|
230
|
1 package IMPL::Web::Handler::SecureCookie;
|
|
196
|
2 use strict;
|
|
|
3
|
|
230
|
4
|
|
196
|
5 use Digest::MD5 qw(md5_hex);
|
|
230
|
6 use IMPL::Const qw(:prop);
|
|
|
7 use IMPL::Security::Auth qw(:Const GenSSID);
|
|
|
8 use IMPL::declare {
|
|
|
9 require => {
|
|
|
10 SecurityContext => 'IMPL::Security::Context',
|
|
238
|
11 User => 'IMPL::Security::Principal',
|
|
230
|
12 AuthSimple => 'IMPL::Security::Auth::Simple',
|
|
231
|
13 Exception => 'IMPL::Exception',
|
|
|
14 OperationException => '-IMPL::InvalidOperationException',
|
|
|
15 HttpResponse => '-IMPL::Web::HttpResponse'
|
|
230
|
16 },
|
|
|
17 base => {
|
|
|
18 'IMPL::Object' => undef,
|
|
|
19 'IMPL::Object::Autofill' => '@_',
|
|
|
20 'IMPL::Object::Serializable' => undef
|
|
|
21 },
|
|
|
22 props => [
|
|
|
23 salt => PROP_RO,
|
|
238
|
24 _manager => PROP_RO,
|
|
230
|
25 _cookies => PROP_RW
|
|
|
26 ]
|
|
|
27 };
|
|
196
|
28
|
|
|
29 sub CTOR {
|
|
|
30 my ($this) = @_;
|
|
|
31
|
|
|
32 $this->salt('DeadBeef') unless $this->salt;
|
|
|
33 }
|
|
|
34
|
|
262
|
35 sub ValidateCookie {
|
|
|
36 my ($this,$sid,$cookie,$sign) = @_;
|
|
|
37
|
|
|
38 return 1 if $sid and $cookie and $sign and $sign eq md5_hex($this->salt,$sid,$cookie,$this->salt);
|
|
|
39
|
|
|
40 return 0;
|
|
|
41 }
|
|
|
42
|
|
263
|
43 sub AuthCookie {
|
|
|
44 my ($this,$sid,$cookie,$sign, $context) = @_;
|
|
|
45
|
|
|
46 if (eval { $context->auth->isa(AuthSimple) }) {
|
|
|
47 my ($result,$challenge) = $context->auth->DoAuth($cookie);
|
|
|
48 return $result;
|
|
|
49 }
|
|
|
50
|
|
|
51 return AUTH_FAIL;
|
|
|
52 }
|
|
|
53
|
|
230
|
54 sub Invoke {
|
|
196
|
55 my ($this,$action,$nextHandler) = @_;
|
|
|
56
|
|
230
|
57 return unless $nextHandler;
|
|
|
58
|
|
|
59 my $context;
|
|
238
|
60 $this->_manager($action->application->security);
|
|
196
|
61
|
|
230
|
62
|
|
|
63 my $sid = $action->cookie('sid',qr/(\w+)/);
|
|
|
64 my $cookie = $action->cookie('sdata',qr/(\w+)/);
|
|
239
|
65 my $sign = $action->cookie('sign',qw/(\w+)/);
|
|
196
|
66
|
|
262
|
67 if ( $this->ValidateCookie($sid,$cookie,$sign) ) {
|
|
230
|
68 # TODO: add a DefferedProxy to deffer a request to a data source
|
|
238
|
69 if ( $context = $this->_manager->GetSession($sid) ) {
|
|
230
|
70 if ( eval { $context->auth->isa(AuthSimple) } ) {
|
|
|
71 my ($result,$challenge) = $context->auth->DoAuth($cookie);
|
|
239
|
72
|
|
|
73 $context->authority($this);
|
|
|
74
|
|
230
|
75 if ($result == AUTH_FAIL) {
|
|
|
76 $context = undef;
|
|
|
77 }
|
|
239
|
78 } else {
|
|
|
79 undef $context;
|
|
196
|
80 }
|
|
|
81 }
|
|
230
|
82
|
|
196
|
83 }
|
|
230
|
84
|
|
231
|
85 $context ||= SecurityContext->new(principal => User->nobody, authority => $this);
|
|
230
|
86
|
|
238
|
87 my $httpResponse = $context->Impersonate($nextHandler,$action);
|
|
230
|
88
|
|
231
|
89 die OperationException->new("A HttpResponse instance is expected")
|
|
|
90 unless ref $httpResponse && eval { $httpResponse->isa(HttpResponse) };
|
|
230
|
91
|
|
231
|
92 return $this->WriteResponse($httpResponse);
|
|
230
|
93 }
|
|
|
94
|
|
231
|
95 sub InitSession {
|
|
239
|
96 my ($this,$user,$roles,$auth,$challenge) = @_;
|
|
230
|
97
|
|
254
|
98 my ($status,$answer);
|
|
|
99
|
|
|
100 if ($auth) {
|
|
|
101 ($status,$answer) = $auth->DoAuth($challenge);
|
|
|
102 } else {
|
|
|
103 $status = AUTH_SUCCESS;
|
|
|
104 }
|
|
239
|
105
|
|
|
106 die OperationException->new("This provider doesn't support multiround auth")
|
|
|
107 if ($status == AUTH_INCOMPLETE || $answer);
|
|
230
|
108
|
|
239
|
109 if ($status == AUTH_SUCCESS) {
|
|
|
110 my $sid = GenSSID();
|
|
|
111 my $cookie = GenSSID();
|
|
|
112
|
|
|
113 $this->_cookies({
|
|
|
114 sid => $sid,
|
|
|
115 sdata => $cookie
|
|
|
116 });
|
|
|
117
|
|
|
118 my $context = $this->_manager->CreateSession(
|
|
|
119 sessionId => $sid,
|
|
|
120 principal => $user,
|
|
|
121 auth => AuthSimple->Create(password => $cookie),
|
|
|
122 authority => $this,
|
|
|
123 rolesAssigned => $roles
|
|
|
124 );
|
|
|
125
|
|
|
126 $context->Apply();
|
|
|
127
|
|
|
128 }
|
|
|
129
|
|
|
130 return $status;
|
|
|
131 }
|
|
230
|
132
|
|
239
|
133 sub CloseSession {
|
|
|
134 my ($this) = @_;
|
|
|
135 if(my $session = SecurityContext->current) {
|
|
|
136 $this->_cookies({
|
|
|
137 sid => undef,
|
|
|
138 sdata => undef
|
|
|
139 })
|
|
|
140 }
|
|
196
|
141 }
|
|
|
142
|
|
|
143 sub WriteResponse {
|
|
230
|
144 my ($this,$response) = @_;
|
|
|
145
|
|
238
|
146 if (my $data = $this->_cookies) {
|
|
196
|
147
|
|
239
|
148 my $sign = $data->{sid} && md5_hex(
|
|
230
|
149 $this->salt,
|
|
|
150 $data->{sid},
|
|
|
151 $data->{sdata},
|
|
|
152 $this->salt
|
|
|
153 );
|
|
|
154
|
|
|
155 $response->cookies->{sid} = $data->{sid};
|
|
|
156 $response->cookies->{sdata} = $data->{sdata};
|
|
|
157 $response->cookies->{sign} = $sign;
|
|
|
158 }
|
|
231
|
159
|
|
|
160 return $response;
|
|
196
|
161 }
|
|
|
162
|
|
|
163 1;
|
|
|
164
|
|
|
165 __END__
|
|
|
166
|
|
|
167 =pod
|
|
|
168
|
|
|
169 =head1 NAME
|
|
|
170
|
|
230
|
171 C<IMPL::Web::Handler::SecureCookie>
|
|
196
|
172
|
|
|
173 =head1 DESCRIPTION
|
|
|
174
|
|
|
175 Возобновляет сессию пользователя на основе информации переданной через Cookie.
|
|
|
176
|
|
|
177 Использует механизм подписи информации для проверки верности входных данных перед
|
|
|
178 началом каких-либо действий.
|
|
|
179
|
|
|
180 Данный обработчик возвращает результат выполнения следдующего обработчика.
|
|
|
181
|
|
230
|
182
|
|
|
183
|
|
196
|
184 =head1 MEMBERS
|
|
|
185
|
|
231
|
186 =head2 C<[get,set] salt>
|
|
196
|
187
|
|
|
188 Скаляр, использующийся для подписи данных.
|
|
|
189
|
|
233
|
190
|
|
254
|
191 =head2 C<InitSession($user,$roles,$auth,$challenge)>
|
|
|
192
|
|
|
193 Инициирует сессию, поскольку данный модуль отвечает за взаимодействие с клиентом
|
|
|
194 при проверки аутентификации, ему передаются данные аутентификации для
|
|
|
195 продолжения обмена данными с клиентом. Если создается новая сессия, по
|
|
|
196 инициативе веб-приложения, то C<$auth> должно быть пусто.
|
|
196
|
197
|
|
|
198 =cut
|
