[jbossweb-commits] JBossWeb SVN: r2589 - in branches/7.4.x: src and 1 other directories.
Author: aogburn
Date: 2015-02-03 11:39:06 -0500 (Tue, 03 Feb 2015)
New Revision: 2589
Modified:
branches/7.4.x/
branches/7.4.x/src/
branches/7.4.x/src/main/java/org/apache/catalina/authenticator/DigestAuthenticator.java
branches/7.4.x/src/main/java/org/apache/catalina/authenticator/SingleSignOn.java
Log:
[JBWEB-258] Ensure concurrent requests that require DIGEST auth receive unique nonces
Property changes on: branches/7.4.x
___________________________________________________________________
Added: svn:mergeinfo
+ /branches/7.5.x:2588
Property changes on: branches/7.4.x/src
___________________________________________________________________
Modified: svn:mergeinfo
- /branches/8.0.x/src:2529
+ /branches/7.5.x/src:2588
/branches/8.0.x/src:2529
Modified:
branches/7.4.x/src/main/java/org/apache/catalina/authenticator/DigestAuthenticator.java
===================================================================
---
branches/7.4.x/src/main/java/org/apache/catalina/authenticator/DigestAuthenticator.java 2015-02-03
16:17:45 UTC (rev 2588)
+++
branches/7.4.x/src/main/java/org/apache/catalina/authenticator/DigestAuthenticator.java 2015-02-03
16:39:06 UTC (rev 2589)
@@ -90,6 +90,14 @@
/**
+ * The last timestamp used to generate a nonce. Each nonce should get a
+ * unique timestamp.
+ */
+ protected long lastTimestamp = 0;
+ protected final Object lastTimestampLock = new Object();
+
+
+ /**
* Maximum number of server nonces to keep in the cache. If not specified,
* the default value of 1000 is used.
*/
@@ -303,6 +311,13 @@
long currentTime = System.currentTimeMillis();
+ synchronized (lastTimestampLock) {
+ if (currentTime > lastTimestamp) {
+ lastTimestamp = currentTime;
+ } else {
+ currentTime = ++lastTimestamp;
+ }
+ }
String ipTimeKey =
request.getRemoteAddr() + ":" + currentTime + ":" +
getKey();
Property changes on:
branches/7.4.x/src/main/java/org/apache/catalina/authenticator/SingleSignOn.java
___________________________________________________________________
Modified: svn:mergeinfo
-
/branches/7.5.x/src/main/java/org/apache/catalina/authenticator/SingleSignOn.java:2574
/branches/8.0.x/src/main/java/org/apache/catalina/authenticator/SingleSignOn.java:2529
+
/branches/7.5.x/src/main/java/org/apache/catalina/authenticator/SingleSignOn.java:2574,2588
/branches/8.0.x/src/main/java/org/apache/catalina/authenticator/SingleSignOn.java:2529