Skip to content

Commit 2d7679c

Browse files
author
lawson89
committed
fix various session issues and cleanup
main change is to force spring security to always send user to welcome.mvc after login which gets their session setup properly before redirecting to start.mvc
1 parent 9bdedd0 commit 2d7679c

File tree

6 files changed

+62
-41
lines changed

6 files changed

+62
-41
lines changed

‎java/org/owasp/webgoat/HammerHead.java‎

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -182,9 +182,10 @@ public void doPost(HttpServletRequest request, HttpServletResponse response) thr
182182
clientBrowser = userAgent;
183183
}
184184
request.setAttribute("client.browser", clientBrowser);
185-
request.getSession().setAttribute(WebSession.SESSION, mySession);
185+
// removed - this is being done in updateSession call
186+
//request.getSession().setAttribute(WebSession.SESSION, mySession);
186187
// not sure why this is being set in the session?
187-
request.getSession().setAttribute(WebSession.COURSE, mySession.getCourse());
188+
//request.getSession().setAttribute(WebSession.COURSE, mySession.getCourse());
188189
String viewPage = getViewPage(mySession);
189190
logger.debug("Forwarding to view: " + viewPage);
190191
logger.debug("Screen: " + screen);
@@ -374,7 +375,8 @@ protected static void setCacheHeaders(HttpServletResponse response, int expiry)
374375
protected WebSession updateSession(HttpServletRequest request, HttpServletResponse response, ServletContext context)
375376
throws IOException {
376377
HttpSession hs;
377-
hs = request.getSession(true);
378+
// session should already be created by spring security
379+
hs = request.getSession(false);
378380

379381
logger.debug("HH Entering Session_id: " + hs.getId());
380382
// dumpSession( hs );
@@ -384,6 +386,7 @@ protected WebSession updateSession(HttpServletRequest request, HttpServletRespon
384386

385387
if ((o != null) && o instanceof WebSession) {
386388
session = (WebSession) o;
389+
hs.setAttribute(WebSession.COURSE, session.getCourse());
387390
} else {
388391
// Create new custom session and save it in the HTTP session
389392
logger.warn("HH Creating new WebSession");
@@ -394,13 +397,12 @@ protected WebSession updateSession(HttpServletRequest request, HttpServletRespon
394397
hs.setAttribute(WebSession.SESSION, session);
395398
// reset timeout
396399
hs.setMaxInactiveInterval(sessionTimeoutSeconds);
397-
398400
}
399401

402+
session.update(request, response, this.getServletName());
400403
// update last attack request info (cookies, parms)
401404
// this is so the REST services can have access to them via the session
402405
session.updateLastAttackRequestInfo(request);
403-
session.update(request, response, this.getServletName());
404406

405407
// to authenticate
406408
logger.debug("HH Leaving Session_id: " + hs.getId());

‎java/org/owasp/webgoat/service/BaseService.java‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -67,8 +67,11 @@ ExceptionInfo handleException(HttpServletRequest request, Exception ex) {
6767
public WebSession getWebSession(HttpSession session) {
6868
WebSession ws;
6969
Object o = session.getAttribute(WebSession.SESSION);
70-
if (o == null || !(o instanceof WebSession)) {
71-
throw new IllegalArgumentException("No valid session object found, has session timed out? [" + session.getId() + "]");
70+
if (o == null) {
71+
throw new IllegalArgumentException("No valid WebSession object found, has session timed out? [" + session.getId() + "]");
72+
}
73+
if (!(o instanceof WebSession)) {
74+
throw new IllegalArgumentException("Invalid WebSession object found, this is probably a bug! [" + o.getClass() + " | " + session.getId() + "]");
7275
}
7376
ws = (WebSession) o;
7477
return ws;

‎java/org/owasp/webgoat/session/WebSession.java‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -782,13 +782,16 @@ public void update(HttpServletRequest request, HttpServletResponse response, Str
782782
// System.out.println("Previous Screen 1: " + previousScreen );
783783
// FIXME: requires ?Logout=true
784784
// FIXME: doesn't work right -- no reauthentication
785+
// REMOVED - we have explicit logout now via spriing security
786+
/*
785787
if (myParser.getRawParameter(LOGOUT, null) != null) {
786788
System.out.println("Logout " + request.getUserPrincipal());
787789
eatCookies();
788790
request.getSession().invalidate();
789791
currentScreen = WELCOME;
790792
previousScreen = ERROR;
791793
}
794+
*/
792795

793796
// There are several scenarios where we want the first lesson to be loaded
794797
// 1) Previous screen is Welcome - Start of the course

‎webapp/META-INF/context.xml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,2 @@
11
<?xml version="1.0" encoding="UTF-8"?>
2-
<Context antiJARLocking="true" path=""/>
2+
<Context antiJARLocking="true" path="/WebGoat"/>

‎webapp/WEB-INF/mvc-dispatcher-servlet.xml‎

Lines changed: 41 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -1,50 +1,59 @@
11
<?xml version="1.0" encoding="UTF-8"?>
22
<beans xmlns="http://www.springframework.org/schema/beans"
3-
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
4-
xmlns:p="http://www.springframework.org/schema/p"
5-
xmlns:context="http://www.springframework.org/schema/context"
6-
xmlns:mvc="http://www.springframework.org/schema/mvc"
7-
xsi:schemaLocation="http://www.springframework.org/schema/beans
3+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
4+
xmlns:p="http://www.springframework.org/schema/p"
5+
xmlns:context="http://www.springframework.org/schema/context"
6+
xmlns:mvc="http://www.springframework.org/schema/mvc"
7+
xsi:schemaLocation="http://www.springframework.org/schema/beans
88
http://www.springframework.org/schema/beans/spring-beans-3.2.xsd
99
http://www.springframework.org/schema/context
1010
http://www.springframework.org/schema/context/spring-context-3.2.xsd
1111
http://www.springframework.org/schema/mvc
1212
http://www.springframework.org/schema/mvc/spring-mvc-3.2.xsd">
1313

14-
<context:component-scan base-package="org.owasp.webgoat.controller, org.owasp.webgoat.lessons, org.owasp.webgoat.service" />
14+
<context:component-scan base-package="org.owasp.webgoat.controller, org.owasp.webgoat.lessons, org.owasp.webgoat.service" />
1515

16-
<!--
17-
put custom validators here. E.g.:
18-
<bean class="org.owasp.webgoat.validators.MyCustomValidator" />
19-
-->
16+
<!--
17+
put custom validators here. E.g.:
18+
<bean class="org.owasp.webgoat.validators.MyCustomValidator" />
19+
-->
2020

21-
<!-- Activates various annotations to be detected in bean classes -->
22-
<context:annotation-config />
21+
<!-- Activates various annotations to be detected in bean classes -->
22+
<context:annotation-config />
2323

24-
<!-- Configures the annotation-driven Spring MVC Controller programming model. -->
25-
<mvc:annotation-driven />
24+
<!-- Configures the annotation-driven Spring MVC Controller programming model. -->
25+
<mvc:annotation-driven />
2626

27-
<!-- Import Tiles-related configuration -->
28-
<!--import resource="tiles-context.xml" /-->
27+
<!-- Import Tiles-related configuration -->
28+
<!--import resource="tiles-context.xml" /-->
2929

3030

31-
<!-- Declare a view resolver -->
32-
<!-- Take note of the order. Since we're using TilesViewResolver as well
33-
We need to define which ViewResolver is called first.
34-
We chose this InternalResourceViewResolver to be at the bottom order -->
35-
<bean
36-
id="viewResolver"
37-
class="org.springframework.web.servlet.view.InternalResourceViewResolver"
38-
p:prefix="/WEB-INF/pages/"
39-
p:suffix=".jsp"
40-
p:order="1"/>
31+
<!-- Declare a view resolver -->
32+
<!-- Take note of the order. Since we're using TilesViewResolver as well
33+
We need to define which ViewResolver is called first.
34+
We chose this InternalResourceViewResolver to be at the bottom order -->
35+
<bean
36+
id="viewResolver"
37+
class="org.springframework.web.servlet.view.InternalResourceViewResolver"
38+
p:prefix="/WEB-INF/pages/"
39+
p:suffix=".jsp"
40+
p:order="1"/>
41+
42+
<mvc:interceptors>
43+
<bean id="webContentInterceptor" class="org.springframework.web.servlet.mvc.WebContentInterceptor">
44+
<property name="cacheSeconds" value="0" />
45+
<property name="useExpiresHeader" value="true" />
46+
<property name="useCacheControlHeader" value="true" />
47+
<property name="useCacheControlNoStore" value="true" />
48+
</bean>
49+
</mvc:interceptors>
4150

4251

43-
<!-- Register the Customer.properties
44-
<bean id="messageSource"
45-
class="org.springframework.context.support.ResourceBundleMessageSource">
46-
<property name="basename" value="org/owasp/webgoat/properties/Customer" />
47-
</bean>
48-
-->
52+
<!-- Register the Customer.properties
53+
<bean id="messageSource"
54+
class="org.springframework.context.support.ResourceBundleMessageSource">
55+
<property name="basename" value="org/owasp/webgoat/properties/Customer" />
56+
</bean>
57+
-->
4958

5059
</beans>

‎webapp/WEB-INF/spring-security.xml‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,9 @@
1414
<http pattern="/css/**" security="none"/>
1515
<http pattern="/images/**" security="none"/>
1616
<http pattern="/javascript/**" security="none"/>
17+
<http pattern="/js/**" security="none"/>
18+
<http pattern="/fonts/**" security="none"/>
19+
<http pattern="/plugins/**" security="none"/>
1720
<http pattern="/favicon.ico" security="none"/>
1821
<http use-expressions="true">
1922
<intercept-url pattern="/login.mvc" access="permitAll" />
@@ -26,7 +29,8 @@
2629
default-target-url="/welcome.mvc"
2730
authentication-failure-url="/login.mvc?error"
2831
username-parameter="username"
29-
password-parameter="password" />
32+
password-parameter="password"
33+
always-use-default-target="true"/>
3034
<logout logout-url="/j_spring_security_logout" logout-success-url="/logout.mvc" />
3135
<!-- enable csrf protection -->
3236
<!--csrf/-->

0 commit comments

Comments
 (0)