zydronium/google-nomulus
1
0
Fork 0
mirror of https://github.com/google/nomulus.git synced 2025-05-13 07:57:13 +02:00
Code Issues Projects Releases Packages Wiki Activity

Rewrite ServerSecret caching and accessor logic

Browse source 
I'm working on some changes to XsrfTokenManager (b/35388772) and ServerSecret
was crufty enough that I ended up rewriting it.  Now it uses a LoadingCache
with a transaction instead of needlessly race-condition-y static init logic.

It also now supports retrieving its value as either a UUID (the old format
used by XsrfTokenManager) or a byte[].  The latter is more flexible and can
be directly used with HMAC which the new XsrfTokenManager format will employ.

And lastly, I added tests.  In addition, I tested this code on alpha and
verified appropriate operation (XSRF tokens still work from the console and
from regtool; if you remove ServerSecret from datastore and memcache, it
persists a new one).

-------------
Created by MOE: https://github.com/google/moe
MOE_MIGRATED_REVID=148931620
This commit is contained in:
nickfelt 2017-03-01 14:28:10 -08:00 • committed by Ben McIlwain
parent c56959b62b
commit 499f1e7dbc
3 changed files with 159 additions and 28 deletions
Download patch file Download diff file Expand all files Collapse all files

6
java/google/registry/security/XsrfTokenManager.java
View file

@ -15,13 +15,13 @@
package google.registry.security;
import static com.google.common.io.BaseEncoding.base64Url;
import static google.registry.model.server.ServerSecret.getServerSecret;
import static java.nio.charset.StandardCharsets.UTF_8;
import com.google.appengine.api.users.UserService;
import com.google.common.base.Joiner;
import com.google.common.base.Splitter;
import com.google.common.hash.Hashing;
import google.registry.model.server.ServerSecret;
import google.registry.util.Clock;
import google.registry.util.FormattingLogger;
import java.util.List;
@ -60,7 +60,9 @@ public final class XsrfTokenManager {
*/
private static String encodeToken(long creationTime, @Nullable String scope, String userEmail) {
String token =
Joiner.on('\t').skipNulls().join(getServerSecret(), userEmail, scope, creationTime);
Joiner.on('\t')
.skipNulls()
.join(ServerSecret.get().asUuid(), userEmail, scope, creationTime);
return base64Url().encode(Hashing.sha256()
.newHasher(token.length())
.putString(token, UTF_8)