Class CookiePriorToLoginPersistence

java.lang.Object

io.micronaut.security.errors.CookiePriorToLoginPersistence

All Implemented Interfaces:

PriorToLoginPersistence<io.micronaut.http.HttpRequest<?>, io.micronaut.http.MutableHttpResponse<?>>

@Requires(classes=io.micronaut.http.HttpRequest.class) @Requires(property="micronaut.security.redirect.prior-to-login",value="true")
@Singleton
public class CookiePriorToLoginPersistence
extends Object
implements PriorToLoginPersistence<io.micronaut.http.HttpRequest<?>, io.micronaut.http.MutableHttpResponse<?>>

Stores the last unauthorized URL in a cookie to redirect back to after logging in.

Only the path and query of the unauthorized request are persisted, and only a local path (one that starts with a single /) is ever returned by getOriginalUri(HttpRequest, MutableHttpResponse). A request line such as GET ///evil.example/x or a planted cookie must not turn the post-login redirect into a redirect to another host (CWE-601).

Since:

2.0.0

Author:

James Kleeh

Constructor Summary

Constructors

Constructor	Description
CookiePriorToLoginPersistence(@Nullable TokenCookieConfiguration cookieConfiguration)

Method Summary

Modifier and Type	Method	Description
protected void	configure(io.micronaut.http.cookie.Cookie cookie, io.micronaut.http.HttpRequest<?> request)	Configure the cookie.
Optional<URI>	getOriginalUri(io.micronaut.http.HttpRequest<?> request, io.micronaut.http.MutableHttpResponse<?> response)
void	onUnauthorized(io.micronaut.http.HttpRequest<?> request, io.micronaut.http.MutableHttpResponse<?> response)

Methods inherited from class Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

CookiePriorToLoginPersistence

public CookiePriorToLoginPersistence(@Nullable TokenCookieConfiguration cookieConfiguration)

Method Details

onUnauthorized

public void onUnauthorized(io.micronaut.http.HttpRequest<?> request,
 io.micronaut.http.MutableHttpResponse<?> response)

Specified by:

onUnauthorized in interface PriorToLoginPersistence<io.micronaut.http.HttpRequest<?>, io.micronaut.http.MutableHttpResponse<?>>

getOriginalUri

public Optional<URI> getOriginalUri(io.micronaut.http.HttpRequest<?> request,
 io.micronaut.http.MutableHttpResponse<?> response)

Specified by:

getOriginalUri in interface PriorToLoginPersistence<io.micronaut.http.HttpRequest<?>, io.micronaut.http.MutableHttpResponse<?>>

configure

protected void configure(io.micronaut.http.cookie.Cookie cookie,
 io.micronaut.http.HttpRequest<?> request)

Configure the cookie.

Parameters:

cookie - The cookie

request - The current request