|
Spiffy UI Framework | |||||||||
PREV CLASS NEXT CLASS | FRAMES NO FRAMES | |||||||||
SUMMARY: NESTED | FIELD | CONSTR | METHOD | DETAIL: FIELD | CONSTR | METHOD |
public interface AuthURLValidator
This optional interface makes it possible to provide an authentication server whitelist.
The server trusts the client to pass the URL for the authentication server. If the client is compromised (like with an XSS attack) then it could pass the URL to an untrusted authentication server and get the authentication proxy servlet to forward the user's credentials there.
This is especially dangerous since this serverlet is not governed by the same origin policy like JavaScript running in the browser. This interface allows you to provide a custom whitelist of trusted authentication servers
If you do not provide this interface the default behavior is to only allow requests to an authentication server hosted on the same web server as the Spiffy UI framework.
Method Summary | |
---|---|
boolean |
validateURI(HttpServletRequest request,
java.lang.String uri)
Validate the specified authentication server WAR against a custom whitelist. |
Method Detail |
---|
boolean validateURI(HttpServletRequest request, java.lang.String uri) throws java.net.MalformedURLException
request
- the HTTP requesturi
- the URI to verify
java.net.MalformedURLException
- if the specified URI is not a valid URI
|
Spiffy UI Framework | |||||||||
PREV CLASS NEXT CLASS | FRAMES NO FRAMES | |||||||||
SUMMARY: NESTED | FIELD | CONSTR | METHOD | DETAIL: FIELD | CONSTR | METHOD |