CryptedUrlWebRequestCodingStrategy (Wicket Parent 1.4.17 API)

Overview

Package

Class

Use

Tree

Deprecated

Index

Help

PREV CLASS NEXT CLASS

FRAMES NO FRAMES

SUMMARY: NESTED | FIELD | CONSTR | METHOD

DETAIL: FIELD | CONSTR | METHOD

org.apache.wicket.protocol.http.request
Class CryptedUrlWebRequestCodingStrategy

java.lang.Object
  org.apache.wicket.protocol.http.request.CryptedUrlWebRequestCodingStrategy

All Implemented Interfaces:: IRequestCodingStrategy, IRequestTargetMounter

public class CryptedUrlWebRequestCodingStrategy
extends Object
implements IRequestCodingStrategy
extends Object
implements IRequestCodingStrategy

This is a request coding strategy which encrypts the URL and hence makes it impossible for users to guess what is in the url and rebuild it manually. It uses the CryptFactory registered with the application to encode and decode the URL. Hence, the coding algorithm must be a two-way one (reversible).

To register the request coding strategy you need to do the following:

 protected IRequestCycleProcessor newRequestCycleProcessor()
 {
        return new WebRequestCycleProcessor()
        {
                protected IRequestCodingStrategy newRequestCodingStrategy()
                {
                        return new CryptedUrlWebRequestCodingStrategy(new WebRequestCodingStrategy());
                }
        };
 }

Note: When trying to hack urls in the browser an exception might be caught while decoding the URL. By default, for safety reasons a very simple WicketRuntimeException is thrown. The original stack trace is only logged.

Note: by default Wicket uses KeyInSessionSunJceCryptFactory to encrypt the query-string. KeyInSessionSunJceCryptFactory creates a unique encryption key per session and uses the session as persistence store. Hence stateless pages will create a session as well and are no longer stateless. You may avoid that by implementing your own ICryptFactory which e.g. uses an application wide encryption key and thus doesn't need a session, but can potentially open your application to vulnerabilities such as CSRF attacks. You can register your own ICryptFactory via Application.getSecuritySettings().setCryptFactory().

Note: The usage of the default KeyInSessionSunJceCryptFactory will also make all bookmarkable urls generated during the user's session non-bookmarkable because they will be encrypted using a session-relative encryption key; however, bookmarkable urls are still available through their mounts.

Author:: Juergen Donnerstag

Nested Class Summary
`class`	`CryptedUrlWebRequestCodingStrategy.HackAttackException`

Constructor Summary
`CryptedUrlWebRequestCodingStrategy(IRequestCodingStrategy defaultStrategy)` Construct.

Method Summary
`void`	`addIgnoreMountPath(String path)` Partly unmounts/ignores a path that normally would map to another mount path.
`RequestParameters`	`decode(Request request)` Decode the querystring of the URL
`protected String`	`decodeURL(String url)` Decode the "x" parameter of the querystring
`CharSequence`	`encode(RequestCycle requestCycle, IRequestTarget requestTarget)` Encode the querystring of the URL
`protected CharSequence`	`encodeURL(CharSequence url)` Returns the given url encoded.
`void`	`mount(IRequestTargetUrlCodingStrategy urlCodingStrategy)` Mounts a request target with the given path.
`protected String`	`onError(Exception ex)` Deprecated. Use `onError(Exception, String)`
`protected String`	`onError(Exception ex, String url)`
`CharSequence`	`pathForTarget(IRequestTarget requestTarget)` Gets the url that the provided request target conforms to.
`protected String`	`rebuildUrl(CharSequence queryString)` In case the query string has been shortened prior to encryption, than rebuild (lengthen) the query string now.
`String`	`rewriteStaticRelativeUrl(String string)` Rewrites relative paths found in static markup attributes (`src,href,background`) of wicket pages.
`protected CharSequence`	`shortenUrl(CharSequence queryString)` Try to shorten the querystring without loosing information.
`IRequestTarget`	`targetForRequest(RequestParameters requestParameters)` Gets the request target that conforms to the given request parameters.
`void`	`unmount(String path)` Unmounts a request target.
`IRequestTargetUrlCodingStrategy`	`urlCodingStrategyForPath(String path)` Gets the encoder that was mounted on the provided path if any.

Methods inherited from class java.lang.Object
`clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait`

Constructor Detail

CryptedUrlWebRequestCodingStrategy

public CryptedUrlWebRequestCodingStrategy(IRequestCodingStrategy defaultStrategy)

Construct.

Parameters:: defaultStrategy - The default strategy most requests are forwarded to

Method Detail

decode

public RequestParameters decode(Request request)

Decode the querystring of the URL

Specified by:: decode in interface IRequestCodingStrategy

Parameters:: request - the incoming request
Returns:: a request parameters object that corresponds to the request
See Also:: IRequestCodingStrategy.decode(org.apache.wicket.Request)

encode

public CharSequence encode(RequestCycle requestCycle,
                           IRequestTarget requestTarget)

Encode the querystring of the URL

Specified by:: encode in interface IRequestCodingStrategy

Parameters:: requestCycle - the current request cycle (for efficient access); requestTarget - the request target
Returns:: the url to the provided target
See Also:: IRequestCodingStrategy.encode(org.apache.wicket.RequestCycle, org.apache.wicket.IRequestTarget)