// Set an appropriate CORS header if requested and if allowed
private void setCorsHeader(HttpServletRequest pReq, HttpServletResponse pResp) {
String origin = requestHandler.extractCorsOrigin(pReq.getHeader("Origin"));
if (origin != null) {
pResp.setHeader("Access-Control-Allow-Origin", origin);
pResp.setHeader("Access-Control-Allow-Credentials", "true");
}
}
/**
* OPTION requests are treated as CORS preflight requests
*
* @param req the original request
* @param resp the response the answer are written to
*/
@Override
protected void doOptions(HttpServletRequest req, HttpServletResponse resp)
throws ServletException, IOException {
Map<String, String> responseHeaders =
requestHandler.handleCorsPreflightRequest(
req.getHeader("Origin"), req.getHeader("Access-Control-Request-Headers"));
for (Map.Entry<String, String> entry : responseHeaders.entrySet()) {
resp.setHeader(entry.getKey(), entry.getValue());
}
}
private void setNoCacheHeaders(HttpServletResponse pResp) {
pResp.setHeader("Cache-Control", "no-cache");
pResp.setHeader("Pragma", "no-cache");
// Check for a date header and set it accordingly to the recommendations of
// RFC-2616 (http://tools.ietf.org/html/rfc2616#section-14.21)
//
// "To mark a response as "already expired," an origin server sends an
// Expires date that is equal to the Date header value. (See the rules
// for expiration calculations in section 13.2.4.)"
//
// See also #71
long now = System.currentTimeMillis();
pResp.setDateHeader("Date", now);
// 1h in the past since it seems, that some servlet set the date header on their
// own so that it cannot be guaranteed that these headers are really equals.
// It happened on Tomcat that Date: was finally set *before* Expires: in the final
// answers some times which seems to be an implementation peculiarity from Tomcat
pResp.setDateHeader("Expires", now - 3600000);
}
public static void setBrowserInfiniteCookie(
HttpServletResponse response, String value, int nServerPort) {
String params = null;
if ((443 == nServerPort) || (8443 == nServerPort)) {
params = "; path=/; HttpOnly; Secure";
} else {
params = "; path=/; HttpOnly";
}
response.setHeader("SET-COOKIE", "infinitecookie=" + value + params);
// (all this is needed in order to support HTTP only cookies)
} // TESTED
/**
* Sets a status and sends an info message.
*
* @param code status code
* @param message info message
* @param error treat as error (use web server standard output)
* @throws IOException I/O exception
*/
public void status(final int code, final String message, final boolean error) throws IOException {
try {
log(message, code);
res.resetBuffer();
if (code == SC_UNAUTHORIZED) res.setHeader(WWW_AUTHENTICATE, BASIC);
if (error && code >= SC_BAD_REQUEST) {
res.sendError(code, message);
} else {
res.setStatus(code);
if (message != null) res.getOutputStream().write(token(message));
}
} catch (final IllegalStateException ex) {
log(Util.message(ex), SC_INTERNAL_SERVER_ERROR);
}
}
/** Common request handling. */
public void service(HttpServletRequest req, HttpServletResponse resp)
throws ServletException, IOException {
resetState();
boolean success = false;
HttpSession session = req.getSession(false);
try {
this.req = req;
this.resp = resp;
if (log.isDebug()) {
logParams();
}
resp.setContentType("text/html");
if (!mayPageBeCached()) {
resp.setHeader("pragma", "no-cache");
resp.setHeader("Cache-control", "no-cache");
}
reqURL = new URL(UrlUtil.getRequestURL(req));
clientAddr = getLocalIPAddr();
// check that current user has permission to run this servlet
if (!isServletAllowed(myServletDescr())) {
displayWarningInLieuOfPage("You are not authorized to use " + myServletDescr().heading);
return;
}
// check whether servlet is disabled
String reason = ServletUtil.servletDisabledReason(myServletDescr().getServletName());
if (reason != null) {
displayWarningInLieuOfPage("This function is disabled. " + reason);
return;
}
if (session != null) {
session.setAttribute(SESSION_KEY_RUNNING_SERVLET, getHeading());
String reqHost = req.getRemoteHost();
String forw = req.getHeader(HttpFields.__XForwardedFor);
if (!StringUtil.isNullString(forw)) {
reqHost += " (proxies for " + forw + ")";
}
session.setAttribute(SESSION_KEY_REQUEST_HOST, reqHost);
}
lockssHandleRequest();
success = (errMsg == null);
} catch (ServletException e) {
log.error("Servlet threw", e);
throw e;
} catch (IOException e) {
log.error("Servlet threw", e);
throw e;
} catch (RuntimeException e) {
log.error("Servlet threw", e);
throw e;
} finally {
if (session != null) {
session.setAttribute(SESSION_KEY_RUNNING_SERVLET, null);
session.setAttribute(LockssFormAuthenticator.__J_AUTH_ACTIVITY, TimeBase.nowMs());
}
if ("please".equalsIgnoreCase(req.getHeader("X-Lockss-Result"))) {
log.debug3("X-Lockss-Result: " + (success ? "Ok" : "Fail"));
resp.setHeader("X-Lockss-Result", success ? "Ok" : "Fail");
}
resetMyLocals();
resetLocals();
}
}
