Mercurial > pub > Impl
annotate Lib/IMPL/Web/QueryHandler/SecureCookie.pm @ 158:a9f4ba4783eb
Minor changes
| author | wizard |
|---|---|
| date | Tue, 02 Nov 2010 20:17:22 +0300 |
| parents | 964587c5183c |
| children | 4267a2ac3d46 |
| rev | line source |
|---|---|
| 73 | 1 package IMPL::Web::QueryHandler::SecureCookie; |
|
95
67eb8eaec3d4
Added a security authority property to the Context and Security classes
wizard
parents:
89
diff
changeset
|
2 use strict; |
| 68 | 3 |
| 4 use base qw(IMPL::Web::QueryHandler); | |
| 5 use Digest::MD5 qw(md5_hex); | |
| 6 | |
| 7 use IMPL::Class::Property; | |
| 69 | 8 use IMPL::Security::Auth qw(:Const); |
|
95
67eb8eaec3d4
Added a security authority property to the Context and Security classes
wizard
parents:
89
diff
changeset
|
9 use IMPL::Security; |
| 68 | 10 |
| 11 BEGIN { | |
| 12 public property salt => prop_all; | |
| 13 } | |
| 14 | |
| 69 | 15 sub CTOR { |
| 16 my ($this) = @_; | |
| 17 | |
| 75 | 18 $this->salt('DeadBeef') unless $this->salt; |
| 69 | 19 } |
| 20 | |
| 68 | 21 sub Process { |
| 22 my ($this,$action,$nextHandler) = @_; | |
| 23 | |
| 75 | 24 return undef unless $nextHandler; |
| 25 | |
| 97 | 26 local $IMPL::Security::authority = $this; |
| 27 | |
| 68 | 28 my $method = $action->query->cookie('method') || 'simple'; |
| 29 | |
| 30 if ($method eq 'simple') { | |
| 31 | |
| 69 | 32 my $sid = $action->query->cookie('sid'); |
| 75 | 33 my $cookie = $action->query->cookie('sdata'); |
| 34 my $sign = $action->query->cookie('sign'); | |
| 69 | 35 |
| 75 | 36 if ( |
| 37 $sid and | |
| 38 $cookie and | |
| 39 $sign and | |
| 40 $sign eq md5_hex( | |
| 41 $this->salt, | |
| 42 $sid, | |
| 43 $cookie, | |
| 44 $this->salt | |
| 45 ) | |
| 46 ) { | |
| 158 | 47 # TODO: add a DefferedProxy to deffer a request to a data source |
| 89 | 48 my $context = $action->application->security->sourceSession->find( |
| 49 { id => $sid } | |
| 50 ) or return $nextHandler->(); | |
| 69 | 51 |
| 74 | 52 my ($result,$challenge) = $context->auth->ValidateSession($cookie); |
| 68 | 53 |
| 69 | 54 if ($result == AUTH_SUCCESS) { |
|
95
67eb8eaec3d4
Added a security authority property to the Context and Security classes
wizard
parents:
89
diff
changeset
|
55 $context->authority($this); |
| 69 | 56 return $context->Impersonate($nextHandler); |
| 57 } else { | |
| 58 return $nextHandler->(); | |
| 59 } | |
| 97 | 60 } else { |
| 61 return $nextHandler->(); | |
| 68 | 62 } |
| 63 } else { | |
| 97 | 64 return $nextHandler->(); |
| 68 | 65 } |
| 66 } | |
| 67 | |
|
95
67eb8eaec3d4
Added a security authority property to the Context and Security classes
wizard
parents:
89
diff
changeset
|
68 sub WriteResponse { |
|
67eb8eaec3d4
Added a security authority property to the Context and Security classes
wizard
parents:
89
diff
changeset
|
69 my ($this,$response,$sid,$cookie,$method) = @_; |
|
67eb8eaec3d4
Added a security authority property to the Context and Security classes
wizard
parents:
89
diff
changeset
|
70 |
|
67eb8eaec3d4
Added a security authority property to the Context and Security classes
wizard
parents:
89
diff
changeset
|
71 my $sign = md5_hex( |
|
67eb8eaec3d4
Added a security authority property to the Context and Security classes
wizard
parents:
89
diff
changeset
|
72 $this->salt, |
|
67eb8eaec3d4
Added a security authority property to the Context and Security classes
wizard
parents:
89
diff
changeset
|
73 $sid, |
|
67eb8eaec3d4
Added a security authority property to the Context and Security classes
wizard
parents:
89
diff
changeset
|
74 $cookie, |
|
67eb8eaec3d4
Added a security authority property to the Context and Security classes
wizard
parents:
89
diff
changeset
|
75 $this->salt |
|
67eb8eaec3d4
Added a security authority property to the Context and Security classes
wizard
parents:
89
diff
changeset
|
76 ); |
|
67eb8eaec3d4
Added a security authority property to the Context and Security classes
wizard
parents:
89
diff
changeset
|
77 |
| 97 | 78 $response->setCookie(sid => $sid); |
| 79 $response->setCookie(sdata => $cookie); | |
| 80 $response->setCookie(sign => $sign); | |
| 81 $response->setCookie(method => $method) if $method; | |
|
95
67eb8eaec3d4
Added a security authority property to the Context and Security classes
wizard
parents:
89
diff
changeset
|
82 } |
|
67eb8eaec3d4
Added a security authority property to the Context and Security classes
wizard
parents:
89
diff
changeset
|
83 |
| 75 | 84 1; |
| 68 | 85 |
| 75 | 86 __END__ |
| 87 | |
| 88 =pod | |
| 89 | |
| 90 =head1 NAME | |
| 91 | |
| 92 C<IMPL::Web::QueryHandler::SecureCookie> | |
| 93 | |
| 94 =head1 DESCRIPTION | |
| 95 | |
| 96 C<use base qw(IMPL::Web::QueryHandler)> | |
| 97 | |
| 98 Возобновляет сессию пользователя на основе информации переданной через Cookie. | |
| 99 | |
| 100 Использует механизм подписи информации для проверки верности входных данных перед | |
| 101 началом каких-либо действий. | |
| 102 | |
| 103 Данный обработчик возвращает результат выполнения следдующего обработчика. | |
| 104 | |
| 105 =head1 MEMBERS | |
| 106 | |
| 107 =over | |
| 108 | |
| 109 =item C<[get,set] salt> | |
| 110 | |
| 111 Скаляр, использующийся для подписи данных. | |
| 112 | |
| 113 =back | |
| 114 | |
| 115 =cut |