HttpUtils { public static boolean validateSessionKey(final HttpSession session, final Map<String, Object[]> params, final Cookie[] cookies, final String sessionKeyString) { if (session == null || sessionKeyString == null) { return false; } final String sessionKey = (String) session.getAttribute(sessionKeyString); final String sessionKeyFromCookie = HttpUtils.findCookie(cookies, sessionKeyString); String[] sessionKeyFromParams = null; if (params != null) { sessionKeyFromParams = (String[]) params.get(sessionKeyString); } if ((sessionKey == null) || (sessionKeyFromParams == null && sessionKeyFromCookie == null) || (sessionKeyFromParams != null && !sessionKey.equals(sessionKeyFromParams[0])) || (sessionKeyFromCookie != null && !sessionKey.equals(sessionKeyFromCookie))) { return false; } return true; }  static void addSecurityHeaders(final HttpServletResponse resp); static void writeHttpResponse(final HttpServletResponse resp, final String response,
                                         final Integer responseCode, final String responseType, final String jsonContentType); static String findCookie(final Cookie[] cookies, final String key); static boolean validateSessionKey(final HttpSession session, final Map<String, Object[]> params, final Cookie[] cookies, final String sessionKeyString); static final Logger s_logger; static final String UTF_8; static final String RESPONSE_TYPE_JSON; static final String RESPONSE_TYPE_XML; static final String JSON_CONTENT_TYPE; static final String XML_CONTENT_TYPE; }
@Test public void validateSessionKeyTest() { HttpSession session = null; Map<String, Object[]> params = null; String sessionKeyString = null; Cookie[] cookies = null; final String sessionKeyValue = "randomUniqueSessionID"; assertFalse(HttpUtils.validateSessionKey(session, params, cookies, sessionKeyString)); sessionKeyString = "sessionkey"; assertFalse(HttpUtils.validateSessionKey(session, params, cookies, sessionKeyString)); session = new MockHttpSession(); session.setAttribute(sessionKeyString, sessionKeyValue); assertFalse(HttpUtils.validateSessionKey(session, params, cookies, sessionKeyString)); params = null; cookies = new Cookie[]{new Cookie(sessionKeyString, sessionKeyValue)}; assertFalse(HttpUtils.validateSessionKey(session, params, cookies, "randomString")); assertTrue(HttpUtils.validateSessionKey(session, params, cookies, sessionKeyString)); params = new HashMap<String, Object[]>(); params.put(sessionKeyString, new String[]{"randomString"}); cookies = null; assertFalse(HttpUtils.validateSessionKey(session, params, cookies, sessionKeyString)); params.put(sessionKeyString, new String[]{sessionKeyValue}); assertTrue(HttpUtils.validateSessionKey(session, params, cookies, sessionKeyString)); params = new HashMap<String, Object[]>(); cookies = new Cookie[]{new Cookie(sessionKeyString, sessionKeyValue)}; params.put(sessionKeyString, new String[]{"incorrectValue"}); assertFalse(HttpUtils.validateSessionKey(session, params, cookies, sessionKeyString)); params.put(sessionKeyString, new String[]{sessionKeyValue}); assertTrue(HttpUtils.validateSessionKey(session, params, cookies, sessionKeyString)); }