io.undertow.security.impl

Class SimpleNonceManager

java.lang.Object

io.undertow.security.impl.SimpleNonceManager

All Implemented Interfaces:

NonceManager, SessionNonceManager

public class SimpleNonceManager
extends Object
implements SessionNonceManager

A default NonceManager implementation to provide reasonable single host management of nonces. This NonceManager manages nonces in two groups, the first is the group that are allocated to new requests, this group is a problem as we want to be able to limit how many we distribute so we don't have a DOS storing too many but we also don't a high number of requests to to push the other valid nonces out faster than they can be used. The second group is the set of nonces actively in use - these should be maintained as we can also maintain the nonce count and even track the next nonce once invalid. Maybe group one should be a timestamp and private key hashed together, if used with a nonce count they move to be tracked to ensure the same count is not used again - if successfully used without a nonce count add to a blacklist until expiration? A nonce used without a nonce count will essentially be single use with each request getting a new nonce.

Author:

Darran Lofthouse

Constructor Summary

Constructors

Constructor and Description
SimpleNonceManager()
SimpleNonceManager(String hashAlg)

Method Summary

Modifier and Type	Method and Description
void	associateHash(String nonce, byte[] hash) Associate the supplied hash with the nonce specified.
byte[]	lookupHash(String nonce) Retrieve the existing hash associated with the nonce specified.
String	nextNonce(String lastNonce, HttpServerExchange exchange) Select the next nonce to be sent from the server taking into account the last valid nonce.
boolean	validateNonce(String nonce, int nonceCount, HttpServerExchange exchange) Validate that a nonce can be used.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

SimpleNonceManager

public SimpleNonceManager()

SimpleNonceManager

public SimpleNonceManager(String hashAlg)

Method Detail

nextNonce

public String nextNonce(String lastNonce,
                        HttpServerExchange exchange)

Description copied from interface: NonceManager

Select the next nonce to be sent from the server taking into account the last valid nonce. It is both possible and likely that the nonce last used by the client will still be valid, in that case the same nonce will be returned.

Specified by:

nextNonce in interface NonceManager

Parameters:

lastNonce - - The last valid nonce received from the client or null if we don't already have a nonce.

Returns:

The next nonce to be sent in a challenge to the client.

See Also:

NonceManager.nextNonce(java.lang.String, io.undertow.server.HttpServerExchange)

validateNonce

public boolean validateNonce(String nonce,
                             int nonceCount,
                             HttpServerExchange exchange)

Description copied from interface: NonceManager

Validate that a nonce can be used. If the nonce can not be used but the related digest was correct then a new nonce should be returned to the client indicating that the nonce was stale. For implementations of this interface this method is not expected by be idempotent, i.e. once a nonce is validated with a specific nonceCount it is not expected that this method will return true again if the same combination is presented. This method is expected to ONLY be called if the users credentials are valid as a storage overhead could be incurred this overhead must not be accessible to unauthenticated clients.

Specified by:

validateNonce in interface NonceManager

Parameters:

nonce - - The nonce received from the client.

nonceCount - - The nonce count from the client or -1 of none specified.

Returns:

true if the nonce can be used otherwise return false.

See Also:

NonceManager.validateNonce(java.lang.String, int, io.undertow.server.HttpServerExchange)

associateHash

public void associateHash(String nonce,
                          byte[] hash)

Description copied from interface: SessionNonceManager

Associate the supplied hash with the nonce specified.

Specified by:

associateHash in interface SessionNonceManager

Parameters:

nonce - - The nonce the hash is to be associated with.

hash - - The hash to associate.

lookupHash

public byte[] lookupHash(String nonce)

Description copied from interface: SessionNonceManager

Retrieve the existing hash associated with the nonce specified. If there is no association then null should be returned.

Specified by:

lookupHash in interface SessionNonceManager

Parameters:

nonce - - The nonce the hash is required for.

Returns:

The associated hash or null if there is no association.