public void handle(HttpExchange http) throws IOException {
/**
* Request Verification - before the request is handled a set of checks are performed for CSRF
* and XSS
*/
/*
* Completely disallow OPTIONS - if the browser suspects this is a cross site request just reject it.
*/
final String requestMethod = http.getRequestMethod();
if (OPTIONS.equals(requestMethod)) {
drain(http);
http.sendResponseHeaders(METHOD_NOT_ALLOWED, -1);
return;
}
/*
* Origin check, if it is set the Origin header should match the Host otherwise reject the request.
*
* This check is for cross site scripted GET and POST requests.
*/
final Headers headers = http.getRequestHeaders();
final URI request = http.getRequestURI();
if (headers.containsKey(ORIGIN)) {
String origin = headers.getFirst(ORIGIN);
String host = headers.getFirst(HOST);
String protocol = http.getHttpContext().getServer() instanceof HttpServer ? HTTP : HTTPS;
String allowedOrigin = protocol + "://" + host;
// This will reject multi-origin Origin headers due to the exact match.
if (origin.equals(allowedOrigin) == false) {
drain(http);
http.sendResponseHeaders(FORBIDDEN, -1);
return;
}
}
/*
* Cross Site Request Forgery makes use of a specially constructed form to pass in what appears to be
* a valid operation request - except for upload requests any inbound requests where the Content-Type
* is not application/json or application/dmr-encoded will be rejected.
*/
final boolean uploadRequest = UPLOAD_REQUEST.equals(request.getPath());
if (POST.equals(requestMethod)) {
if (uploadRequest) {
// This type of request doesn't need the content type check.
processUploadRequest(http);
return;
}
String contentType = extractContentType(headers.getFirst(CONTENT_TYPE));
if (!(APPLICATION_JSON.equals(contentType) || APPLICATION_DMR_ENCODED.equals(contentType))) {
drain(http);
http.sendResponseHeaders(FORBIDDEN, -1);
return;
}
}
processRequest(http);
}
