Mercurial > pub > Impl
annotate Lib/IMPL/Web/QueryHandler/SecureCookie.pm @ 95:67eb8eaec3d4
Added a security authority property to the Context and Security classes
Added a WriteResponse method to the SecureCookie class
Added a setCookie method to the Response class
| author | wizard |
|---|---|
| date | Thu, 29 Apr 2010 02:21:27 +0400 |
| parents | 3d1f584aea60 |
| children | 964587c5183c |
| rev | line source |
|---|---|
| 73 | 1 package IMPL::Web::QueryHandler::SecureCookie; |
|
95
67eb8eaec3d4
Added a security authority property to the Context and Security classes
wizard
parents:
89
diff
changeset
|
2 use strict; |
| 68 | 3 |
| 4 use base qw(IMPL::Web::QueryHandler); | |
| 5 use Digest::MD5 qw(md5_hex); | |
| 6 | |
| 7 use IMPL::Class::Property; | |
| 69 | 8 use IMPL::Security::Auth qw(:Const); |
|
95
67eb8eaec3d4
Added a security authority property to the Context and Security classes
wizard
parents:
89
diff
changeset
|
9 use IMPL::Security; |
| 68 | 10 |
| 11 BEGIN { | |
| 12 public property salt => prop_all; | |
| 13 } | |
| 14 | |
| 69 | 15 sub CTOR { |
| 16 my ($this) = @_; | |
| 17 | |
| 75 | 18 $this->salt('DeadBeef') unless $this->salt; |
| 69 | 19 } |
| 20 | |
| 68 | 21 sub Process { |
| 22 my ($this,$action,$nextHandler) = @_; | |
| 23 | |
| 75 | 24 return undef unless $nextHandler; |
| 25 | |
| 68 | 26 my $method = $action->query->cookie('method') || 'simple'; |
| 27 | |
| 28 if ($method eq 'simple') { | |
| 29 | |
| 69 | 30 my $sid = $action->query->cookie('sid'); |
| 75 | 31 my $cookie = $action->query->cookie('sdata'); |
| 32 my $sign = $action->query->cookie('sign'); | |
| 69 | 33 |
| 75 | 34 if ( |
| 35 $sid and | |
| 36 $cookie and | |
| 37 $sign and | |
| 38 $sign eq md5_hex( | |
| 39 $this->salt, | |
| 40 $sid, | |
| 41 $cookie, | |
| 42 $this->salt | |
| 43 ) | |
| 44 ) { | |
|
95
67eb8eaec3d4
Added a security authority property to the Context and Security classes
wizard
parents:
89
diff
changeset
|
45 local $IMPL::Security::authority = $this; |
| 68 | 46 |
| 89 | 47 my $context = $action->application->security->sourceSession->find( |
| 48 { id => $sid } | |
| 49 ) or return $nextHandler->(); | |
| 69 | 50 |
| 74 | 51 my ($result,$challenge) = $context->auth->ValidateSession($cookie); |
| 68 | 52 |
| 69 | 53 if ($result == AUTH_SUCCESS) { |
|
95
67eb8eaec3d4
Added a security authority property to the Context and Security classes
wizard
parents:
89
diff
changeset
|
54 $context->authority($this); |
| 69 | 55 return $context->Impersonate($nextHandler); |
| 56 } else { | |
| 57 return $nextHandler->(); | |
| 58 } | |
| 68 | 59 } |
| 60 } else { | |
| 61 die new IMPL::Exception("Unknown auth method",$method); | |
| 62 } | |
| 63 } | |
| 64 | |
|
95
67eb8eaec3d4
Added a security authority property to the Context and Security classes
wizard
parents:
89
diff
changeset
|
65 sub WriteResponse { |
|
67eb8eaec3d4
Added a security authority property to the Context and Security classes
wizard
parents:
89
diff
changeset
|
66 my ($this,$response,$sid,$cookie,$method) = @_; |
|
67eb8eaec3d4
Added a security authority property to the Context and Security classes
wizard
parents:
89
diff
changeset
|
67 |
|
67eb8eaec3d4
Added a security authority property to the Context and Security classes
wizard
parents:
89
diff
changeset
|
68 my $sign = md5_hex( |
|
67eb8eaec3d4
Added a security authority property to the Context and Security classes
wizard
parents:
89
diff
changeset
|
69 $this->salt, |
|
67eb8eaec3d4
Added a security authority property to the Context and Security classes
wizard
parents:
89
diff
changeset
|
70 $sid, |
|
67eb8eaec3d4
Added a security authority property to the Context and Security classes
wizard
parents:
89
diff
changeset
|
71 $cookie, |
|
67eb8eaec3d4
Added a security authority property to the Context and Security classes
wizard
parents:
89
diff
changeset
|
72 $this->salt |
|
67eb8eaec3d4
Added a security authority property to the Context and Security classes
wizard
parents:
89
diff
changeset
|
73 ); |
|
67eb8eaec3d4
Added a security authority property to the Context and Security classes
wizard
parents:
89
diff
changeset
|
74 |
|
67eb8eaec3d4
Added a security authority property to the Context and Security classes
wizard
parents:
89
diff
changeset
|
75 $this->setCookie(sid => $sid); |
|
67eb8eaec3d4
Added a security authority property to the Context and Security classes
wizard
parents:
89
diff
changeset
|
76 $this->setCookie(sdata => $cookie); |
|
67eb8eaec3d4
Added a security authority property to the Context and Security classes
wizard
parents:
89
diff
changeset
|
77 $this->setCookie(sign => $sign); |
|
67eb8eaec3d4
Added a security authority property to the Context and Security classes
wizard
parents:
89
diff
changeset
|
78 $this->setCookie(method => $method) if $method; |
|
67eb8eaec3d4
Added a security authority property to the Context and Security classes
wizard
parents:
89
diff
changeset
|
79 } |
|
67eb8eaec3d4
Added a security authority property to the Context and Security classes
wizard
parents:
89
diff
changeset
|
80 |
| 75 | 81 1; |
| 68 | 82 |
| 75 | 83 __END__ |
| 84 | |
| 85 =pod | |
| 86 | |
| 87 =head1 NAME | |
| 88 | |
| 89 C<IMPL::Web::QueryHandler::SecureCookie> | |
| 90 | |
| 91 =head1 DESCRIPTION | |
| 92 | |
| 93 C<use base qw(IMPL::Web::QueryHandler)> | |
| 94 | |
| 95 Возобновляет сессию пользователя на основе информации переданной через Cookie. | |
| 96 | |
| 97 Использует механизм подписи информации для проверки верности входных данных перед | |
| 98 началом каких-либо действий. | |
| 99 | |
| 100 Данный обработчик возвращает результат выполнения следдующего обработчика. | |
| 101 | |
| 102 =head1 MEMBERS | |
| 103 | |
| 104 =over | |
| 105 | |
| 106 =item C<[get,set] salt> | |
| 107 | |
| 108 Скаляр, использующийся для подписи данных. | |
| 109 | |
| 110 =back | |
| 111 | |
| 112 =cut |