[cpp-sp] branch master updated: Put correlation cookie cleanup back.

[Scott Cantor]

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch master
in repository cpp-sp.

View the commit online:
http://git.shibboleth.net/view/?p=cpp-sp.git;a=commit;h=e3b3db7e5cb40e97b63d7e0367b6757f2511fd54

The following commit(s) were added to refs/heads/master by this push:
       new  e3b3db7   Put correlation cookie cleanup back.
e3b3db7 is described below

commit e3b3db7e5cb40e97b63d7e0367b6757f2511fd54
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Mon Feb 24 20:45:00 2020 -0500

    Put correlation cookie cleanup back.
---
 shibsp/handler/impl/AbstractHandler.cpp | 44 +++++++++++++++++++++------------
 1 file changed, 28 insertions(+), 16 deletions(-)

diff --git a/shibsp/handler/impl/AbstractHandler.cpp b/shibsp/handler/impl/AbstractHandler.cpp
index c76b007..d21c42c 100644
--- a/shibsp/handler/impl/AbstractHandler.cpp
+++ b/shibsp/handler/impl/AbstractHandler.cpp
@@ -195,38 +195,50 @@ void Handler::cleanRelayState(
         }
     }
 
-    if (!mech.first || !mech.second || strncmp(mech.second, "cookie", 6))
-        return;
-
-    int maxCookies = 20,purgedCookies = 0;
-
-    mech.second += 6;
-    if (*mech.second == ':' && isdigit(*(++mech.second))) {
-        maxCookies = atoi(mech.second);
-        if (maxCookies == 0) {
-            maxCookies = 20;
+    int maxRSCookies = 20,purgedRSCookies = 0;
+    int maxOSCookies = 20,purgedOSCookies = 0;
+
+    if (mech.first && !strncmp(mech.second, "cookie", 6)) {
+        mech.second += 6;
+        if (*mech.second == ':' && isdigit(*(++mech.second))) {
+            maxRSCookies = maxOSCookies = atoi(mech.second);
+            if (maxRSCookies == 0) {
+                maxRSCookies = maxOSCookies = 20;
+            }
         }
     }
 
     // Walk the list of cookies backwards by name.
     const map<string,string>& cookies = request.getCookies();
     for (map<string,string>::const_reverse_iterator i = cookies.rbegin(); i != cookies.rend(); ++i) {
-        // Process relay state cookies only.
         if (starts_with(i->first, "_shibstate_")) {
-            if (maxCookies > 0) {
+            if (maxRSCookies > 0) {
+                // Keep it, but count it against the limit.
+                --maxRSCookies;
+            }
+            else {
+                // We're over the limit, so everything here and older gets cleaned up.
+                response.setCookie(i->first.c_str(), nullptr, 0, HTTPResponse::SAMESITE_NONE);
+                ++purgedRSCookies;
+            }
+        }
+        else if (starts_with(i->first, "_opensaml_req_")) {
+            if (maxOSCookies > 0) {
                 // Keep it, but count it against the limit.
-                --maxCookies;
+                --maxOSCookies;
             }
             else {
                 // We're over the limit, so everything here and older gets cleaned up.
                 response.setCookie(i->first.c_str(), nullptr, 0, HTTPResponse::SAMESITE_NONE);
-                ++purgedCookies;
+                ++purgedOSCookies;
             }
         }
     }
 
-    if (purgedCookies > 0)
-        log(SPRequest::SPDebug, string("purged ") + lexical_cast<string>(purgedCookies) + " stale relay state cookie(s) from client");
+    if (purgedRSCookies > 0)
+        log(SPRequest::SPDebug, string("purged ") + lexical_cast<string>(purgedRSCookies) + " stale relay state cookie(s) from client");
+    if (purgedOSCookies > 0)
+        log(SPRequest::SPDebug, string("purged ") + lexical_cast<string>(purgedOSCookies) + " stale request correlation cookie(s) from client");
 }
 
 void Handler::preserveRelayState(const Application& application, HTTPResponse& response, string& relayState) const

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.