a6b36ae97fbcb4cf30b59e94c01783288970ff29 - gerrit

commit	a6b36ae97fbcb4cf30b59e94c01783288970ff29	[log] [tgz]
author	Shawn O. Pearce <sop@google.com>	Wed Oct 26 16:57:26 2011 -0700
committer	Shawn O. Pearce <sop@google.com>	Mon Oct 31 17:35:30 2011 -0700
tree	738eb45de8fe83ad1ef6ddb14e6b69a97fec0828
parent	6acda54742093d17581bf38309589a9c5b22a979 [diff]

Embed the XSRF token in the host page again

If the servlet container forces 'HttpOnly' on us for our account
session cookie, we can't use that to prevent cross site forgery.
Instead embed a token that is unique to this session into the host
page, and have the web UI echo that token back on each request.
We'll validate the token matches the session cookie on the server,
and then simply never rotate it within the lifespan of the session.

Change-Id: Ia9678335b7446eab8a6ee7f043e03f928707b1ad
Signed-off-by: Shawn O. Pearce <sop@google.com>

gerrit-common/src/main/java/com/google/gerrit/common/data/HostPageData.java[diff]
gerrit-gwtui/src/main/java/com/google/gerrit/client/Gerrit.java[diff]
gerrit-httpd/src/main/java/com/google/gerrit/httpd/WebSession.java[diff]
gerrit-httpd/src/main/java/com/google/gerrit/httpd/WebSessionManager.java[diff]
gerrit-httpd/src/main/java/com/google/gerrit/httpd/raw/HostPageServlet.java[diff]

5 files changed