[cpp-opensaml] branch master updated: Move correlation cookie cleanup into decoder.

[Scott Cantor]

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch master
in repository cpp-opensaml.

View the commit online:
http://git.shibboleth.net/view/?p=cpp-opensaml.git;a=commit;h=58d87586e0d6f28aa3983a1fb14a3b4e404f37ee

The following commit(s) were added to refs/heads/master by this push:
       new  58d8758   Move correlation cookie cleanup into decoder.
58d8758 is described below

commit 58d87586e0d6f28aa3983a1fb14a3b4e404f37ee
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Fri Feb 14 10:16:48 2020 -0500

    Move correlation cookie cleanup into decoder.
---
 saml/saml2/binding/impl/SAML2MessageDecoder.cpp | 28 +++++++++++++++++++++++++
 1 file changed, 28 insertions(+)

diff --git a/saml/saml2/binding/impl/SAML2MessageDecoder.cpp b/saml/saml2/binding/impl/SAML2MessageDecoder.cpp
index 18e25d9..76bae6a 100644
--- a/saml/saml2/binding/impl/SAML2MessageDecoder.cpp
+++ b/saml/saml2/binding/impl/SAML2MessageDecoder.cpp
@@ -38,6 +38,9 @@
 #include <xmltooling/io/HTTPResponse.h>
 #include <xmltooling/util/URLEncoder.h>
 
+#include <boost/lexical_cast.hpp>
+#include <boost/algorithm/string.hpp>
+
 using namespace opensaml::saml2md;
 using namespace opensaml::saml2p;
 using namespace opensaml::saml2;
@@ -66,6 +69,31 @@ void SAML2MessageDecoder::extractCorrelationID(
     Category& log = Category::getInstance(SAML_LOGCAT ".MessageDecoder.SAML2");
 
     if (!relayState.empty()) {
+
+        if (response) {
+            // CLean existing cookies.
+            int maxCookies = 20, purgedCookies = 0;
+
+            // Walk the list of cookies backwards by name.
+            const map<string,string>& cookies = request.getCookies();
+            for (map<string,string>::const_reverse_iterator i = cookies.rbegin(); i != cookies.rend(); ++i) {
+                if (boost::starts_with(i->first, "_opensaml_req_")) {
+                    if (maxCookies > 0) {
+                        // Keep it, but count it against the limit.
+                        --maxCookies;
+                    }
+                    else {
+                        // We're over the limit, so everything here and older gets cleaned up.
+                        response->setCookie(i->first.c_str(), nullptr, 0, HTTPResponse::SAMESITE_NONE);
+                        ++purgedCookies;
+                    }
+                }
+            }
+
+            if (purgedCookies > 0)
+                log.debug(string("purged ") + boost::lexical_cast<string>(purgedCookies) + " stale request correlation cookie(s) from client");
+        }
+
         string cookie_name = string("_opensaml_req_").append(
             XMLToolingConfig::getConfig().getURLEncoder()->encode(relayState.c_str()));
         const char* cookie = request.getCookie(cookie_name.c_str());

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.