From d85819e949df28fdb1aa5cd6d6e0ceb4859e6fcf Mon Sep 17 00:00:00 2001 From: IN40068837 Date: Wed, 12 Mar 2025 16:36:07 +0530 Subject: [PATCH 1/4] jwt implementation modify --- .../controller/users/IEMRAdminController.java | 21 +++--- .../com/iemr/common/utils/CookieUtil.java | 68 ++++++++++--------- .../utils/JwtUserIdValidationFilter.java | 2 +- 3 files changed, 46 insertions(+), 45 deletions(-) diff --git a/src/main/java/com/iemr/common/controller/users/IEMRAdminController.java b/src/main/java/com/iemr/common/controller/users/IEMRAdminController.java index c05436e1..1d86e57f 100644 --- a/src/main/java/com/iemr/common/controller/users/IEMRAdminController.java +++ b/src/main/java/com/iemr/common/controller/users/IEMRAdminController.java @@ -152,9 +152,8 @@ public String userAuthenticate( JSONObject serviceRoleMap = new JSONObject(); JSONArray serviceRoleList = new JSONArray(); JSONObject previlegeObj = new JSONObject(); - if (m_User.getUserName() != null - && (m_User.getDoLogout() == null || !m_User.getDoLogout()) - && (m_User.getWithCredentials() != null && m_User.getWithCredentials())) { + if (m_User.getUserName() != null && (m_User.getDoLogout() == null || !m_User.getDoLogout()) + && (m_User.getWithCredentials() != null && m_User.getWithCredentials())) { String tokenFromRedis = getConcurrentCheckSessionObjectAgainstUser( m_User.getUserName().trim().toLowerCase()); if (tokenFromRedis != null) { @@ -167,19 +166,17 @@ public String userAuthenticate( if (mUser.size() == 1) { String Jwttoken = jwtUtil.generateToken(m_User.getUserName(), mUser.get(0).getUserID().toString()); logger.info("jwt token is:" + Jwttoken); - + User user = new User(); // Assuming the Users class exists - user.setUserID(mUser.get(0).getUserID()); - user.setUserName(mUser.get(0).getUserName()); - - String redisKey = "user_" + mUser.get(0).getUserID(); // Use user ID to create a unique key + user.setUserID(mUser.get(0).getUserID()); + user.setUserName(mUser.get(0).getUserName()); - // Store the user in Redis (set a TTL of 30 minutes) - redisTemplate.opsForValue().set(redisKey, user, 30, TimeUnit.MINUTES); + String redisKey = "user_" + mUser.get(0).getUserID(); // Use user ID to create a unique key - // Set Jwttoken in the response cookie - cookieUtil.addJwtTokenToCookie(Jwttoken, httpResponse, request); + // Store the user in Redis (set a TTL of 30 minutes) + redisTemplate.opsForValue().set(redisKey, user, 30, TimeUnit.MINUTES); + cookieUtil.addJwtTokenToCookie(Jwttoken, httpResponse, request); createUserMapping(mUser.get(0), resMap, serviceRoleMultiMap, serviceRoleMap, serviceRoleList, previlegeObj); } else { diff --git a/src/main/java/com/iemr/common/utils/CookieUtil.java b/src/main/java/com/iemr/common/utils/CookieUtil.java index 55fec9f5..a5122c09 100644 --- a/src/main/java/com/iemr/common/utils/CookieUtil.java +++ b/src/main/java/com/iemr/common/utils/CookieUtil.java @@ -3,6 +3,9 @@ import java.util.Arrays; import java.util.Optional; +import org.slf4j.Logger; +import org.slf4j.LoggerFactory; +import org.springframework.beans.factory.annotation.Value; import org.springframework.stereotype.Service; import jakarta.servlet.http.Cookie; @@ -11,6 +14,7 @@ @Service public class CookieUtil { + private Logger logger = LoggerFactory.getLogger(this.getClass().getSimpleName()); public Optional getCookieValue(HttpServletRequest request, String cookieName) { Cookie[] cookies = request.getCookies(); @@ -25,42 +29,42 @@ public Optional getCookieValue(HttpServletRequest request, String cookie } public void addJwtTokenToCookie(String Jwttoken, HttpServletResponse response, HttpServletRequest request) { - // Create a new cookie with the JWT token - Cookie cookie = new Cookie("Jwttoken", Jwttoken); - - // Make the cookie HttpOnly to prevent JavaScript access for security - cookie.setHttpOnly(true); - - // Set the Max-Age (expiry time) in seconds (1 day) - cookie.setMaxAge(60 * 60 * 24); // 1 day expiration - - // Set the path to "/" so the cookie is available across the entire application - cookie.setPath("/"); - - // Set the SameSite attribute for cross-site request handling (if needed) - String sameSite = "None"; // Allow cross-site cookies (can be 'Strict', 'Lax', or 'None') - cookie.setSecure(true); - // Add the cookie to the response - response.addCookie(cookie); - - // Build the Set-Cookie header manually (to add SameSite attribute support) - StringBuilder cookieHeader = new StringBuilder(); - cookieHeader.append(cookie.getName()).append("=").append(cookie.getValue()) - .append("; Path=").append(cookie.getPath()) - .append("; Max-Age=").append(cookie.getMaxAge()) - .append("; HttpOnly"); - - // Add SameSite and Secure attributes manually if needed - cookieHeader.append("; SameSite=").append(sameSite); - if (cookie.getSecure()) { - cookieHeader.append("; Secure"); - } - - // Set the custom Set-Cookie header + // Create a new cookie with the JWT token + Cookie cookie = new Cookie("Jwttoken", Jwttoken); + + // Make the cookie HttpOnly to prevent JavaScript access for security + cookie.setHttpOnly(true); + + // Set the Max-Age (expiry time) in seconds (1 day) + cookie.setMaxAge(60 * 60 * 24); // 1 day expiration + + // Set the path to "/" so the cookie is available across the entire application + cookie.setPath("/"); + + // Set the SameSite attribute for cross-site request handling (if needed) + String sameSite = "None"; // Allow cross-site cookies (can be 'Strict', 'Lax', or 'None') + cookie.setSecure(true); + // Add the cookie to the response + // response.addCookie(cookie); + + // Build the Set-Cookie header manually (to add SameSite attribute support) + StringBuilder cookieHeader = new StringBuilder(); + cookieHeader.append(cookie.getName()).append("=").append(cookie.getValue()).append("; Path=") + .append(cookie.getPath()).append("; Max-Age=").append(cookie.getMaxAge()).append("; HttpOnly"); + + // Add SameSite and Secure attributes manually if needed + cookieHeader.append("; SameSite=").append(sameSite); + if (cookie.getSecure()) { + cookieHeader.append("; Secure"); + } + // Set the custom Set-Cookie header response.addHeader("Set-Cookie", cookieHeader.toString()); } public String getJwtTokenFromCookie(HttpServletRequest request) { + if (request.getCookies() == null) { + return null; // If cookies are null, return null safely. + } return Arrays.stream(request.getCookies()).filter(cookie -> "Jwttoken".equals(cookie.getName())) .map(Cookie::getValue).findFirst().orElse(null); } diff --git a/src/main/java/com/iemr/common/utils/JwtUserIdValidationFilter.java b/src/main/java/com/iemr/common/utils/JwtUserIdValidationFilter.java index 0c12c3a6..5d831147 100644 --- a/src/main/java/com/iemr/common/utils/JwtUserIdValidationFilter.java +++ b/src/main/java/com/iemr/common/utils/JwtUserIdValidationFilter.java @@ -62,7 +62,7 @@ public void doFilter(ServletRequest servletRequest, ServletResponse servletRespo } try { - // Retrieve JWT token from cookies + // Retrieve JWT token from cookie String jwtTokenFromCookie = getJwtTokenFromCookies(request); logger.info("JWT token from cookie: "); From 770be02c9bde53f45db73347154e73158bf8ce9d Mon Sep 17 00:00:00 2001 From: Indrani Bandyopadhyay Date: Wed, 12 Mar 2025 16:45:31 +0530 Subject: [PATCH 2/4] Revert "jwt implementation modify" This reverts commit d85819e949df28fdb1aa5cd6d6e0ceb4859e6fcf. --- .../controller/users/IEMRAdminController.java | 21 +++--- .../com/iemr/common/utils/CookieUtil.java | 68 +++++++++---------- .../utils/JwtUserIdValidationFilter.java | 2 +- 3 files changed, 45 insertions(+), 46 deletions(-) diff --git a/src/main/java/com/iemr/common/controller/users/IEMRAdminController.java b/src/main/java/com/iemr/common/controller/users/IEMRAdminController.java index 1d86e57f..c05436e1 100644 --- a/src/main/java/com/iemr/common/controller/users/IEMRAdminController.java +++ b/src/main/java/com/iemr/common/controller/users/IEMRAdminController.java @@ -152,8 +152,9 @@ public String userAuthenticate( JSONObject serviceRoleMap = new JSONObject(); JSONArray serviceRoleList = new JSONArray(); JSONObject previlegeObj = new JSONObject(); - if (m_User.getUserName() != null && (m_User.getDoLogout() == null || !m_User.getDoLogout()) - && (m_User.getWithCredentials() != null && m_User.getWithCredentials())) { + if (m_User.getUserName() != null + && (m_User.getDoLogout() == null || !m_User.getDoLogout()) + && (m_User.getWithCredentials() != null && m_User.getWithCredentials())) { String tokenFromRedis = getConcurrentCheckSessionObjectAgainstUser( m_User.getUserName().trim().toLowerCase()); if (tokenFromRedis != null) { @@ -166,17 +167,19 @@ public String userAuthenticate( if (mUser.size() == 1) { String Jwttoken = jwtUtil.generateToken(m_User.getUserName(), mUser.get(0).getUserID().toString()); logger.info("jwt token is:" + Jwttoken); - + User user = new User(); // Assuming the Users class exists - user.setUserID(mUser.get(0).getUserID()); - user.setUserName(mUser.get(0).getUserName()); - - String redisKey = "user_" + mUser.get(0).getUserID(); // Use user ID to create a unique key + user.setUserID(mUser.get(0).getUserID()); + user.setUserName(mUser.get(0).getUserName()); + + String redisKey = "user_" + mUser.get(0).getUserID(); // Use user ID to create a unique key - // Store the user in Redis (set a TTL of 30 minutes) - redisTemplate.opsForValue().set(redisKey, user, 30, TimeUnit.MINUTES); + // Store the user in Redis (set a TTL of 30 minutes) + redisTemplate.opsForValue().set(redisKey, user, 30, TimeUnit.MINUTES); + // Set Jwttoken in the response cookie cookieUtil.addJwtTokenToCookie(Jwttoken, httpResponse, request); + createUserMapping(mUser.get(0), resMap, serviceRoleMultiMap, serviceRoleMap, serviceRoleList, previlegeObj); } else { diff --git a/src/main/java/com/iemr/common/utils/CookieUtil.java b/src/main/java/com/iemr/common/utils/CookieUtil.java index a5122c09..55fec9f5 100644 --- a/src/main/java/com/iemr/common/utils/CookieUtil.java +++ b/src/main/java/com/iemr/common/utils/CookieUtil.java @@ -3,9 +3,6 @@ import java.util.Arrays; import java.util.Optional; -import org.slf4j.Logger; -import org.slf4j.LoggerFactory; -import org.springframework.beans.factory.annotation.Value; import org.springframework.stereotype.Service; import jakarta.servlet.http.Cookie; @@ -14,7 +11,6 @@ @Service public class CookieUtil { - private Logger logger = LoggerFactory.getLogger(this.getClass().getSimpleName()); public Optional getCookieValue(HttpServletRequest request, String cookieName) { Cookie[] cookies = request.getCookies(); @@ -29,42 +25,42 @@ public Optional getCookieValue(HttpServletRequest request, String cookie } public void addJwtTokenToCookie(String Jwttoken, HttpServletResponse response, HttpServletRequest request) { - // Create a new cookie with the JWT token - Cookie cookie = new Cookie("Jwttoken", Jwttoken); - - // Make the cookie HttpOnly to prevent JavaScript access for security - cookie.setHttpOnly(true); - - // Set the Max-Age (expiry time) in seconds (1 day) - cookie.setMaxAge(60 * 60 * 24); // 1 day expiration - - // Set the path to "/" so the cookie is available across the entire application - cookie.setPath("/"); - - // Set the SameSite attribute for cross-site request handling (if needed) - String sameSite = "None"; // Allow cross-site cookies (can be 'Strict', 'Lax', or 'None') - cookie.setSecure(true); - // Add the cookie to the response - // response.addCookie(cookie); - - // Build the Set-Cookie header manually (to add SameSite attribute support) - StringBuilder cookieHeader = new StringBuilder(); - cookieHeader.append(cookie.getName()).append("=").append(cookie.getValue()).append("; Path=") - .append(cookie.getPath()).append("; Max-Age=").append(cookie.getMaxAge()).append("; HttpOnly"); - - // Add SameSite and Secure attributes manually if needed - cookieHeader.append("; SameSite=").append(sameSite); - if (cookie.getSecure()) { - cookieHeader.append("; Secure"); - } - // Set the custom Set-Cookie header + // Create a new cookie with the JWT token + Cookie cookie = new Cookie("Jwttoken", Jwttoken); + + // Make the cookie HttpOnly to prevent JavaScript access for security + cookie.setHttpOnly(true); + + // Set the Max-Age (expiry time) in seconds (1 day) + cookie.setMaxAge(60 * 60 * 24); // 1 day expiration + + // Set the path to "/" so the cookie is available across the entire application + cookie.setPath("/"); + + // Set the SameSite attribute for cross-site request handling (if needed) + String sameSite = "None"; // Allow cross-site cookies (can be 'Strict', 'Lax', or 'None') + cookie.setSecure(true); + // Add the cookie to the response + response.addCookie(cookie); + + // Build the Set-Cookie header manually (to add SameSite attribute support) + StringBuilder cookieHeader = new StringBuilder(); + cookieHeader.append(cookie.getName()).append("=").append(cookie.getValue()) + .append("; Path=").append(cookie.getPath()) + .append("; Max-Age=").append(cookie.getMaxAge()) + .append("; HttpOnly"); + + // Add SameSite and Secure attributes manually if needed + cookieHeader.append("; SameSite=").append(sameSite); + if (cookie.getSecure()) { + cookieHeader.append("; Secure"); + } + + // Set the custom Set-Cookie header response.addHeader("Set-Cookie", cookieHeader.toString()); } public String getJwtTokenFromCookie(HttpServletRequest request) { - if (request.getCookies() == null) { - return null; // If cookies are null, return null safely. - } return Arrays.stream(request.getCookies()).filter(cookie -> "Jwttoken".equals(cookie.getName())) .map(Cookie::getValue).findFirst().orElse(null); } diff --git a/src/main/java/com/iemr/common/utils/JwtUserIdValidationFilter.java b/src/main/java/com/iemr/common/utils/JwtUserIdValidationFilter.java index 5d831147..0c12c3a6 100644 --- a/src/main/java/com/iemr/common/utils/JwtUserIdValidationFilter.java +++ b/src/main/java/com/iemr/common/utils/JwtUserIdValidationFilter.java @@ -62,7 +62,7 @@ public void doFilter(ServletRequest servletRequest, ServletResponse servletRespo } try { - // Retrieve JWT token from cookie + // Retrieve JWT token from cookies String jwtTokenFromCookie = getJwtTokenFromCookies(request); logger.info("JWT token from cookie: "); From 016f2a2508fa7378c0785263a31879bb7d9ef356 Mon Sep 17 00:00:00 2001 From: IN40068837 Date: Wed, 12 Mar 2025 17:04:29 +0530 Subject: [PATCH 3/4] cookieutil change --- src/main/java/com/iemr/common/utils/CookieUtil.java | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/src/main/java/com/iemr/common/utils/CookieUtil.java b/src/main/java/com/iemr/common/utils/CookieUtil.java index 55fec9f5..7a9e59a8 100644 --- a/src/main/java/com/iemr/common/utils/CookieUtil.java +++ b/src/main/java/com/iemr/common/utils/CookieUtil.java @@ -41,7 +41,7 @@ public void addJwtTokenToCookie(String Jwttoken, HttpServletResponse response, H String sameSite = "None"; // Allow cross-site cookies (can be 'Strict', 'Lax', or 'None') cookie.setSecure(true); // Add the cookie to the response - response.addCookie(cookie); + // response.addCookie(cookie); // Build the Set-Cookie header manually (to add SameSite attribute support) StringBuilder cookieHeader = new StringBuilder(); @@ -61,6 +61,9 @@ public void addJwtTokenToCookie(String Jwttoken, HttpServletResponse response, H } public String getJwtTokenFromCookie(HttpServletRequest request) { + if (request.getCookies() == null) { + return null; // If cookies are null, return null safely. + } return Arrays.stream(request.getCookies()).filter(cookie -> "Jwttoken".equals(cookie.getName())) .map(Cookie::getValue).findFirst().orElse(null); } From 74c35d98125ccaf63b31c5e273270bd347d2cd95 Mon Sep 17 00:00:00 2001 From: IN40068837 Date: Wed, 12 Mar 2025 17:10:27 +0530 Subject: [PATCH 4/4] sonarCloud checks resolved --- src/main/java/com/iemr/common/utils/CookieUtil.java | 2 -- 1 file changed, 2 deletions(-) diff --git a/src/main/java/com/iemr/common/utils/CookieUtil.java b/src/main/java/com/iemr/common/utils/CookieUtil.java index 7a9e59a8..8c0a0b76 100644 --- a/src/main/java/com/iemr/common/utils/CookieUtil.java +++ b/src/main/java/com/iemr/common/utils/CookieUtil.java @@ -40,8 +40,6 @@ public void addJwtTokenToCookie(String Jwttoken, HttpServletResponse response, H // Set the SameSite attribute for cross-site request handling (if needed) String sameSite = "None"; // Allow cross-site cookies (can be 'Strict', 'Lax', or 'None') cookie.setSecure(true); - // Add the cookie to the response - // response.addCookie(cookie); // Build the Set-Cookie header manually (to add SameSite attribute support) StringBuilder cookieHeader = new StringBuilder();