zydronium/google-nomulus
1
0
Fork 0
mirror of https://github.com/google/nomulus.git synced 2025-05-09 08:18:21 +02:00
Code Issues Projects Releases Packages Wiki Activity
google-nomulus/java/google/registry/tools
History
nickfelt 2e969d6ed1 Change XsrfTokenManager to support new HMAC token format 
This follows up on Brian's work to transition not just to a new format
with an empty scope value, but instead to replace the existing format
entirely with a new one that:

  1) includes a version number to support future format migrations
  2) doesn't include a field for the scope at all, since scoping the
     tokens adds no real security benefit and just makes verification
     more difficult
  3) replaces the raw SHA-256 hash with a SHA-256 HMAC instead, as a
     best practice to avoid length-extension attacks [1], even though
     in our particular case they would only be able to extend the
     timestamp and would thus be relatively innocuous

The new format will be produced by calling generateToken(), and the
scope-accepting version is renamed to generateLegacyToken() in addition
to its existing deprecation, for maximum clarity.

I changed the validateToken() logic to stop accepting a scope entirely;
when validating a legacy-style token, we'll test it against the two
existing legacy scope values ("admin" and "console") and accept it if
it matches either one.

Note that this means the xsrfScope parameter in @Action is now wholly
obsolete; I'll remove it in a follow-up to avoid bringing extra files
into this CL.

After this CL hits production, the next one will replace all calls to
generateLegacyToken() with generateToken().  Once that CL is deployed,
the last step will be removing the legacy fallback in validateToken().

[1] See https://en.wikipedia.org/wiki/Length_extension_attack

-------------
Created by MOE: https://github.com/google/moe
MOE_MIGRATED_REVID=148936805
2017-03-07 13:31:46 -05:00
..
javascrap Drop FixDomainNameserverKeysCommand 2017-03-07 13:16:34 -05:00
params Align parameter formats for zone data commands 2017-02-22 11:46:07 -05:00
resources Add Client-side OAuth2 to HTTP connections 2017-02-17 12:17:53 -05:00
server Move premium list static helper methods into their own class 2017-02-27 11:30:45 -05:00
soy Update copyright year on all license headers 2017-02-02 16:27:22 -05:00
sql Exclude SYNTHETIC flag from BillingData BigQuery view 2017-03-07 13:13:37 -05:00
AllocateDomainCommand.java Update copyright year on all license headers 2017-02-02 16:27:22 -05:00
AppEngineConnection.java Change XsrfTokenManager to support new HMAC token format 2017-03-07 13:31:46 -05:00
AppEngineConnectionFlags.java Add Client-side OAuth2 to HTTP connections 2017-02-17 12:17:53 -05:00
AuctionStatusCommand.java Update copyright year on all license headers 2017-02-02 16:27:22 -05:00
BigqueryCommand.java Update copyright year on all license headers 2017-02-02 16:27:22 -05:00
BigqueryCommandUtilities.java Update copyright year on all license headers 2017-02-02 16:27:22 -05:00
BigqueryParameters.java Update copyright year on all license headers 2017-02-02 16:27:22 -05:00
BUILD Add Client-side OAuth2 to HTTP connections 2017-02-17 12:17:53 -05:00
CanonicalizeLabelsCommand.java Update copyright year on all license headers 2017-02-02 16:27:22 -05:00
CheckSnapshotCommand.java Refer to Datastore everywhere correctly by its capitalized form 2017-02-17 12:12:12 -05:00
Command.java Update copyright year on all license headers 2017-02-02 16:27:22 -05:00
CommandUtilities.java Fix CommandUtilities to fail gracefully if stdin is unavailable 2017-02-06 16:45:23 -05:00
ConfirmingCommand.java Update copyright year on all license headers 2017-02-02 16:27:22 -05:00
ConvertIdnCommand.java Update copyright year on all license headers 2017-02-02 16:27:22 -05:00
CreateAnchorTenantCommand.java Update copyright year on all license headers 2017-02-02 16:27:22 -05:00
CreateAuctionCreditsCommand.java Refer to Datastore everywhere correctly by its capitalized form 2017-02-17 12:12:12 -05:00
CreateContactCommand.java Update copyright year on all license headers 2017-02-02 16:27:22 -05:00
CreateCreditBalanceCommand.java Update copyright year on all license headers 2017-02-02 16:27:22 -05:00
CreateCreditCommand.java Update copyright year on all license headers 2017-02-02 16:27:22 -05:00
CreateDomainCommand.java Update copyright year on all license headers 2017-02-02 16:27:22 -05:00
CreateHostCommand.java Update copyright year on all license headers 2017-02-02 16:27:22 -05:00
CreateLrpTokensCommand.java Update copyright year on all license headers 2017-02-02 16:27:22 -05:00
CreateOrUpdatePremiumListCommand.java Read from bloom filter for premium pricing checks 2017-02-27 11:22:21 -05:00
CreateOrUpdateRegistrarCommand.java Update copyright year on all license headers 2017-02-02 16:27:22 -05:00
CreateOrUpdateReservedListCommand.java Update copyright year on all license headers 2017-02-02 16:27:22 -05:00
CreateOrUpdateTldCommand.java Update copyright year on all license headers 2017-02-02 16:27:22 -05:00
CreatePremiumListCommand.java Update copyright year on all license headers 2017-02-02 16:27:22 -05:00
CreateRegistrarCommand.java Update copyright year on all license headers 2017-02-02 16:27:22 -05:00
CreateRegistrarGroupsCommand.java Update copyright year on all license headers 2017-02-02 16:27:22 -05:00
CreateReservedListCommand.java Refer to Datastore everywhere correctly by its capitalized form 2017-02-17 12:12:12 -05:00
CreateTldCommand.java Update copyright year on all license headers 2017-02-02 16:27:22 -05:00
DefaultRequestFactoryModule.java Put the path to client_secrets in a config option. 2017-02-22 11:49:03 -05:00
DeleteCreditCommand.java Update copyright year on all license headers 2017-02-02 16:27:22 -05:00
DeleteDomainCommand.java Update copyright year on all license headers 2017-02-02 16:27:22 -05:00
DeleteEntityCommand.java Update copyright year on all license headers 2017-02-02 16:27:22 -05:00
DeletePremiumListCommand.java Move premium list static helper methods into their own class 2017-02-27 11:30:45 -05:00
DeleteReservedListCommand.java Update copyright year on all license headers 2017-02-02 16:27:22 -05:00
DomainApplicationInfoCommand.java Update copyright year on all license headers 2017-02-02 16:27:22 -05:00
DomainCheckClaimsCommand.java Update copyright year on all license headers 2017-02-02 16:27:22 -05:00
DomainCheckCommand.java Update copyright year on all license headers 2017-02-02 16:27:22 -05:00
DomainCheckFeeCommand.java Update copyright year on all license headers 2017-02-02 16:27:22 -05:00
EncryptEscrowDepositCommand.java Update copyright year on all license headers 2017-02-02 16:27:22 -05:00
EppToolCommand.java Update copyright year on all license headers 2017-02-02 16:27:22 -05:00
EscrowDepositEncryptor.java Update copyright year on all license headers 2017-02-02 16:27:22 -05:00
ExecuteEppCommand.java Fix two Gauava 20 deprecations across the tools package 2017-02-02 16:54:28 -05:00
GenerateApplicationsReportCommand.java Update copyright year on all license headers 2017-02-02 16:27:22 -05:00
GenerateAuctionDataCommand.java Update copyright year on all license headers 2017-02-02 16:27:22 -05:00
GenerateDnsReportCommand.java Update copyright year on all license headers 2017-02-02 16:27:22 -05:00
GenerateEscrowDepositCommand.java Refer to Datastore everywhere correctly by its capitalized form 2017-02-17 12:12:12 -05:00
GenerateLordnCommand.java Update copyright year on all license headers 2017-02-02 16:27:22 -05:00
GenerateZoneFilesCommand.java Align parameter formats for zone data commands 2017-02-22 11:46:07 -05:00
GetApplicationCommand.java Update copyright year on all license headers 2017-02-02 16:27:22 -05:00
GetApplicationIdsCommand.java Update copyright year on all license headers 2017-02-02 16:27:22 -05:00
GetAppliedLabelsCommand.java Update copyright year on all license headers 2017-02-02 16:27:22 -05:00
GetClaimsListCommand.java Refer to Datastore everywhere correctly by its capitalized form 2017-02-17 12:12:12 -05:00
GetContactCommand.java Update copyright year on all license headers 2017-02-02 16:27:22 -05:00
GetDomainCommand.java Update copyright year on all license headers 2017-02-02 16:27:22 -05:00
GetEppResourceCommand.java Update copyright year on all license headers 2017-02-02 16:27:22 -05:00
GetHistoryEntriesCommand.java Update copyright year on all license headers 2017-02-02 16:27:22 -05:00
GetHostCommand.java Update copyright year on all license headers 2017-02-02 16:27:22 -05:00
GetLrpTokenCommand.java Update copyright year on all license headers 2017-02-02 16:27:22 -05:00
GetRegistrarCommand.java Update copyright year on all license headers 2017-02-02 16:27:22 -05:00
GetResourceByKeyCommand.java Refer to Datastore everywhere correctly by its capitalized form 2017-02-17 12:12:12 -05:00
GetSchemaCommand.java Update copyright year on all license headers 2017-02-02 16:27:22 -05:00
GetSchemaTreeCommand.java Update copyright year on all license headers 2017-02-02 16:27:22 -05:00
GetTldCommand.java Update copyright year on all license headers 2017-02-02 16:27:22 -05:00
GhostrydeCommand.java Update copyright year on all license headers 2017-02-02 16:27:22 -05:00
HashCertificateCommand.java Update copyright year on all license headers 2017-02-02 16:27:22 -05:00
HelpCommand.java Update copyright year on all license headers 2017-02-02 16:27:22 -05:00
Injector.java Update copyright year on all license headers 2017-02-02 16:27:22 -05:00
ListCreditsCommand.java Update copyright year on all license headers 2017-02-02 16:27:22 -05:00
ListCursorsCommand.java Update copyright year on all license headers 2017-02-02 16:27:22 -05:00
ListDomainsCommand.java Update copyright year on all license headers 2017-02-02 16:27:22 -05:00
ListHostsCommand.java Update copyright year on all license headers 2017-02-02 16:27:22 -05:00
ListObjectsCommand.java Update copyright year on all license headers 2017-02-02 16:27:22 -05:00
ListPremiumListsCommand.java Update copyright year on all license headers 2017-02-02 16:27:22 -05:00
ListRegistrarsCommand.java Update copyright year on all license headers 2017-02-02 16:27:22 -05:00
ListReservedListsCommand.java Update copyright year on all license headers 2017-02-02 16:27:22 -05:00
ListTldsCommand.java Update copyright year on all license headers 2017-02-02 16:27:22 -05:00
LoadSnapshotCommand.java Refer to Datastore everywhere correctly by its capitalized form 2017-02-17 12:12:12 -05:00
logging.properties mv com/google/domain/registry google/registry 2016-05-13 18:55:08 -04:00
LoggingParameters.java Update copyright year on all license headers 2017-02-02 16:27:22 -05:00
MakeBillingTablesCommand.java Cut over to synthetic OneTime billing events 2017-02-09 14:24:42 -05:00
MutatingCommand.java Refer to Datastore everywhere correctly by its capitalized form 2017-02-17 12:12:12 -05:00
MutatingEppToolCommand.java Update copyright year on all license headers 2017-02-02 16:27:22 -05:00
package-info.java Update copyright year on all license headers 2017-02-02 16:27:22 -05:00
PendingEscrowCommand.java Update copyright year on all license headers 2017-02-02 16:27:22 -05:00
PublishDetailReportCommand.java Update copyright year on all license headers 2017-02-02 16:27:22 -05:00
RegistrarActivityReportCommand.java Update copyright year on all license headers 2017-02-02 16:27:22 -05:00
RegistrarContactCommand.java Update copyright year on all license headers 2017-02-02 16:27:22 -05:00
RegistryCli.java Refer to Datastore everywhere correctly by its capitalized form 2017-02-17 12:12:12 -05:00
RegistryTool.java Drop FixDomainNameserverKeysCommand 2017-03-07 13:16:34 -05:00
RegistryToolComponent.java Daggerize XsrfTokenManager 2017-02-22 11:43:10 -05:00
RegistryToolEnvironment.java Update copyright year on all license headers 2017-02-02 16:27:22 -05:00
RegistryToolModule.java Update copyright year on all license headers 2017-02-02 16:27:22 -05:00
ResaveEntitiesCommand.java Refer to Datastore everywhere correctly by its capitalized form 2017-02-17 12:12:12 -05:00
ResaveEnvironmentEntitiesCommand.java Update copyright year on all license headers 2017-02-02 16:27:22 -05:00
ResaveEppResourceCommand.java Refer to Datastore everywhere correctly by its capitalized form 2017-02-17 12:12:12 -05:00
SendEscrowReportToIcannCommand.java Update copyright year on all license headers 2017-02-02 16:27:22 -05:00
ServerSideCommand.java Update copyright year on all license headers 2017-02-02 16:27:22 -05:00
SetupOteCommand.java Update copyright year on all license headers 2017-02-02 16:27:22 -05:00
UniformRapidSuspensionCommand.java Update copyright year on all license headers 2017-02-02 16:27:22 -05:00
UpdateApplicationStatusCommand.java Refer to Datastore everywhere correctly by its capitalized form 2017-02-17 12:12:12 -05:00
UpdateClaimsNoticeCommand.java Refer to Datastore everywhere correctly by its capitalized form 2017-02-17 12:12:12 -05:00
UpdateCreditsCommand.java Update copyright year on all license headers 2017-02-02 16:27:22 -05:00
UpdateCursorsCommand.java Update copyright year on all license headers 2017-02-02 16:27:22 -05:00
UpdatePremiumListCommand.java Update copyright year on all license headers 2017-02-02 16:27:22 -05:00
UpdateRegistrarCommand.java Update copyright year on all license headers 2017-02-02 16:27:22 -05:00
UpdateReservedListCommand.java Refer to Datastore everywhere correctly by its capitalized form 2017-02-17 12:12:12 -05:00
UpdateServerLocksCommand.java Update copyright year on all license headers 2017-02-02 16:27:22 -05:00
UpdateSmdCommand.java Refer to Datastore everywhere correctly by its capitalized form 2017-02-17 12:12:12 -05:00
UpdateTldCommand.java Update copyright year on all license headers 2017-02-02 16:27:22 -05:00
UploadClaimsListCommand.java Update copyright year on all license headers 2017-02-02 16:27:22 -05:00
UserIdProvider.java Update copyright year on all license headers 2017-02-02 16:27:22 -05:00
ValidateEscrowDepositCommand.java Update copyright year on all license headers 2017-02-02 16:27:22 -05:00
ValidateLoginCredentialsCommand.java Update copyright year on all license headers 2017-02-02 16:27:22 -05:00
VerifyOteCommand.java Update copyright year on all license headers 2017-02-02 16:27:22 -05:00
WhoisQueryCommand.java Update copyright year on all license headers 2017-02-02 16:27:22 -05:00