FWD » Core Development » User Interface

When a HTTP redirection is done the GET method is used. A HTTP GET request contains HTTP headers and an URL. No body content is send to server.

In order to send the authorization token we have two ways:

1. Using a HTTP header. On redirection using GET method is not possible to set a header value except setting a cookie which finally is send as a header value by web browser. Cookies does not work over cross domains.

2. Using a query string parameter in URL. In this case the redirection URL looks like:
https://domain:port/?param=<token value> and it works over cross domains.
The problem here is that query string token is visible in browser address bar because is a part of the URL on redirection.
But using the token only once at the redirection time the risk to be stolen and used by another person is reduced, see my implementation bellow.

My changes follow the second way to send the token. The token is send as a query parameter when redirection is made. On the redirected site the token is compared with the expected value. If match a cookie is set using a new random generated token and the first token is no longer valid. If a new request is coming having the first token as a query parameter and the cookie was already set the access is denied. Basically for security reasons the initial token can be used only once when redirection is made.

The cookie is used when the user force a page reload from browser which means also a HTTP GET request and we have to send an authorization token from browser to server. We have again two options HTTP headers or query string. Because the browser have to send token the cookie is used which is send as a HTTP header.
Using a query string is less secure because the query string is always visible in the browser address bar.

Here are the results of my regression test. CTRL-C test took 1 hour and 8 minutes and the errors are false negative.
Regarding the MAIN part I'm not sure if the test is completely done.

A severe error occur at one moment:

** Shared variable curFac has not yet been created. (392)

Comparing results with other results from previous regression tests seems to be completed.
Looking inside the server log I found:

07/23/2014 07:05:58 EDT] (com.goldencode.p2j.persist.trigger.DatabaseTriggerManager:INFO) DatabaseTriggerManager registered with TransactionManager.
[07/23/2014 07:05:59 EDT] (com.goldencode.p2j.persist.lock.InMemoryLockManager:WARNING) [0000018F:00000506:syman] --> local/majic/primary:  cleaning up 2 leaked record lock(s) for exiting context ({purchase_order_item:T=SHARE [syman:0000018F], temp_sum:T=SHARE [syman:0000018F syman:0000018E deweyw:0000019A deweyw:00000198 syman:00000189 syman:00000186 syman:00000199]})
[07/23/2014 07:06:00 EDT] (com.goldencode.p2j.persist.lock.InMemoryLockManager:WARNING) [00000198:000004FF:deweyw] --> local/majic/primary:  cleaning up 1 leaked record lock(s) for exiting context ({temp_sum:T=SHARE [syman:0000018E deweyw:0000019A deweyw:00000198 syman:00000189 syman:00000186 syman:00000199]})
[07/23/2014 07:06:02 EDT] (ErrorManager:SEVERE) {0000019A:00000505:deweyw} ** Shared variable curFac has not yet been created. (392)
[07/23/2014 07:06:02 EDT] (com.goldencode.p2j.util.ControlFlowOps$ExternalProgramResolver:WARNING) Unable to resolve external program.
com.goldencode.p2j.util.ErrorConditionException: ** Shared variable curFac has not yet been created. (392)
        at com.goldencode.p2j.util.ErrorManager.recordOrThrowError(ErrorManager.java:1041)
        at com.goldencode.p2j.util.ErrorManager.recordOrThrowError(ErrorManager.java:934)
        at com.goldencode.p2j.util.ErrorManager.recordOrThrowError(ErrorManager.java:913)
        at com.goldencode.p2j.util.SharedVariableManager.errorHelper(SharedVariableManager.java:766)
        at com.goldencode.p2j.util.SharedVariableManager.lookupWorker(SharedVariableManager.java:742)
        at com.goldencode.p2j.util.SharedVariableManager.lookupVariable(SharedVariableManager.java:337)
        at aero.timco.majic.po.PocoT.<init>(PocoT.java:121)
        at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
        at sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:57)
        at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
        at java.lang.reflect.Constructor.newInstance(Constructor.java:526)
        at java.lang.Class.newInstance(Class.java:374)

WebHandler, the public static members are placed before the private static members.

no regression tests are mandatory for this changes.
committed revision 10579