1   package com.atlassian.seraph.service.rememberme;
2   
3   import javax.servlet.ServletContext;
4   import javax.servlet.http.HttpServletRequest;
5   
6   import com.atlassian.seraph.config.SecurityConfig;
7   import com.atlassian.seraph.config.SecurityConfigFactory;
8   import com.atlassian.seraph.spi.rememberme.RememberMeConfiguration;
9   import com.atlassian.seraph.util.ServerInformationParser;
10  
11  import org.apache.commons.lang.StringUtils;
12  
13  import static com.atlassian.seraph.util.ServerInformationParser.ServerInformation;
14  
15  /**
16   * This default implementation of {@link com.atlassian.seraph.spi.rememberme.RememberMeConfiguration}
17   */
18  public class DefaultRememberMeConfiguration implements RememberMeConfiguration
19  {
20      public static final int TWO_WEEKS = 2 * 7 * 24 * 60 * 60;
21      private final SecurityConfig config;
22  
23  
24      public DefaultRememberMeConfiguration()
25      {
26          this(SecurityConfigFactory.getInstance());
27      }
28  
29      public DefaultRememberMeConfiguration(final SecurityConfig config)
30      {
31          this.config = config;
32      }
33  
34      /**
35       * This app may needs to determine this.  See JRA-10508.  By default we load it from the same place that Serpah uses
36       * for backwards compatibility.
37       *
38       * @return true if {@link javax.servlet.http.Cookie#setSecure(boolean)} should be called with true
39       */
40      public boolean isInsecureCookieAlwaysUsed()
41      {
42          return config.isInsecureCookie();
43      }
44  
45  
46      /**
47       * By default we take the conservative route and not use HttpOnly cookies.  However an application
48       * can decide to make it more secure and return true.  We had initial troubles in JIRA and hence
49       * we took the conservative route.  Eventually we want to get around these problems 
50       * 
51       * @return
52       */
53      public boolean isCookieHttpOnly(HttpServletRequest httpServletRequest)
54      {
55          ServletContext context = httpServletRequest.getSession().getServletContext();
56  
57          try
58          {
59              ServerInformation serverInfo = ServerInformationParser.parse(context.getServerInfo());
60  
61              // Apache Tomcat versions 5.5.28+ and 6.0.19+ support httpOnly cookies
62              return serverInfo.isApacheTomcat() &&
63                  ((serverInfo.getVersion().startsWith("5") && serverInfo.getVersion().compareTo("5.5.28") >= 0) ||
64                   (serverInfo.getVersion().startsWith("6") && serverInfo.getVersion().compareTo("6.0.19") >= 0) );
65          }
66          catch (IllegalArgumentException e)
67          {
68              return false;
69          }
70      }
71  
72      public String getCookieName()
73      {
74          return config.getLoginCookieKey();
75      }
76  
77      public int getCookieMaxAgeInSeconds()
78      {
79          int maxAge = config.getAutoLoginCookieAge();
80          if (maxAge <= 0)
81          {
82              maxAge = TWO_WEEKS;
83          }
84          return maxAge;
85      }
86  
87      public String getCookieDomain(final HttpServletRequest httpServletRequest)
88      {
89          return null;
90      }
91  
92      public String getCookiePath(final HttpServletRequest httpServletRequest)
93      {
94          final String path = config.getLoginCookiePath();
95          if (path != null)
96          {
97              return path;
98          }
99          final String contextPath = httpServletRequest.getContextPath();
100         if (StringUtils.isBlank(contextPath))
101         {
102             return "/";
103         }
104         return contextPath;
105     }
106 }