Examples with WebSocketAwareCsrfPreventionRequestCycleListener org.apache.wicket.protocol.ws.WebSocketAwareCsrfPreventionRequestCycleListener used on opensource projects

Example 1 with WebSocketAwareCsrfPreventionRequestCycleListener

use of org.apache.wicket.protocol.ws.WebSocketAwareCsrfPreventionRequestCycleListener in project openmeetings by apache.

the class Application method init.

@Override
protected void init() {
    setWicketApplicationName(super.getName());
    getSecuritySettings().setAuthenticationStrategy(new OmAuthenticationStrategy());
    getApplicationSettings().setAccessDeniedPage(AccessDeniedPage.class);
    getComponentInstantiationListeners().add(new SpringComponentInjector(this, ctx, true));
    hazelcast.getCluster().getLocalMember().setStringAttribute(NAME_ATTR_KEY, hazelcast.getName());
    hazelWsTopic = hazelcast.getTopic("default");
    hazelWsTopic.addMessageListener(msg -> {
        String serverId = msg.getPublishingMember().getStringAttribute(NAME_ATTR_KEY);
        if (serverId.equals(hazelcast.getName())) {
            return;
        }
        WbWebSocketHelper.send(msg.getMessageObject());
    });
    hazelcast.getCluster().addMembershipListener(new MembershipListener() {

        @Override
        public void memberRemoved(MembershipEvent evt) {
            // server down, need to remove all online clients, process persistent addresses
            String serverId = evt.getMember().getStringAttribute(NAME_ATTR_KEY);
            cm.clean(serverId);
            scm.clean(serverId);
            updateJpaAddresses();
        }

        @Override
        public void memberAttributeChanged(MemberAttributeEvent evt) {
        // no-op
        }

        @Override
        public void memberAdded(MembershipEvent evt) {
            // server added, need to process persistent addresses
            updateJpaAddresses();
            // check for duplicate instance-names
            Set<String> names = new HashSet<>();
            for (Member m : evt.getMembers()) {
                if (evt.getMember().getUuid().equals(m.getUuid())) {
                    continue;
                }
                String serverId = m.getStringAttribute(NAME_ATTR_KEY);
                names.add(serverId);
            }
            String serverId = evt.getMember().getStringAttribute(NAME_ATTR_KEY);
            if (names.contains(serverId)) {
                log.warn("Duplicate cluster instance with name {} found {}", serverId, evt.getMember());
            }
        }
    });
    setPageManagerProvider(new DefaultPageManagerProvider(this) {

        @Override
        protected IDataStore newDataStore() {
            return new HazelcastDataStore(hazelcast);
        }
    });
    // Add custom resource loader at the beginning, so it will be checked first in the
    // chain of Resource Loaders, if not found it will search in Wicket's internal
    // Resource Loader for a the property key
    getResourceSettings().getStringResourceLoaders().add(0, new LabelResourceLoader());
    getJavaScriptLibrarySettings().setJQueryReference(getV3());
    getRequestCycleListeners().add(new WebSocketAwareCsrfPreventionRequestCycleListener() {

        @Override
        public void onEndRequest(RequestCycle cycle) {
            Response resp = cycle.getResponse();
            if (resp instanceof WebResponse && !(resp instanceof WebSocketResponse)) {
                WebResponse wresp = (WebResponse) resp;
                wresp.setHeader("X-XSS-Protection", "1; mode=block");
                wresp.setHeader("Strict-Transport-Security", "max-age=31536000; includeSubDomains; preload");
                wresp.setHeader("X-Content-Type-Options", "nosniff");
                wresp.setHeader("X-Frame-Options", xFrameOptions);
                Url reqUrl = cycle.getRequest().getUrl();
                wresp.setHeader("Content-Security-Policy", String.format("%s; connect-src 'self' %s;", contentSecurityPolicy, getWsUrl(reqUrl)));
            }
        }
    });
    super.init();
    // register some widgets
    dashboardContext = new DashboardContext();
    dashboardContext.setDashboardPersister(new UserDashboardPersister());
    WidgetRegistry widgetRegistry = dashboardContext.getWidgetRegistry();
    widgetRegistry.registerWidget(new MyRoomsWidgetDescriptor());
    widgetRegistry.registerWidget(new RecentRoomsWidgetDescriptor());
    widgetRegistry.registerWidget(new WelcomeWidgetDescriptor());
    widgetRegistry.registerWidget(new StartWidgetDescriptor());
    widgetRegistry.registerWidget(new RssWidgetDescriptor());
    widgetRegistry.registerWidget(new AdminWidgetDescriptor());
    // add dashboard context injector
    getComponentInstantiationListeners().add(new DashboardContextInjector(dashboardContext));
    DashboardSettings dashboardSettings = DashboardSettings.get();
    dashboardSettings.setIncludeJQueryUI(false);
    getRootRequestMapperAsCompound().add(new NoVersionMapper(getHomePage()));
    getRootRequestMapperAsCompound().add(new NoVersionMapper(NOTINIT_MAPPING, NotInitedPage.class));
    getRootRequestMapperAsCompound().add(new NoVersionMapper(HASH_MAPPING, HashPage.class));
    getRootRequestMapperAsCompound().add(new NoVersionMapper(SIGNIN_MAPPING, getSignInPageClass()));
    getRootRequestMapperAsCompound().add(new NoVersionMapper("oauth/${oauthid}", getSignInPageClass()));
    mountPage("install", InstallWizardPage.class);
    mountPage("activate", ActivatePage.class);
    mountPage("reset", ResetPage.class);
    mountResource("/recordings/mp4/${id}", new Mp4RecordingResourceReference());
    // should be in sync with VideoPlayer
    mountResource("/recordings/png/${id}", new PngRecordingResourceReference());
    mountResource("/room/file/${id}", new RoomResourceReference());
    mountResource("/room/preview/${id}", new RoomPreviewResourceReference());
    mountResource("/profile/${id}", new ProfileImageResourceReference());
    mountResource("/group/${id}", new GroupLogoResourceReference());
    log.debug("Application::init");
    try {
        if (OmFileHelper.getOmHome() == null) {
            OmFileHelper.setOmHome(new File(getServletContext().getRealPath("/")));
        }
        LabelDao.initLanguageMap();
        log.debug("webAppPath : {}", OmFileHelper.getOmHome());
        // Init all global config properties
        cfgDao.reinit();
        // Init properties
        setXFrameOptions(cfgDao.getString(CONFIG_HEADER_XFRAME, HEADER_XFRAME_SAMEORIGIN));
        setContentSecurityPolicy(cfgDao.getString(CONFIG_HEADER_CSP, HEADER_CSP_SELF));
        updateJpaAddresses();
        setExtProcessTtl(cfgDao.getInt(CONFIG_EXT_PROCESS_TTL, getExtProcessTtl()));
        Version.logOMStarted();
        // we are starting so all processing recordings are now errors
        recordingDao.resetProcessingStatus();
        setInitComplete(true);
    } catch (Exception err) {
        log.error("[appStart]", err);
    }
}