Package swiss.trustbroker.common.util

Class WebUtil

java.lang.Object
swiss.trustbroker.common.util.WebUtil
public class WebUtil extends Object
Log-able web input (where we do not expected any StringUtil.clean modified data) and other helpers.

  • Field Details

  • Method Details

    • getHeader

      public static String getHeader(String name, jakarta.servlet.http.HttpServletRequest request)

    • getParameter

      public static String getParameter(String name, jakarta.servlet.http.HttpServletRequest request)

    • getCookie

      public static String getCookie(String name, jakarta.servlet.http.HttpServletRequest request)

    • deduplicateSetCookie

      public static Optional<jakarta.servlet.http.Cookie> deduplicateSetCookie(Map<String,List<jakarta.servlet.http.Cookie>> addedCookies, jakarta.servlet.http.Cookie newCookie)

    • cookiesToStrings

      public static List<String> cookiesToStrings(List<jakarta.servlet.http.Cookie> cookieList)

    • cookieToString

      public static String cookieToString(jakarta.servlet.http.Cookie cookie)

    • getAny

      public static String getAny(String name, jakarta.servlet.http.HttpServletRequest request)

    • getUserAgent

      public static String getUserAgent(jakarta.servlet.http.HttpServletRequest request)

    • getClientIp

      public static String getClientIp(jakarta.servlet.http.HttpServletRequest request)

    • getClientIp

      public static String getClientIp(jakarta.servlet.http.HttpServletRequest request, boolean tagged)

    • getGatewayIp

      public static String getGatewayIp(jakarta.servlet.http.HttpServletRequest request)

    • getGatewayIps

      public static String[] getGatewayIps(jakarta.servlet.http.HttpServletRequest request)

    • getGatewayIp

      public static String getGatewayIp(jakarta.servlet.http.HttpServletRequest request, boolean tagged)

    • getClientIps

      public static String[] getClientIps(jakarta.servlet.http.HttpServletRequest request, boolean tagged)

    • getServiceContext

      public static String getServiceContext(jakarta.servlet.http.HttpServletRequest request)

    • getOrigin

      public static String getOrigin(jakarta.servlet.http.HttpServletRequest request)

    • getOriginOrReferer

      public static String getOriginOrReferer(jakarta.servlet.http.HttpServletRequest request)

    • getReferer

      public static String getReferer(jakarta.servlet.http.HttpServletRequest request)

    • addCookies

      public static void addCookies(jakarta.servlet.http.HttpServletResponse response, List<jakarta.servlet.http.Cookie> cookies)

    • getUrlWithQuery

      public static String getUrlWithQuery(jakarta.servlet.http.HttpServletRequest request)

    • urlEncodeValue

      public static String urlEncodeValue(String value)

    • urlDecodeValue

      public static String urlDecodeValue(String value)

    • appendQueryParameters

      public static String appendQueryParameters(String url, Map<String,String> parameters)

    • splitQueryParameters

      public static org.apache.commons.lang3.tuple.Pair<String,List<org.apache.commons.lang3.tuple.Pair<String,String>>> splitQueryParameters(String url, boolean htmlEncodeParameters)

    • removeQueryParameters

      public static String removeQueryParameters(String url)

    • createCookie

      public static jakarta.servlet.http.Cookie createCookie(CookieParameters params)

    • getCookieSameSite

      public static String getCookieSameSite(String defaultSameSite, String perimeterUrl, String requestUrl, Optional<Boolean> crossSiteRequest, Optional<Boolean> insecureRequest)

    • getSameSite

      public static String getSameSite(boolean isSameSite)
      Parameters:
      isSameSite - e.g. result of isSameSite(URI, URI)
      Returns:
      sameSite flag - has to be NONE if RPs that are cross site to XTB, STRICT if they are same site (LAX does not work in the former case for SAML posts, and is not as restrictive as possible in the latter case)

    • isSameSiteDynamic

      public static boolean isSameSiteDynamic(String sameSiteConfig)
      Parameters:
      sameSiteConfig -
      Returns:
      true if the config is null or has the special XTB value Dynamic

    • isSameSite

      public static boolean isSameSite(URI uri1, URI uri2)
      Returns:
      true if URIs are not null, absolute, and same site (same site and same scheme, port does not matter)
      See Also:

    • getSite

      public static String getSite(URI uri)
      Site extraction based on InternetDomainName, returns the full host name if it cannot be extracted (e.g. for localhost, localdomain)
      Returns:
      site of URI with the restriction above or null if it cannot be extracted
      See Also:
      • InternetDomainName

    • getValidatedUri

      public static URI getValidatedUri(String url)

    • getUrlHost

      public static String getUrlHost(String url)

    • isValidAbsoluteUrl

      public static boolean isValidAbsoluteUrl(String url)

    • isValidRelativeUrl

      public static boolean isValidRelativeUrl(String url)

    • getAbsoluteUrl

      public static String getAbsoluteUrl(String baseUrl, String otherUrl)

    • getValidRefererWithoutPath

      public static String getValidRefererWithoutPath(String referer)

    • getValidOrigin

      public static String getValidOrigin(String origin)

    • isNullOrigin

      public static boolean isNullOrigin(String origin)

    • getValidOrigin

      public static String getValidOrigin(URI uri)

    • isCorsRequest

      public static boolean isCorsRequest(jakarta.servlet.http.HttpServletRequest request)

    • isCrossSiteRequest

      public static Optional<Boolean> isCrossSiteRequest(jakarta.servlet.http.HttpServletRequest request)

    • addCacheHeaders

      public static void addCacheHeaders(jakarta.servlet.http.HttpServletResponse response, int maxAgeSecs, String etag, Instant lastModified, Instant now)
      "etag" must contain leading and trailing quotes
      See Also:

    • isCached

      public static boolean isCached(String etag, String ifNoneMatch, Instant cacheTime, String ifModifiedSince)
      Returns true if the resource has not been modified based on the browser headers If-None-Match/If-Modified-Since. "etag" must contain leading and trailing quotes
      See Also:

    • isAllowedOriginOrReferer

      public static boolean isAllowedOriginOrReferer(Collection<String> allowedUrls, String originOrReferer, String validatedOriginOrReferer)
      Validate origin/referer against allow list.
      Parameters:
      allowedUrls - allowed URLs (AC whitelist etc.)
      originOrReferer - original URL from request
      validatedOriginOrReferer - optional validated variant from getValidOrigin or getValidatedUri
      Returns:
      true if the URL is in the allowed list, ignoring the path (which origin would not have, and for referer we do not care about).

    • isAllowedOrigin

      public static boolean isAllowedOrigin(Collection<Collection<String>> allowedUrlSets, String origin)

    • isAllowedReferer

      public static boolean isAllowedReferer(Collection<Collection<String>> allowedUrlSets, String referer)

    • getBasicAuthorizationHeader

      public static String getBasicAuthorizationHeader(String clientId, String clientSecret)

    • getBearerAuthorizationHeader

      public static String getBearerAuthorizationHeader(String accessToken)