summaryrefslogtreecommitdiffabout
authorMichael Krelin <hacker@klever.net>2007-08-09 11:23:36 (UTC)
committer Michael Krelin <hacker@klever.net>2007-08-09 11:23:36 (UTC)
commit65bab7c9f984d6fe45ce72e7db014c40eba4d240 (patch) (side-by-side diff)
tree28c4791aea6b7dc404ad0d27050c34f447a84314
parent1f347795ef5eba50892fd777c173a2a6db1755f2 (diff)
downloadlibopkele-65bab7c9f984d6fe45ce72e7db014c40eba4d240.zip
libopkele-65bab7c9f984d6fe45ce72e7db014c40eba4d240.tar.gz
libopkele-65bab7c9f984d6fe45ce72e7db014c40eba4d240.tar.bz2
associations robustness improvements and documentation updates
Diffstat (more/less context) (show whitespace changes)
-rw-r--r--include/opkele/association.h2
-rw-r--r--include/opkele/consumer.h19
-rw-r--r--lib/consumer.cc4
3 files changed, 24 insertions, 1 deletions
diff --git a/include/opkele/association.h b/include/opkele/association.h
index a8f3915..72eff5b 100644
--- a/include/opkele/association.h
+++ b/include/opkele/association.h
@@ -60,8 +60,10 @@ namespace opkele {
virtual string assoc_type() const { return _assoc_type; }
virtual secret_t secret() const { return _secret; }
virtual int expires_in() const { return _expires-time(0); }
virtual bool stateless() const { return _stateless; }
+
+ virtual bool is_expired() const { return _expires<time(0); }
};
}
diff --git a/include/opkele/consumer.h b/include/opkele/consumer.h
index 042e2d1..b9d1e54 100644
--- a/include/opkele/consumer.h
+++ b/include/opkele/consumer.h
@@ -12,8 +12,13 @@
namespace opkele {
/**
* implementation of basic consumer functionality
+ *
+ * @note
+ * The consumer uses libcurl internally, which means that if you're using
+ * libopkele in multithreaded environment you should call curl_global_init
+ * yourself before spawning any threads.
*/
class consumer_t {
public:
@@ -30,12 +35,18 @@ namespace opkele {
/**
* retrieve stored association. The function should be overridden
* in the real implementation to provide persistent assocations
* store.
+ *
+ * @note
+ * The user is responsible for handling associations expiry and
+ * this function should never return an expired or invalidated
+ * association.
+ *
* @param server the OpenID server
* @param handle association handle
* @return the autho_ptr<> for the newly allocated association_t object
- * @throw failed_lookup in case of error
+ * @throw failed_lookup if no unexpired association found
*/
virtual assoc_t retrieve_assoc(const string& server,const string& handle) = 0;
/**
* invalidate stored association. The function should be overridden
@@ -47,8 +58,14 @@ namespace opkele {
/**
* retrieve any unexpired association for the server. If the
* function is not overridden in the real implementation, the new
* association will be established for each request.
+ *
+ * @note
+ * The user is responsible for handling associations and this
+ * function should never return an expired or invalidated
+ * association.
+ *
* @param server the OpenID server
* @return the auto_ptr<> for the newly allocated association_t object
* @throw failed_lookup in case of absence of the handle
*/
diff --git a/lib/consumer.cc b/lib/consumer.cc
index dd8e150..af309c1 100644
--- a/lib/consumer.cc
+++ b/lib/consumer.cc
@@ -143,8 +143,10 @@ namespace opkele {
p["trust_root"] = trust_root;
p["return_to"] = return_to;
try {
string ah = find_assoc(server)->handle();
+ if(ah->is_expired()) /* TODO: or should I throw some other exception to force programmer fix his implementation? */
+ throw failed_lookup(OPKELE_CP_ "find_assoc() has returned expired handle");
p["assoc_handle"] = ah;
}catch(failed_lookup& fl) {
string ah = associate(server)->handle();
p["assoc_handle"] = ah;
@@ -160,8 +162,10 @@ namespace opkele {
retrieve_links(identity.empty()?pin.get_param("openid.identity"):canonicalize(identity),server,delegate);
params_t ps;
try {
assoc_t assoc = retrieve_assoc(server,pin.get_param("openid.assoc_handle"));
+ if(assoc->is_expired()) /* TODO: or should I throw some other exception to force programmer fix his implementation? */
+ throw failed_lookup(OPKELE_CP_ "retrieve_assoc() has returned expired handle");
const string& sigenc = pin.get_param("openid.sig");
vector<unsigned char> sig;
util::decode_base64(sigenc,sig);
const string& slist = pin.get_param("openid.signed");