Examples with SessionCookieConfig jakarta.servlet.SessionCookieConfig used on opensource projects

Example 6 with SessionCookieConfig

use of jakarta.servlet.SessionCookieConfig in project tomcat by apache.

the class TestLoadBalancerDrainingValve method runValve.

@Test
public void runValve() throws Exception {
    IMocksControl control = EasyMock.createControl();
    ServletContext servletContext = control.createMock(ServletContext.class);
    Context ctx = control.createMock(Context.class);
    Request request = control.createMock(Request.class);
    Response response = control.createMock(Response.class);
    String sessionCookieName = "JSESSIONID";
    String sessionId = "cafebabe";
    String requestURI = "/test/path";
    SessionCookieConfig cookieConfig = new CookieConfig();
    cookieConfig.setDomain("example.com");
    cookieConfig.setName(sessionCookieName);
    cookieConfig.setPath("/");
    cookieConfig.setSecure(secureSessionConfig);
    // Valve.init requires all of this stuff
    EasyMock.expect(ctx.getMBeanKeyProperties()).andStubReturn("");
    EasyMock.expect(ctx.getName()).andStubReturn("");
    EasyMock.expect(ctx.getPipeline()).andStubReturn(new StandardPipeline());
    EasyMock.expect(ctx.getDomain()).andStubReturn("foo");
    EasyMock.expect(ctx.getLogger()).andStubReturn(org.apache.juli.logging.LogFactory.getLog(LoadBalancerDrainingValve.class));
    EasyMock.expect(ctx.getServletContext()).andStubReturn(servletContext);
    // Set up the actual test
    EasyMock.expect(request.getAttribute(LoadBalancerDrainingValve.ATTRIBUTE_KEY_JK_LB_ACTIVATION)).andStubReturn(jkActivation);
    EasyMock.expect(Boolean.valueOf(request.isRequestedSessionIdValid())).andStubReturn(Boolean.valueOf(validSessionId));
    ArrayList<Cookie> cookies = new ArrayList<>();
    if (enableIgnore) {
        cookies.add(new Cookie("ignore", "true"));
    }
    if (!validSessionId && jkActivation.equals("DIS")) {
        MyCookie cookie = new MyCookie(cookieConfig.getName(), sessionId);
        cookie.setPath(cookieConfig.getPath());
        cookie.setValue(sessionId);
        cookies.add(cookie);
        EasyMock.expect(request.getRequestedSessionId()).andStubReturn(sessionId);
        EasyMock.expect(request.getRequestURI()).andStubReturn(requestURI);
        EasyMock.expect(request.getCookies()).andStubReturn(cookies.toArray(new Cookie[0]));
        EasyMock.expect(request.getContext()).andStubReturn(ctx);
        EasyMock.expect(ctx.getSessionCookieName()).andStubReturn(sessionCookieName);
        EasyMock.expect(servletContext.getSessionCookieConfig()).andStubReturn(cookieConfig);
        EasyMock.expect(request.getQueryString()).andStubReturn(queryString);
        EasyMock.expect(ctx.getSessionCookiePath()).andStubReturn("/");
        if (!enableIgnore) {
            EasyMock.expect(Boolean.valueOf(ctx.getSessionCookiePathUsesTrailingSlash())).andStubReturn(Boolean.TRUE);
            EasyMock.expect(request.getQueryString()).andStubReturn(queryString);
            // Response will have cookie deleted
            MyCookie expectedCookie = new MyCookie(cookieConfig.getName(), "");
            expectedCookie.setPath(cookieConfig.getPath());
            expectedCookie.setMaxAge(0);
            EasyMock.expect(Boolean.valueOf(request.isSecure())).andReturn(secureRequest);
            // These two lines just mean EasyMock.expect(response.addCookie) but for a void method
            response.addCookie(expectedCookie);
            // Indirect call
            EasyMock.expect(ctx.getSessionCookieName()).andReturn(sessionCookieName);
            String expectedRequestURI = requestURI;
            if (null != queryString) {
                expectedRequestURI = expectedRequestURI + '?' + queryString;
            }
            response.setHeader("Location", expectedRequestURI);
            response.setStatus(307);
        }
    }
    Valve next = control.createMock(Valve.class);
    if (expectInvokeNext) {
        // Expect the "next" Valve to fire
        // Next 2 lines are basically EasyMock.expect(next.invoke(req,res)) but for a void method
        next.invoke(request, response);
        EasyMock.expectLastCall();
    }
    // Get set to actually test
    control.replay();
    LoadBalancerDrainingValve valve = new LoadBalancerDrainingValve();
    valve.setContainer(ctx);
    valve.init();
    valve.setNext(next);
    valve.setIgnoreCookieName("ignore");
    valve.setIgnoreCookieValue("true");
    valve.invoke(request, response);
    control.verify();
}

Example 7 with SessionCookieConfig

use of jakarta.servlet.SessionCookieConfig in project spring-boot by spring-projects.

the class AbstractServletWebServerFactoryTests method sessionCookieConfiguration.

@Test
void sessionCookieConfiguration() {
    AbstractServletWebServerFactory factory = getFactory();
    factory.getSession().getCookie().setName("testname");
    factory.getSession().getCookie().setDomain("testdomain");
    factory.getSession().getCookie().setPath("/testpath");
    factory.getSession().getCookie().setComment("testcomment");
    factory.getSession().getCookie().setHttpOnly(true);
    factory.getSession().getCookie().setSecure(true);
    factory.getSession().getCookie().setMaxAge(Duration.ofSeconds(60));
    final AtomicReference<SessionCookieConfig> configReference = new AtomicReference<>();
    this.webServer = factory.getWebServer((context) -> configReference.set(context.getSessionCookieConfig()));
    SessionCookieConfig sessionCookieConfig = configReference.get();
    assertThat(sessionCookieConfig.getName()).isEqualTo("testname");
    assertThat(sessionCookieConfig.getDomain()).isEqualTo("testdomain");
    assertThat(sessionCookieConfig.getPath()).isEqualTo("/testpath");
    assertThat(sessionCookieConfig.getComment()).isEqualTo("testcomment");
    assertThat(sessionCookieConfig.isHttpOnly()).isTrue();
    assertThat(sessionCookieConfig.isSecure()).isTrue();
    assertThat(sessionCookieConfig.getMaxAge()).isEqualTo(60);
}

Example 8 with SessionCookieConfig

use of jakarta.servlet.SessionCookieConfig in project tomcat by apache.

the class LoadBalancerDrainingValve method invoke.

@Override
public void invoke(Request request, Response response) throws IOException, ServletException {
    if ("DIS".equals(request.getAttribute(ATTRIBUTE_KEY_JK_LB_ACTIVATION)) && !request.isRequestedSessionIdValid()) {
        if (containerLog.isDebugEnabled()) {
            containerLog.debug("Load-balancer is in DISABLED state; draining this node");
        }
        boolean ignoreRebalance = false;
        Cookie sessionCookie = null;
        final Cookie[] cookies = request.getCookies();
        final String sessionCookieName = SessionConfig.getSessionCookieName(request.getContext());
        if (null != cookies) {
            for (Cookie cookie : cookies) {
                final String cookieName = cookie.getName();
                if (containerLog.isTraceEnabled()) {
                    containerLog.trace("Checking cookie " + cookieName + "=" + cookie.getValue());
                }
                if (sessionCookieName.equals(cookieName) && request.getRequestedSessionId().equals(cookie.getValue())) {
                    sessionCookie = cookie;
                } else if (null != _ignoreCookieName && _ignoreCookieName.equals(cookieName) && null != _ignoreCookieValue && _ignoreCookieValue.equals(cookie.getValue())) {
                    // The client presenting a valid ignore-cookie value?
                    ignoreRebalance = true;
                }
            }
        }
        if (ignoreRebalance) {
            if (containerLog.isDebugEnabled()) {
                containerLog.debug("Client is presenting a valid " + _ignoreCookieName + " cookie, re-balancing is being skipped");
            }
            getNext().invoke(request, response);
            return;
        }
        // TODO: Consider implications of SSO cookies
        if (null != sessionCookie) {
            sessionCookie.setPath(SessionConfig.getSessionCookiePath(request.getContext()));
            // Delete
            sessionCookie.setMaxAge(0);
            // Purge the cookie's value
            sessionCookie.setValue("");
            // Replicate logic used to set secure attribute for session cookies
            SessionCookieConfig sessionCookieConfig = request.getContext().getServletContext().getSessionCookieConfig();
            sessionCookie.setSecure(request.isSecure() || sessionCookieConfig.isSecure());
            response.addCookie(sessionCookie);
        }
        // Re-write the URI if it contains a ;jsessionid parameter
        String uri = request.getRequestURI();
        String sessionURIParamName = SessionConfig.getSessionUriParamName(request.getContext());
        if (uri.contains(";" + sessionURIParamName + "=")) {
            uri = uri.replaceFirst(";" + sessionURIParamName + "=[^&?]*", "");
        }
        String queryString = request.getQueryString();
        if (null != queryString) {
            uri = uri + "?" + queryString;
        }
        // NOTE: Do not call response.encodeRedirectURL or the bad
        // sessionid will be restored
        response.setHeader("Location", uri);
        response.setStatus(_redirectStatusCode);
    } else {
        getNext().invoke(request, response);
    }
}