org.spiffyui.server
Interface AuthURLValidator


public interface AuthURLValidator

This optional interface makes it possible to provide an authentication server whitelist.

The server trusts the client to pass the URL for the authentication server. If the client is compromised (like with an XSS attack) then it could pass the URL to an untrusted authentication server and get the authentication proxy servlet to forward the user's credentials there.

This is especially dangerous since this serverlet is not governed by the same origin policy like JavaScript running in the browser. This interface allows you to provide a custom whitelist of trusted authentication servers

If you do not provide this interface the default behavior is to only allow requests to an authentication server hosted on the same web server as the Spiffy UI framework.


Method Summary
 boolean validateURI(HttpServletRequest request, java.lang.String uri)
          Validate the specified authentication server WAR against a custom whitelist.
 

Method Detail

validateURI

boolean validateURI(HttpServletRequest request,
                    java.lang.String uri)
                    throws java.net.MalformedURLException
Validate the specified authentication server WAR against a custom whitelist.

Parameters:
request - the HTTP request
uri - the URI to verify
Returns:
true if this request should be allowed and false otherwise
Throws:
java.net.MalformedURLException - if the specified URI is not a valid URI