[java-plugin-shibd] branch main updated: Remove state token handling in favor of separate action.

[Scott Cantor]

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch main
in repository java-plugin-shibd.

View the commit online:
http://git.shibboleth.net/view/?p=java-plugin-shibd.git;a=commit;h=bddd2cebb8f4179cbd541406cc5edd26d1605f4a

The following commit(s) were added to refs/heads/main by this push:
     new bddd2ce  Remove state token handling in favor of separate action.
bddd2ce is described below

commit bddd2cebb8f4179cbd541406cc5edd26d1605f4a
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Tue Sep 23 17:50:37 2025 -0400

    Remove state token handling in favor of separate action.
---
 .../AbstractTokenConsumerResponseAction.java       | 62 ++--------------------
 1 file changed, 5 insertions(+), 57 deletions(-)

diff --git a/sp-server-api/src/main/java/net/shibboleth/sp/profile/AbstractTokenConsumerResponseAction.java b/sp-server-api/src/main/java/net/shibboleth/sp/profile/AbstractTokenConsumerResponseAction.java
index a762a34..5077cb3 100644
--- a/sp-server-api/src/main/java/net/shibboleth/sp/profile/AbstractTokenConsumerResponseAction.java
+++ b/sp-server-api/src/main/java/net/shibboleth/sp/profile/AbstractTokenConsumerResponseAction.java
@@ -14,7 +14,6 @@
 
 package net.shibboleth.sp.profile;
 
-import java.io.IOException;
 import java.nio.charset.StandardCharsets;
 import java.util.function.Function;
 
@@ -38,7 +37,6 @@ import net.shibboleth.shared.logic.Constraint;
 import net.shibboleth.shared.primitive.LoggerFactory;
 import net.shibboleth.sp.context.AgentRequestContext;
 import net.shibboleth.sp.ddf.DDF;
-import net.shibboleth.sp.messaging.RemotedHttpServletRequestResponseContext;
 import net.shibboleth.sp.messaging.RemotedHttpServletResponse;
 
 /**
@@ -140,14 +138,14 @@ public abstract class AbstractTokenConsumerResponseAction extends AbstractApplic
             output.addmember(ConsumerConstants.SESSION_OPAQUE).string(sessionData);
         }
         
-        // Issue redirect to proper resource URL. Either recovered from protocol state,
-        // or falling back to an input parameter from the agent. Final backtop is a relative
+        // Issue redirect to proper resource URL. Either recovered from protocol state earlier
+        // or falling back to an input parameter from the agent. Final backstop is a relative
         // redirect to the site root.
         
         final RemotedHttpServletResponse remotedResponse = agentRequestContext.getRemotedHttpServletResponse();
         assert remotedResponse != null;
         
-        byte[] resource = recoverState(profileRequestContext, agentRequestContext);
+        byte[] resource = agentRequestContext.getTargetURL();
         if (resource == null || resource.length == 0) {
             final DDF in = agentRequestContext.getInput();
             if (in != null) {
@@ -156,63 +154,13 @@ public abstract class AbstractTokenConsumerResponseAction extends AbstractApplic
             if (resource == null || resource.length == 0) {
                 resource = "/".getBytes(StandardCharsets.UTF_8);
             }
+            agentRequestContext.setTargetURL(resource);
         }
         
-        ensureAgentRequestContext().setTargetURL(resource);
         output.addmember(SPConstants.TARGET).unsafe_string(resource);
         remotedResponse.sendRedirect(resource);
     }
-    
-    /**
-     * Access protocol state token and recover the original resource URL in raw form.
-     * 
-     * @param profileRequestContext profile request context
-     * @param agentRequestContext agent request context
-     * 
-     * @return original URL if available
-     */
-    @Nullable protected byte[] recoverState(@Nonnull final ProfileRequestContext profileRequestContext,
-            @Nonnull final AgentRequestContext agentRequestContext) {
-        
-        // Short-circuit if already done.
-        if (agentRequestContext.getTargetURL() != null) {
-            return agentRequestContext.getTargetURL();
-        }
-        
-        final String token = getStateToken(profileRequestContext);
-        if (token == null) {
-            log.debug("{} No state token found in protocol layer", getLogPrefix());
-            return null;
-        }
-        
-        // We do the wacky wrapping to accomodate cookie-backed state.
-        try {
-            RemotedHttpServletRequestResponseContext.loadCurrent(agentRequestContext.getRemotedHttpServletRequest(),
-                    agentRequestContext.getRemotedHttpServletResponse());
-            
-            final byte[] url = ensureApplication().getStateTokenManager().recoverFromStateToken(
-                    ensureAgent(), ensureApplication(), token);
-            log.debug("{} Requested resource recovered from state token: {}", getLogPrefix(), url);
-            agentRequestContext.setTargetURL(url);
-            return url;
-        } catch (final IOException e) {
-            log.warn("{} Exception recovering requested resource from state token", getLogPrefix(), e);
-        } finally {
-            RemotedHttpServletRequestResponseContext.clearCurrent();
-        }
-        
-        return null;
-    }
-
-    /**
-     * Get the state token from the protocol response.
-     * 
-     * @param profileRequestContext profile request context
-     * 
-     * @return state token (prior to recovery)
-     */
-    @Nullable protected abstract String getStateToken(@Nonnull final ProfileRequestContext profileRequestContext);
- 
+     
     /**
      * Get the opaque session data that the agent should bind to any session it creates for later use.
      * 

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.