package oasis.web.authn;

import java.io.IOException;
import java.net.URI;

import javax.annotation.Priority;
import javax.inject.Inject;
import javax.ws.rs.container.ContainerRequestContext;
import javax.ws.rs.container.ContainerRequestFilter;
import javax.ws.rs.core.Response;
import javax.ws.rs.ext.Provider;

import oasis.urls.Urls;
import oasis.web.resteasy.Resteasy1099;

/**
 * Enforce the use of the {@link oasis.urls.Urls#canonicalBaseUri() canonical base URI}
 * for cookie-based authentication.
 */
@User
@Provider
@Priority(0)
public class UserCanonicalBaseUriFilter implements ContainerRequestFilter {

  @Inject Urls urls;

  @Override
  public void filter(ContainerRequestContext requestContext) throws IOException {
    if (!urls.canonicalBaseUri().isPresent()) {
      return; // nothing to do
    }
    if (requestContext.getUriInfo().getBaseUri().equals(urls.canonicalBaseUri().get())) {
      return; // we're already on the canonical base URI
    }

    URI relativeUri = Resteasy1099.getBaseUri(requestContext.getUriInfo()).relativize(requestContext.getUriInfo().getRequestUri());
    URI canonicalUri = urls.canonicalBaseUri().get().resolve(relativeUri);

    requestContext.abortWith(Response.status(Response.Status.MOVED_PERMANENTLY)
        .location(canonicalUri)
        .build());
  }
}

package oasis.web.authn;

import java.io.IOException;
import java.net.URI;

import javax.annotation.Priority;
import javax.inject.Inject;
import javax.ws.rs.container.ContainerRequestContext;
import javax.ws.rs.container.ContainerRequestFilter;
import javax.ws.rs.core.Response;
import javax.ws.rs.ext.Provider;

import oasis.urls.Urls;
import oasis.web.resteasy.Resteasy1099;

/**
 * Enforce the use of the {@link oasis.urls.Urls#canonicalBaseUri() canonical base URI}
 * for cookie-based authentication.
 */
@User
@Provider
@Priority(0)
public class UserCanonicalBaseUriFilter implements ContainerRequestFilter {

  @Inject Urls urls;

  @Override
  public void filter(ContainerRequestContext requestContext) throws IOException {
    if (!urls.canonicalBaseUri().isPresent()) {
      return; // nothing to do
    }
    if (Resteasy1099.getBaseUri(requestContext.getUriInfo()).equals(urls.canonicalBaseUri().get())) {
      return; // we're already on the canonical base URI
    }

    URI relativeUri = Resteasy1099.getBaseUri(requestContext.getUriInfo()).relativize(requestContext.getUriInfo().getRequestUri());
    URI canonicalUri = urls.canonicalBaseUri().get().resolve(relativeUri);

    requestContext.abortWith(Response.status(Response.Status.MOVED_PERMANENTLY)
        .location(canonicalUri)
        .build());
  }
}

Fix redirect loops in HTTPS when canonical-base-uri is configured
Fix redirect loops in HTTPS when canonical-base-uri is configured

Once again, we're hit by RESTEASY-1099; this time when comparing the
base URI with the expected "canonical base URI". When the requested
URI had a query-string, the comparison failed and we tried to redirect
to actually the exact same URI as result.

Change-Id: If4ec9832f98b79ef6c3a9a8a9c2b0ca258b3debd
