github
/
OpenID-Connect-Java-Spring-Server
mirror of https://github.com/mitreid-connect/OpenID-Connect-Java-Spring-Server
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

fixed issuer on login page, added CSRF to login / logout, closes #870, closes #824, closes #875

pull/924/head
Justin Richer 2015-10-01 21:16:38 -04:00
parent ca23521c3b
commit 43e9fbc29c
3 changed files with 18 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
openid-connect-server-webapp/src/main/webapp/WEB-INF/tags/topbar.tag
View File

@ -89,7 +89,7 @@
<ul class="dropdown-menu pull-right"> <ul class="dropdown-menu pull-right">
<li><a href="manage/#user/profile" data-toggle="collapse" data-target=".nav-collapse">${ longName }</a></li> <li><a href="manage/#user/profile" data-toggle="collapse" data-target=".nav-collapse">${ longName }</a></li>
<li class="divider"></li> <li class="divider"></li>
<li><a href="logout" data-toggle="collapse" data-target=".nav-collapse"><i class="icon-remove"></i> <spring:message code="topbar.logout"/></a></li> <li><a href="" data-toggle="collapse" data-target=".nav-collapse" class="logoutLink"><i class="icon-remove"></i> <spring:message code="topbar.logout"/></a></li>
</ul> </ul>
</li> </li>
</security:authorize> </security:authorize>
@ -105,7 +105,7 @@
<security:authorize access="hasRole('ROLE_USER')"> <security:authorize access="hasRole('ROLE_USER')">
<li><a href="manage/#user/profile">${ longName }</a></li> <li><a href="manage/#user/profile">${ longName }</a></li>
<li class="divider"></li> <li class="divider"></li>
<li><a href="logout"><i class="icon-remove"></i> <spring:message code="topbar.logout"/></a></li> <li><a href="" class="logoutLink"><i class="icon-remove"></i> <spring:message code="topbar.logout"/></a></li>
</security:authorize> </security:authorize>
<security:authorize access="!hasRole('ROLE_USER')"> <security:authorize access="!hasRole('ROLE_USER')">
<li> <li>
@ -113,9 +113,21 @@
</li> </li>
</security:authorize> </security:authorize>
</ul> </ul>
<form action="${ config.issuer }${ config.issuer.endsWith('/') ? '' : '/' }logout" method="POST" class="hidden" id="logoutForm">
<input type="hidden" name="${_csrf.parameterName}" value="${_csrf.token}" />
</form>
</div><!--/.nav-collapse --> </div><!--/.nav-collapse -->
</c:if> </c:if>
</div> </div>
</div> </div>
</div> </div>
<script type="text/javascript">
$(document).ready(function() {
$('.logoutLink').on('click', function(e) {
e.preventDefault();
$('#logoutForm').submit();
});
});
</script>

5
openid-connect-server-webapp/src/main/webapp/WEB-INF/user-context.xml
View File

@ -37,10 +37,6 @@
<mvc:view-controller path="/login" view-name="login" /> <mvc:view-controller path="/login" view-name="login" />
<security:http pattern="/login**" use-expressions="true" entry-point-ref="http403EntryPoint">
<security:intercept-url pattern="/login**" access="permitAll"/>
</security:http>
<security:http disable-url-rewriting="true" use-expressions="true"> <security:http disable-url-rewriting="true" use-expressions="true">
<security:form-login login-page="/login" authentication-failure-url="/login?error=failure" authentication-success-handler-ref="authenticationTimeStamper" /> <security:form-login login-page="/login" authentication-failure-url="/login?error=failure" authentication-success-handler-ref="authenticationTimeStamper" />
<security:intercept-url pattern="/authorize" access="hasRole('ROLE_USER')" /> <security:intercept-url pattern="/authorize" access="hasRole('ROLE_USER')" />
@ -52,6 +48,7 @@
<security:headers> <security:headers>
<security:frame-options policy="DENY" /> <security:frame-options policy="DENY" />
</security:headers> </security:headers>
<security:csrf />
</security:http> </security:http>
</beans> </beans>

4
openid-connect-server-webapp/src/main/webapp/WEB-INF/views/login.jsp
View File

@ -26,8 +26,7 @@ $(document).ready(function() {
<div class="row-fluid"> <div class="row-fluid">
<div class="span6 offset1 well"> <div class="span6 offset1 well">
<form action="<%=request.getContextPath()%>/j_spring_security_check" <form action="${ config.issuer }${ config.issuer.endsWith('/') ? '' : '/' }j_spring_security_check" method="POST">
method="POST">
<div> <div>
<div class="input-prepend input-block-level"> <div class="input-prepend input-block-level">
<span class="add-on"><i class="icon-user"></i></span> <span class="add-on"><i class="icon-user"></i></span>
@ -41,6 +40,7 @@ $(document).ready(function() {
</div> </div>
</div> </div>
<div> <div>
<input type="hidden" name="${_csrf.parameterName}" value="${_csrf.token}" />
<input type="submit" class="btn" value="Login" name="submit"> <input type="submit" class="btn" value="Login" name="submit">
</div> </div>
</form> </form>