->{sid};
|
|
|
121 $response->cookies->{sdata} = $data->{sdata};
|
|
|
122 $response->cookies->{sign} = $sign;
|
|
|
123 }
|
|
231
|
124
|
|
|
125 return $response;
|
|
196
|
126 }
|
|
|
127
|
|
|
128 1;
|
|
|
129
|
|
|
130 __END__
|
|
|
131
|
|
|
132 =pod
|
|
|
133
|
|
|
134 =head1 NAME
|
|
|
135
|
|
230
|
136 C<IMPL::Web::Handler::SecureCookie>
|
|
196
|
137
|
|
|
138 =head1 DESCRIPTION
|
|
|
139
|
|
|
140 Возобновляет сессию пользователя на основе информации переданной через Cookie.
|
|
|
141
|
|
|
142 Использует механизм подписи информации для проверки верности входных данных перед
|
|
|
143 началом каких-либо действий.
|
|
|
144
|
|
|
145 Данный обработчик возвращает результат выполнения следдующего обработчика.
|
|
|
146
|
|
230
|
147
|
|
|
148
|
|
196
|
149 =head1 MEMBERS
|
|
|
150
|
|
231
|
151 =head2 C<[get,set] salt>
|
|
196
|
152
|
|
|
153 Скаляр, использующийся для подписи данных.
|
|
|
154
|
|
233
|
155 =head2 C<[get,set] manager>
|
|
|
156
|
|
|
157 Реализация менеджера безопасности, отвечающая за реализацию взаимодействия с
|
|
|
158 моделью безопасности.
|
|
|
159
|
|
231
|
160 =head2 C<InitSession($user,$auth,$roles)>
|
|
196
|
161
|
|
|
162 =cut
|
