tree 204ae2eb3f582a27e50502bd7239024c70a68299
parent be5cba5d680de96518d9cbf2ce31973594757b47
author Luca Milanesio <luca.milanesio@gmail.com> 1393527126 +0000
committer Luca Milanesio <luca.milanesio@gmail.com> 1395586550 +0000

Resilience against GerritOAuth and JSESSIONID cookies lost

GitHub plugin uses two main cookies to cache OAuth
information:
- GerritOAuth to enrich HTTP requests with auth headers used by
  Gerrit HTTP authentication
- JSESSIONID to get session objects with GitHub client objects

When GerritOAuth or JSESSIONID expire, a transparent GitHub OAuth
renegotiation is needed to recreate them through a new authentication
challenge. OAuth scope is now stored in the GerritOAuth cookie in order
to re-create the same scope-level previously own.

NOTE: GerritOAuth is typically short lived to avoid
      security leak of the OAuth information. JSESSIONID could be lost
      because of workload balancing or failover.

Change-Id: I874c4ae75f2b238dccb0ec8c164628c28f1b5f01