Skip to content

Commit 9070639

Browse files
author
Mihkel Kivisild
committed
Merged web-eid-spring-boot-example into the web-eid-authtoken-validation-java repository.
WE2-932 Signed-off-by: Mihkel Kivisild <[email protected]>
1 parent be477cb commit 9070639

File tree

76 files changed

+5702
-0
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

76 files changed

+5702
-0
lines changed
+30
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,30 @@
1+
name: Maven build for example
2+
3+
on: [ push, pull_request ]
4+
5+
jobs:
6+
build:
7+
runs-on: ubuntu-latest
8+
9+
steps:
10+
- uses: actions/checkout@v4
11+
12+
- uses: actions/setup-java@v4
13+
with:
14+
distribution: zulu
15+
java-version: 17
16+
17+
- name: Cache Maven packages
18+
uses: actions/cache@v4
19+
with:
20+
path: ~/.m2
21+
key: ${{ runner.os }}-m2-v17-${{ secrets.CACHE_VERSION }}-${{ hashFiles('**/pom.xml') }}
22+
restore-keys: ${{ runner.os }}-m2-v17-${{ secrets.CACHE_VERSION }}
23+
24+
- name: Build
25+
run: mvn --batch-mode compile
26+
working-directory: ./example
27+
28+
- name: Test and package
29+
run: mvn --batch-mode package
30+
working-directory: ./example

README.md

+4
Original file line numberDiff line numberDiff line change
@@ -201,6 +201,7 @@ try {
201201
- [Basic usage](#basic-usage-1)
202202
- [Extended configuration](#extended-configuration-1)
203203
- [Differences between version 1 and version 2](#differences-between-version-1-and-version-2)
204+
- [Example using Spring Boot](#example-using-spring-boot)
204205
205206
# Introduction
206207
@@ -380,3 +381,6 @@ NonceGenerator generator = new NonceGeneratorBuilder()
380381
In version 1, the generated challenge nonces were stored in a JSR107 compatible cache. The goal of using a cache was to support stateful and stateless authentication with a universal API that uses the same underlying mechanism. However, in case the website had a CSRF vulnerability, this made the solution vulnerable to [forged login attacks](https://en.wikipedia.org/wiki/Cross-site_request_forgery#Forging_login_requests) (the attacker could trick the victim to submit the authentication token with the attacker's challenge nonce to the website using a CSRF attack, so that the victim was authenticated to the website as the attacker). To mitigate this attack, in version 2 the requirement is that the library adopter must guarantee that the authentication token is received from the same browser to which the corresponding challenge nonce was issued. The recommended solution is to use a session-backed challenge nonce store, as in the code examples above. The library no longer uses the JSR107 cache API and provides a `ChallengeNonceStore` interface instead.
381382

382383
In the internal implementation, the Web eID authentication token format changed in version 2. In version 1, the authentication token was in the OpenID X509 ID Token (JWT) format in order to be compatible with the standard OpenID Connect ID Token specification. During independent security review it was pointed out that any similarities of the Web eID authentication token to the JWT format are actually undesirable, as they would imply that the claims presented in the Web eID authentication token can be trusted and processed, while in fact they must be ignored, as they can be manipulated at the client side. The presence of the claims in the authentication token introduces a risk of vulnerabilities in case the authentication implementer decides to rely on any of them for making security critical decisions or decides to apply the same standard validation workflow that is applied to standard JWTs. Since there does not exist a standardized format for an authentication proof that corresponds to the requirements of the Web eID authentication protocol, a special purpose JSON-based format for the Web eID authentication token was adopted in version 2. The format is described in detail in the section *[Authentication token format](#authentication-token-format)*, and the full analysis of the format change is available in [this article](https://web-eid.github.io/web-eid-system-architecture-doc/web-eid-auth-token-v2-format-spec.pdf).
384+
385+
# Example using Spring Boot
386+
See the [example documentation](example/README.md).

example/.gitattributes

+19
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
* text=auto
2+
*.java text eol=lf
3+
*.xml text eol=lf
4+
*.pl text eol=lf
5+
*.py text eol=lf
6+
*.html text eol=lf
7+
*.scss text eol=lf
8+
*.css text eol=lf
9+
*.js text eol=lf
10+
*.bat text eol=crlf
11+
*.cmd text eol=crlf
12+
MANIFEST.MF text eol=lf
13+
commit-msg text eol=lf
14+
.gitattributes text eol=lf
15+
.gitignore text eol=lf
16+
*.deb filter=lfs diff=lfs merge=lfs -text
17+
*.pkg filter=lfs diff=lfs merge=lfs -text
18+
*.msi filter=lfs diff=lfs merge=lfs -text
19+
*.zip filter=lfs diff=lfs merge=lfs -text

example/.gitignore

+34
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
HELP.md
2+
target/
3+
!.mvn/wrapper/maven-wrapper.jar
4+
!**/src/main/**
5+
!**/src/test/**
6+
7+
### STS ###
8+
.apt_generated
9+
.classpath
10+
.factorypath
11+
.project
12+
.settings
13+
.springBeans
14+
.sts4-cache
15+
16+
### IntelliJ IDEA ###
17+
.idea
18+
*.iws
19+
*.iml
20+
*.ipr
21+
22+
### NetBeans ###
23+
/nbproject/private/
24+
/nbbuild/
25+
/dist/
26+
/nbdist/
27+
/.nb-gradle/
28+
build/
29+
30+
### VS Code ###
31+
.vscode/
32+
33+
### Vim ###
34+
*.swp
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,121 @@
1+
/*
2+
* Copyright 2007-present the original author or authors.
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* https://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
import java.io.*;
17+
import java.net.*;
18+
import java.nio.channels.*;
19+
import java.util.Properties;
20+
21+
public class MavenWrapperDownloader {
22+
private static final String WRAPPER_VERSION = "0.5.6";
23+
/**
24+
* Default URL to download the maven-wrapper.jar from, if no 'downloadUrl' is provided.
25+
*/
26+
private static final String DEFAULT_DOWNLOAD_URL =
27+
"https://repo.maven.apache.org/maven2/io/takari/maven-wrapper/" +
28+
WRAPPER_VERSION +
29+
"/maven-wrapper-" +
30+
WRAPPER_VERSION +
31+
".jar";
32+
33+
/**
34+
* Path to the maven-wrapper.properties file, which might contain a downloadUrl property to
35+
* use instead of the default one.
36+
*/
37+
private static final String MAVEN_WRAPPER_PROPERTIES_PATH = ".mvn/wrapper/maven-wrapper.properties";
38+
39+
/**
40+
* Path where the maven-wrapper.jar will be saved to.
41+
*/
42+
private static final String MAVEN_WRAPPER_JAR_PATH = ".mvn/wrapper/maven-wrapper.jar";
43+
44+
/**
45+
* Name of the property which should be used to override the default download url for the wrapper.
46+
*/
47+
private static final String PROPERTY_NAME_WRAPPER_URL = "wrapperUrl";
48+
49+
public static void main(String args[]) {
50+
System.out.println("- Downloader started");
51+
File baseDirectory = new File(args[0]);
52+
System.out.println("- Using base directory: " + baseDirectory.getAbsolutePath());
53+
54+
// If the maven-wrapper.properties exists, read it and check if it contains a custom
55+
// wrapperUrl parameter.
56+
File mavenWrapperPropertyFile = new File(baseDirectory, MAVEN_WRAPPER_PROPERTIES_PATH);
57+
String url = DEFAULT_DOWNLOAD_URL;
58+
if (mavenWrapperPropertyFile.exists()) {
59+
FileInputStream mavenWrapperPropertyFileInputStream = null;
60+
try {
61+
mavenWrapperPropertyFileInputStream = new FileInputStream(mavenWrapperPropertyFile);
62+
Properties mavenWrapperProperties = new Properties();
63+
mavenWrapperProperties.load(mavenWrapperPropertyFileInputStream);
64+
url = mavenWrapperProperties.getProperty(PROPERTY_NAME_WRAPPER_URL, url);
65+
} catch (IOException e) {
66+
System.out.println("- ERROR loading '" + MAVEN_WRAPPER_PROPERTIES_PATH + "'");
67+
} finally {
68+
try {
69+
if (mavenWrapperPropertyFileInputStream != null) {
70+
mavenWrapperPropertyFileInputStream.close();
71+
}
72+
} catch (IOException e) {
73+
// Ignore ...
74+
}
75+
}
76+
}
77+
System.out.println("- Downloading from: " + url);
78+
79+
File outputFile = new File(baseDirectory.getAbsolutePath(), MAVEN_WRAPPER_JAR_PATH);
80+
if (!outputFile.getParentFile().exists()) {
81+
if (!outputFile.getParentFile().mkdirs()) {
82+
System.out.println(
83+
"- ERROR creating output directory '" + outputFile.getParentFile().getAbsolutePath() + "'"
84+
);
85+
}
86+
}
87+
System.out.println("- Downloading to: " + outputFile.getAbsolutePath());
88+
try {
89+
downloadFileFromURL(url, outputFile);
90+
System.out.println("Done");
91+
System.exit(0);
92+
} catch (Throwable e) {
93+
System.out.println("- Error downloading");
94+
e.printStackTrace();
95+
System.exit(1);
96+
}
97+
}
98+
99+
private static void downloadFileFromURL(String urlString, File destination) throws Exception {
100+
if (System.getenv("MVNW_USERNAME") != null && System.getenv("MVNW_PASSWORD") != null) {
101+
String username = System.getenv("MVNW_USERNAME");
102+
char[] password = System.getenv("MVNW_PASSWORD").toCharArray();
103+
Authenticator.setDefault(
104+
new Authenticator() {
105+
106+
@Override
107+
protected PasswordAuthentication getPasswordAuthentication() {
108+
return new PasswordAuthentication(username, password);
109+
}
110+
}
111+
);
112+
}
113+
URL website = new URL(urlString);
114+
ReadableByteChannel rbc;
115+
rbc = Channels.newChannel(website.openStream());
116+
FileOutputStream fos = new FileOutputStream(destination);
117+
fos.getChannel().transferFrom(rbc, 0, Long.MAX_VALUE);
118+
fos.close();
119+
rbc.close();
120+
}
121+
}
49.5 KB
Binary file not shown.
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
distributionUrl=https://repo.maven.apache.org/maven2/org/apache/maven/apache-maven/3.6.3/apache-maven-3.6.3-bin.zip
2+
wrapperUrl=https://repo.maven.apache.org/maven2/io/takari/maven-wrapper/0.5.6/maven-wrapper-0.5.6.jar

example/.prettierrc.yaml

+7
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
trailingComma: "none"
2+
useTabs: false
3+
tabWidth: 4
4+
semi: true
5+
singleQuote: false
6+
printWidth: 120
7+

example/AUTHORS.md

+7
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
# Contributors
2+
3+
Here is the list of people involved in creating the example application.
4+
5+
Juri Letberg
6+
Mart Sõmermaa
7+
Martin Ott

example/LICENSE

+21
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
MIT License
2+
3+
Copyright (c) 2020-2023 Estonian Information System Authority
4+
5+
Permission is hereby granted, free of charge, to any person obtaining a copy
6+
of this software and associated documentation files (the "Software"), to deal
7+
in the Software without restriction, including without limitation the rights
8+
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
9+
copies of the Software, and to permit persons to whom the Software is
10+
furnished to do so, subject to the following conditions:
11+
12+
The above copyright notice and this permission notice shall be included in all
13+
copies or substantial portions of the Software.
14+
15+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16+
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17+
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18+
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19+
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20+
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21+
SOFTWARE.

0 commit comments

Comments
 (0)