Examples with AuthToken com.zimbra.cs.account.AuthToken used on opensource projects

Example 91 with AuthToken

use of com.zimbra.cs.account.AuthToken in project zm-mailbox by Zimbra.

the class CsrfUtil method getAuthTokenFromReq.

/**
   *
   * @param req
   * @return
   */
public static AuthToken getAuthTokenFromReq(HttpServletRequest req) {
    AuthToken at = null;
    try {
        boolean isAdminRequest = AuthUtil.isAdminRequest(req);
        at = AuthProvider.getAuthToken(req, isAdminRequest);
    } catch (ServiceException | AuthTokenException e) {
        ZimbraLog.security.info("Error extracting auth token from the request. " + e.getMessage());
    }
    return at;
}

Example 92 with AuthToken

use of com.zimbra.cs.account.AuthToken in project zm-mailbox by Zimbra.

the class CsrfUtil method getAuthTokenFromResponse.

/**
     * @param resp
     * @return
     * @throws AuthTokenException
     */
public static AuthToken getAuthTokenFromResponse(HttpServletResponse resp) throws AuthTokenException {
    List<String> headers = (List<String>) resp.getHeaders("Set-Cookie");
    AuthToken at = null;
    for (String s : headers) {
        if (!StringUtil.isNullOrEmpty(s) && s.contains("ZM_AUTH_TOKEN")) {
            String[] temp = s.split("=");
            int index = temp[1].indexOf(";");
            String token = temp[1].substring(0, index);
            at = AuthToken.getAuthToken(token);
        }
    }
    return at;
}

Example 93 with AuthToken

use of com.zimbra.cs.account.AuthToken in project zm-mailbox by Zimbra.

the class TestCookieReuse method testReuseUserCookieWithCsrf.

/**
     * Verify that we CAN make a GET request by reusing a valid CSRF-enabled cookie
     */
@Test
public void testReuseUserCookieWithCsrf() throws Exception {
    AuthToken at = AuthProvider.getAuthToken(TestUtil.getAccount(USER_NAME));
    ZMailbox mbox = TestUtil.getZMailbox(USER_NAME);
    URI uri = mbox.getRestURI("Inbox?fmt=rss&thief=true");
    at.setCsrfTokenEnabled(true);
    GetMethod get = new GetMethod(uri.toString());
    HttpClient eve = ZimbraHttpConnectionManager.getInternalHttpConnMgr().newHttpClient();
    HttpState state = HttpClientUtil.newHttpState(new ZAuthToken(at.getEncoded()), uri.getHost(), false);
    eve.setState(state);
    eve.getParams().setCookiePolicy(CookiePolicy.BROWSER_COMPATIBILITY);
    int statusCode = HttpClientUtil.executeMethod(eve, get);
    Assert.assertEquals("This request should succeed. Getting status code " + statusCode + " Response: " + get.getResponseBodyAsString(), HttpStatus.SC_OK, statusCode);
}

Example 94 with AuthToken

use of com.zimbra.cs.account.AuthToken in project zm-mailbox by Zimbra.

the class TestCookieReuse method testReuseAdminCookieWithoutCsrf.

/**
     * Verify that we CAN make an admin GET request by re-using a valid non-csrf-enabled cookie
     */
@Test
public void testReuseAdminCookieWithoutCsrf() throws Exception {
    AuthToken at = AuthProvider.getAdminAuthToken();
    at.setCsrfTokenEnabled(false);
    int port = 7071;
    try {
        port = Provisioning.getInstance().getLocalServer().getIntAttr(Provisioning.A_zimbraAdminPort, 0);
    } catch (ServiceException e) {
        ZimbraLog.test.error("Unable to get admin SOAP port", e);
    }
    String host = Provisioning.getInstance().getLocalServer().getName();
    String getServerConfigURL = "https://localhost:" + port + "/service/collectconfig/?host=" + host;
    HttpClient eve = ZimbraHttpConnectionManager.getInternalHttpConnMgr().newHttpClient();
    HttpState state = new HttpState();
    at.encode(state, true, "localhost");
    eve.setState(state);
    GetMethod get = new GetMethod(getServerConfigURL);
    int statusCode = HttpClientUtil.executeMethod(eve, get);
    Assert.assertEquals("This request should succeed. Getting status code " + statusCode, HttpStatus.SC_OK, statusCode);
}

Example 95 with AuthToken

use of com.zimbra.cs.account.AuthToken in project zm-mailbox by Zimbra.

the class TestCookieReuse method testAdminTokenDeregistration.

/**
     * test de-registering an admin authtoken
     * @throws Exception
     */
@Test
public void testAdminTokenDeregistration() throws Exception {
    AuthToken at = AuthProvider.getAdminAuthToken();
    Assert.assertTrue("token should be registered", at.isRegistered());
    at.deRegister();
    Assert.assertFalse("token should not be registered", at.isRegistered());
}