Java WebContext.getSessionAttribute方法代码示例

import org.pac4j.core.context.WebContext; //导入方法依赖的package包/类
/**
 * <p>Get the redirectAction computed for this client. All the logic is encapsulated here. It should not be called be directly, the
 * {@link #redirect(WebContext)} should be generally called instead.</p>
 * <p>If an authentication has already been tried for this client and has failed (<code>null</code> credentials) or if the request is an AJAX one,
 * an authorized response (401 HTTP status code) is returned instead of a redirection.</p>
 *
 * @param context context
 * @return the redirection action
 * @throws HttpAction requires an additional HTTP action
 */
public final RedirectAction getRedirectAction(final WebContext context) throws HttpAction {
    init(context);

    // it's an AJAX request -> unauthorized (instead of a redirection)
    if (ajaxRequestResolver.isAjax(context)) {
        logger.info("AJAX request detected -> returning 401");
        cleanRequestedUrl(context);
        throw HttpAction.unauthorized("AJAX request -> 401", context, null);
    }
    // authentication has already been tried -> unauthorized
    final String attemptedAuth = (String) context.getSessionAttribute(getName() + ATTEMPTED_AUTHENTICATION_SUFFIX);
    if (CommonHelper.isNotBlank(attemptedAuth)) {
        cleanAttemptedAuthentication(context);
        cleanRequestedUrl(context);
        throw HttpAction.unauthorized("authentication already tried -> forbidden", context, null);
    }

    return retrieveRedirectAction(context);
}
 

import org.pac4j.core.context.WebContext; //导入方法依赖的package包/类
@Override
protected OAuthCredentials getOAuthCredentials(final WebContext context) throws HttpAction {
    final String tokenParameter = context.getRequestParameter(OAUTH_TOKEN);
    final String verifierParameter = context.getRequestParameter(OAUTH_VERIFIER);
    if (tokenParameter != null && verifierParameter != null) {
        // get request token from session
        final OAuth1RequestToken tokenSession = (OAuth1RequestToken) context.getSessionAttribute(getRequestTokenSessionAttributeName());
        logger.debug("tokenRequest: {}", tokenSession);
        final String token = OAuthEncoder.decode(tokenParameter);
        final String verifier = OAuthEncoder.decode(verifierParameter);
        logger.debug("token: {} / verifier: {}", token, verifier);
        return new OAuth10Credentials(tokenSession, token, verifier, getName());
    } else {
        final String message = "No credential found";
        throw new OAuthCredentialsException(message);
    }
}
 

import org.pac4j.core.context.WebContext; //导入方法依赖的package包/类
@Override
protected OpenIdCredentials retrieveCredentials(final WebContext context) throws HttpAction {
    final String mode = context.getRequestParameter(OPENID_MODE);
    // cancelled authentication
    if (CommonHelper.areEquals(mode, CANCEL_MODE)) {
        logger.debug("authentication cancelled");
        return null;
    }

    // parameters list returned by the provider
    final ParameterList parameterList = new ParameterList(context.getRequestParameters());

    // retrieve the previously stored discovery information
    final DiscoveryInformation discoveryInformation = (DiscoveryInformation) context
            .getSessionAttribute(getDiscoveryInformationSessionAttributeName());

    // create credentials
    final OpenIdCredentials credentials = new OpenIdCredentials(discoveryInformation, parameterList, getName());
    logger.debug("credentials: {}", credentials);
    return credentials;
}
 

import org.pac4j.core.context.WebContext; //导入方法依赖的package包/类
@Override
public String get(final WebContext context) {
    String token = (String) context.getSessionAttribute(Pac4jConstants.CSRF_TOKEN);
    if (token == null) {
        synchronized (this) {
            token = (String) context.getSessionAttribute(Pac4jConstants.CSRF_TOKEN);
            if (token == null) {
                token = java.util.UUID.randomUUID().toString();
                context.setSessionAttribute(Pac4jConstants.CSRF_TOKEN, token);
            }
        }
    }
    return token;
}
 

import org.pac4j.core.context.WebContext; //导入方法依赖的package包/类
@Override
public boolean isAuthorized(final WebContext context, final List<CommonProfile> profiles) throws HttpAction {
    final boolean checkRequest = !onlyCheckPostRequest || ContextHelper.isPost(context);
    if (checkRequest) {
        final String parameterToken = context.getRequestParameter(parameterName);
        final String headerToken = context.getRequestHeader(headerName);
        final String sessionToken = (String) context.getSessionAttribute(Pac4jConstants.CSRF_TOKEN);
        return sessionToken != null && (sessionToken.equals(parameterToken) || sessionToken.equals(headerToken));
    } else {
        return true;
    }
}
 

import org.pac4j.core.context.WebContext; //导入方法依赖的package包/类
@Override
protected String getStateParameter(final WebContext webContext) {
    final String relayState = (String) webContext.getSessionAttribute(SAML_RELAY_STATE_ATTRIBUTE);
    // clean from session after retrieving it
    webContext.setSessionAttribute(SAML_RELAY_STATE_ATTRIBUTE, "");
    return (relayState == null) ? computeFinalCallbackUrl(webContext) : relayState;
}
 

import org.pac4j.core.context.WebContext; //导入方法依赖的package包/类
@Override
@SuppressWarnings("unchecked")
public U create(final OidcCredentials credentials, final WebContext context) throws HttpAction {
    init(context);

    final AccessToken accessToken = credentials.getAccessToken();

    // Create profile
    final U profile = getProfileFactory().get();
    profile.setAccessToken(accessToken);
    final JWT idToken = credentials.getIdToken();
    profile.setIdTokenString(idToken.getParsedString());
    // Check if there is a refresh token
    final RefreshToken refreshToken = credentials.getRefreshToken();
    if (refreshToken != null && !refreshToken.getValue().isEmpty()) {
        profile.setRefreshToken(refreshToken);
        logger.debug("Refresh Token successful retrieved");
    }

    try {

        // check idToken
        final Nonce nonce;
        if (configuration.isUseNonce()) {
            nonce = new Nonce((String) context.getSessionAttribute(OidcConfiguration.NONCE_SESSION_ATTRIBUTE));
        } else {
            nonce = null;
        }
        // Check ID Token
        final IDTokenClaimsSet claimsSet = this.idTokenValidator.validate(idToken, nonce);
        assertNotNull("claimsSet", claimsSet);
        profile.setId(claimsSet.getSubject());

        // User Info request
        if (configuration.getProviderMetadata().getUserInfoEndpointURI() != null && accessToken != null) {
            final UserInfoRequest userInfoRequest = new UserInfoRequest(configuration.getProviderMetadata().getUserInfoEndpointURI(), (BearerAccessToken) accessToken);
            final HTTPRequest userInfoHttpRequest = userInfoRequest.toHTTPRequest();
            userInfoHttpRequest.setConnectTimeout(configuration.getConnectTimeout());
            userInfoHttpRequest.setReadTimeout(configuration.getReadTimeout());
            final HTTPResponse httpResponse = userInfoHttpRequest.send();
            logger.debug("Token response: status={}, content={}", httpResponse.getStatusCode(),
                    httpResponse.getContent());

            final UserInfoResponse userInfoResponse = UserInfoResponse.parse(httpResponse);
            if (userInfoResponse instanceof UserInfoErrorResponse) {
                logger.error("Bad User Info response, error={}",
                        ((UserInfoErrorResponse) userInfoResponse).getErrorObject());
            } else {
                final UserInfoSuccessResponse userInfoSuccessResponse = (UserInfoSuccessResponse) userInfoResponse;
                final UserInfo userInfo = userInfoSuccessResponse.getUserInfo();
                if (userInfo != null) {
                    profile.addAttributes(userInfo.toJWTClaimsSet().getClaims());
                }
            }
        }

        // add attributes of the ID token if they don't already exist
        for (final Map.Entry<String, Object> entry : idToken.getJWTClaimsSet().getClaims().entrySet()) {
            final String key = entry.getKey();
            final Object value = entry.getValue();
            if (profile.getAttribute(key) == null) {
                profile.addAttribute(key, value);
            }
        }

        return profile;

    } catch (final IOException | ParseException | JOSEException | BadJOSEException | java.text.ParseException e) {
        throw new TechnicalException(e);
    }
}