| -rw-r--r-- | include/opkele/association.h | 2 | ||||
| -rw-r--r-- | include/opkele/consumer.h | 19 | ||||
| -rw-r--r-- | lib/consumer.cc | 4 |
3 files changed, 24 insertions, 1 deletions
diff --git a/include/opkele/association.h b/include/opkele/association.h index a8f3915..72eff5b 100644 --- a/include/opkele/association.h +++ b/include/opkele/association.h @@ -58,11 +58,13 @@ namespace opkele { virtual string server() const { return _server; } virtual string handle() const { return _handle; } virtual string assoc_type() const { return _assoc_type; } virtual secret_t secret() const { return _secret; } virtual int expires_in() const { return _expires-time(0); } virtual bool stateless() const { return _stateless; } + + virtual bool is_expired() const { return _expires<time(0); } }; } #endif /* __OPKELE_ASSOCIATION_H */ diff --git a/include/opkele/consumer.h b/include/opkele/consumer.h index 042e2d1..b9d1e54 100644 --- a/include/opkele/consumer.h +++ b/include/opkele/consumer.h @@ -10,12 +10,17 @@ */ namespace opkele { /** * implementation of basic consumer functionality + * + * @note + * The consumer uses libcurl internally, which means that if you're using + * libopkele in multithreaded environment you should call curl_global_init + * yourself before spawning any threads. */ class consumer_t { public: /** * store association. The function should be overridden in the real @@ -28,16 +33,22 @@ namespace opkele { */ virtual assoc_t store_assoc(const string& server,const string& handle,const secret_t& secret,int expires_in) = 0; /** * retrieve stored association. The function should be overridden * in the real implementation to provide persistent assocations * store. + * + * @note + * The user is responsible for handling associations expiry and + * this function should never return an expired or invalidated + * association. + * * @param server the OpenID server * @param handle association handle * @return the autho_ptr<> for the newly allocated association_t object - * @throw failed_lookup in case of error + * @throw failed_lookup if no unexpired association found */ virtual assoc_t retrieve_assoc(const string& server,const string& handle) = 0; /** * invalidate stored association. The function should be overridden * in the real implementation of the consumer. * @param server the OpenID server @@ -45,12 +56,18 @@ namespace opkele { */ virtual void invalidate_assoc(const string& server,const string& handle) = 0; /** * retrieve any unexpired association for the server. If the * function is not overridden in the real implementation, the new * association will be established for each request. + * + * @note + * The user is responsible for handling associations and this + * function should never return an expired or invalidated + * association. + * * @param server the OpenID server * @return the auto_ptr<> for the newly allocated association_t object * @throw failed_lookup in case of absence of the handle */ virtual assoc_t find_assoc(const string& server); diff --git a/lib/consumer.cc b/lib/consumer.cc index dd8e150..af309c1 100644 --- a/lib/consumer.cc +++ b/lib/consumer.cc @@ -141,12 +141,14 @@ namespace opkele { p["identity"] = delegate.empty()?iurl:delegate; if(!trust_root.empty()) p["trust_root"] = trust_root; p["return_to"] = return_to; try { string ah = find_assoc(server)->handle(); + if(ah->is_expired()) /* TODO: or should I throw some other exception to force programmer fix his implementation? */ + throw failed_lookup(OPKELE_CP_ "find_assoc() has returned expired handle"); p["assoc_handle"] = ah; }catch(failed_lookup& fl) { string ah = associate(server)->handle(); p["assoc_handle"] = ah; } if(ext) ext->checkid_hook(p,identity); @@ -158,12 +160,14 @@ namespace opkele { throw id_res_setup(OPKELE_CP_ "assertion failed, setup url provided",pin.get_param("openid.user_setup_url")); string server,delegate; retrieve_links(identity.empty()?pin.get_param("openid.identity"):canonicalize(identity),server,delegate); params_t ps; try { assoc_t assoc = retrieve_assoc(server,pin.get_param("openid.assoc_handle")); + if(assoc->is_expired()) /* TODO: or should I throw some other exception to force programmer fix his implementation? */ + throw failed_lookup(OPKELE_CP_ "retrieve_assoc() has returned expired handle"); const string& sigenc = pin.get_param("openid.sig"); vector<unsigned char> sig; util::decode_base64(sigenc,sig); const string& slist = pin.get_param("openid.signed"); string kv; string::size_type p = 0; |