{"action":"created","comment":{"url":"https://api.github.com/repos/SonarSource/sonarqube/pulls/comments/70067602","id":70067602,"diff_hunk":"@@ -19,43 +19,33 @@\n  */\n package org.sonar.server.authentication;\n \n-import static org.apache.commons.codec.digest.DigestUtils.sha256Hex;\n-import static org.apache.commons.lang.StringUtils.isBlank;\n-\n import java.math.BigInteger;\n import java.security.SecureRandom;\n import java.util.Optional;\n import javax.servlet.http.Cookie;\n import javax.servlet.http.HttpServletRequest;\n import javax.servlet.http.HttpServletResponse;\n-import org.sonar.api.platform.Server;\n import org.sonar.server.exceptions.UnauthorizedException;\n \n+import static org.apache.commons.codec.digest.DigestUtils.sha256Hex;\n+import static org.apache.commons.lang.StringUtils.isBlank;\n+import static org.sonar.server.authentication.CookieUtils.createCookie;\n+import static org.sonar.server.authentication.CookieUtils.findCookie;\n+\n public class OAuthCsrfVerifier {\n \n   private static final String CSRF_STATE_COOKIE = \"OAUTHSTATE\";\n \n-  private final Server server;\n-\n-  public OAuthCsrfVerifier(Server server) {\n-    this.server = server;\n-  }\n-\n-  public String generateState(HttpServletResponse response) {\n+  public String generateState(HttpServletRequest request, HttpServletResponse response) {\n     // Create a state token to prevent request forgery.\n     // Store it in the session for later validation.\n     String state = new BigInteger(130, new SecureRandom()).toString(32);\n-    Cookie cookie = new Cookie(CSRF_STATE_COOKIE, sha256Hex(state));\n-    cookie.setPath(server.getContextPath() + \"/\");\n-    cookie.setHttpOnly(true);\n-    cookie.setMaxAge(-1);\n-    cookie.setSecure(server.isSecured());\n-    response.addCookie(cookie);\n+    response.addCookie(createCookie(CSRF_STATE_COOKIE, sha256Hex(state), true, -1, request));\n     return state;\n   }\n \n   public void verifyState(HttpServletRequest request, HttpServletResponse response) {\n-    Optional<Cookie> stateCookie = CookieUtils.findCookie(CSRF_STATE_COOKIE, request);\n+    Optional<Cookie> stateCookie = findCookie(CSRF_STATE_COOKIE, request);\n     if (!stateCookie.isPresent()) {","path":"server/sonar-server/src/main/java/org/sonar/server/authentication/OAuthCsrfVerifier.java","position":49,"original_position":49,"commit_id":"7c723fffccd2dd2a9f1b2b97f4be10f0b5dd7526","original_commit_id":"7c723fffccd2dd2a9f1b2b97f4be10f0b5dd7526","user":{"login":"julienlancelot","id":370769,"avatar_url":"https://avatars.githubusercontent.com/u/370769?v=3","gravatar_id":"","url":"https://api.github.com/users/julienlancelot","html_url":"https://github.com/julienlancelot","followers_url":"https://api.github.com/users/julienlancelot/followers","following_url":"https://api.github.com/users/julienlancelot/following{/other_user}","gists_url":"https://api.github.com/users/julienlancelot/gists{/gist_id}","starred_url":"https://api.github.com/users/julienlancelot/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/julienlancelot/subscriptions","organizations_url":"https://api.github.com/users/julienlancelot/orgs","repos_url":"https://api.github.com/users/julienlancelot/repos","events_url":"https://api.github.com/users/julienlancelot/events{/privacy}","received_events_url":"https://api.github.com/users/julienlancelot/received_events","type":"User","site_admin":false},"body":"👍 ","created_at":"2016-07-08T12:42:18Z","updated_at":"2016-07-08T12:42:18Z","html_url":"https://github.com/SonarSource/sonarqube/pull/1090#discussion_r70067602","pull_request_url":"https://api.github.com/repos/SonarSource/sonarqube/pulls/1090","_links":{"self":{"href":"https://api.github.com/repos/SonarSource/sonarqube/pulls/comments/70067602"},"html":{"href":"https://github.com/SonarSource/sonarqube/pull/1090#discussion_r70067602"},"pull_request":{"href":"https://api.github.com/repos/SonarSource/sonarqube/pulls/1090"}}},"pull_request":{"url":"https://api.github.com/repos/SonarSource/sonarqube/pulls/1090","id":76708625,"html_url":"https://github.com/SonarSource/sonarqube/pull/1090","diff_url":"https://github.com/SonarSource/sonarqube/pull/1090.diff","patch_url":"https://github.com/SonarSource/sonarqube/pull/1090.patch","issue_url":"https://api.github.com/repos/SonarSource/sonarqube/issues/1090","number":1090,"state":"open","locked":false,"title":"SONAR-7856 Do not use \"sonar.core.serverBaseURL\" to detect if server is using SSL","user":{"login":"julienlancelot","id":370769,"avatar_url":"https://avatars.githubusercontent.com/u/370769?v=3","gravatar_id":"","url":"https://api.github.com/users/julienlancelot","html_url":"https://github.com/julienlancelot","followers_url":"https://api.github.com/users/julienlancelot/followers","following_url":"https://api.github.com/users/julienlancelot/following{/other_user}","gists_url":"https://api.github.com/users/julienlancelot/gists{/gist_id}","starred_url":"https://api.github.com/users/julienlancelot/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/julienlancelot/subscriptions","organizations_url":"https://api.github.com/users/julienlancelot/orgs","repos_url":"https://api.github.com/users/julienlancelot/repos","events_url":"https://api.github.com/users/julienlancelot/events{/privacy}","received_events_url":"https://api.github.com/users/julienlancelot/received_events","type":"User","site_admin":false},"body":"","created_at":"2016-07-08T06:48:44Z","updated_at":"2016-07-08T12:42:18Z","closed_at":null,"merged_at":null,"merge_commit_sha":"e84417cffba0882ae419ea2790dc5b28fed74a2b","assignee":{"login":"teryk","id":1247713,"avatar_url":"https://avatars.githubusercontent.com/u/1247713?v=3","gravatar_id":"","url":"https://api.github.com/users/teryk","html_url":"https://github.com/teryk","followers_url":"https://api.github.com/users/teryk/followers","following_url":"https://api.github.com/users/teryk/following{/other_user}","gists_url":"https://api.github.com/users/teryk/gists{/gist_id}","starred_url":"https://api.github.com/users/teryk/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/teryk/subscriptions","organizations_url":"https://api.github.com/users/teryk/orgs","repos_url":"https://api.github.com/users/teryk/repos","events_url":"https://api.github.com/users/teryk/events{/privacy}","received_events_url":"https://api.github.com/users/teryk/received_events","type":"User","site_admin":false},"assignees":[{"login":"teryk","id":1247713,"avatar_url":"https://avatars.githubusercontent.com/u/1247713?v=3","gravatar_id":"","url":"https://api.github.com/users/teryk","html_url":"https://github.com/teryk","followers_url":"https://api.github.com/users/teryk/followers","following_url":"https://api.github.com/users/teryk/following{/other_user}","gists_url":"https://api.github.com/users/teryk/gists{/gist_id}","starred_url":"https://api.github.com/users/teryk/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/teryk/subscriptions","organizations_url":"https://api.github.com/users/teryk/orgs","repos_url":"https://api.github.com/users/teryk/repos","events_url":"https://api.github.com/users/teryk/events{/privacy}","received_events_url":"https://api.github.com/users/teryk/received_events","type":"User","site_admin":false}],"milestone":null,"commits_url":"https://api.github.com/repos/SonarSource/sonarqube/pulls/1090/commits","review_comments_url":"https://api.github.com/repos/SonarSource/sonarqube/pulls/1090/comments","review_comment_url":"https://api.github.com/repos/SonarSource/sonarqube/pulls/comments{/number}","comments_url":"https://api.github.com/repos/SonarSource/sonarqube/issues/1090/comments","statuses_url":"https://api.github.com/repos/SonarSource/sonarqube/statuses/7c723fffccd2dd2a9f1b2b97f4be10f0b5dd7526","head":{"label":"SonarSource:feature/jl/use_X_FORWARDED_PROTO_to_detect_https","ref":"feature/jl/use_X_FORWARDED_PROTO_to_detect_https","sha":"7c723fffccd2dd2a9f1b2b97f4be10f0b5dd7526","user":{"login":"SonarSource","id":545988,"avatar_url":"https://avatars.githubusercontent.com/u/545988?v=3","gravatar_id":"","url":"https://api.github.com/users/SonarSource","html_url":"https://github.com/SonarSource","followers_url":"https://api.github.com/users/SonarSource/followers","following_url":"https://api.github.com/users/SonarSource/following{/other_user}","gists_url":"https://api.github.com/users/SonarSource/gists{/gist_id}","starred_url":"https://api.github.com/users/SonarSource/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/SonarSource/subscriptions","organizations_url":"https://api.github.com/users/SonarSource/orgs","repos_url":"https://api.github.com/users/SonarSource/repos","events_url":"https://api.github.com/users/SonarSource/events{/privacy}","received_events_url":"https://api.github.com/users/SonarSource/received_events","type":"Organization","site_admin":false},"repo":{"id":1222504,"name":"sonarqube","full_name":"SonarSource/sonarqube","owner":{"login":"SonarSource","id":545988,"avatar_url":"https://avatars.githubusercontent.com/u/545988?v=3","gravatar_id":"","url":"https://api.github.com/users/SonarSource","html_url":"https://github.com/SonarSource","followers_url":"https://api.github.com/users/SonarSource/followers","following_url":"https://api.github.com/users/SonarSource/following{/other_user}","gists_url":"https://api.github.com/users/SonarSource/gists{/gist_id}","starred_url":"https://api.github.com/users/SonarSource/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/SonarSource/subscriptions","organizations_url":"https://api.github.com/users/SonarSource/orgs","repos_url":"https://api.github.com/users/SonarSource/repos","events_url":"https://api.github.com/users/SonarSource/events{/privacy}","received_events_url":"https://api.github.com/users/SonarSource/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/SonarSource/sonarqube","description":"Put your technical debt under control","fork":false,"url":"https://api.github.com/repos/SonarSource/sonarqube","forks_url":"https://api.github.com/repos/SonarSource/sonarqube/forks","keys_url":"https://api.github.com/repos/SonarSource/sonarqube/keys{/key_id}","collaborators_url":"https://api.github.com/repos/SonarSource/sonarqube/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/SonarSource/sonarqube/teams","hooks_url":"https://api.github.com/repos/SonarSource/sonarqube/hooks","issue_events_url":"https://api.github.com/repos/SonarSource/sonarqube/issues/events{/number}","events_url":"https://api.github.com/repos/SonarSource/sonarqube/events","assignees_url":"https://api.github.com/repos/SonarSource/sonarqube/assignees{/user}","branches_url":"https://api.github.com/repos/SonarSource/sonarqube/branches{/branch}","tags_url":"https://api.github.com/repos/SonarSource/sonarqube/tags","blobs_url":"https://api.github.com/repos/SonarSource/sonarqube/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/SonarSource/sonarqube/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/SonarSource/sonarqube/git/refs{/sha}","trees_url":"https://api.github.com/repos/SonarSource/sonarqube/git/trees{/sha}","statuses_url":"https://api.github.com/repos/SonarSource/sonarqube/statuses/{sha}","languages_url":"https://api.github.com/repos/SonarSource/sonarqube/languages","stargazers_url":"https://api.github.com/repos/SonarSource/sonarqube/stargazers","contributors_url":"https://api.github.com/repos/SonarSource/sonarqube/contributors","subscribers_url":"https://api.github.com/repos/SonarSource/sonarqube/subscribers","subscription_url":"https://api.github.com/repos/SonarSource/sonarqube/subscription","commits_url":"https://api.github.com/repos/SonarSource/sonarqube/commits{/sha}","git_commits_url":"https://api.github.com/repos/SonarSource/sonarqube/git/commits{/sha}","comments_url":"https://api.github.com/repos/SonarSource/sonarqube/comments{/number}","issue_comment_url":"https://api.github.com/repos/SonarSource/sonarqube/issues/comments{/number}","contents_url":"https://api.github.com/repos/SonarSource/sonarqube/contents/{+path}","compare_url":"https://api.github.com/repos/SonarSource/sonarqube/compare/{base}...{head}","merges_url":"https://api.github.com/repos/SonarSource/sonarqube/merges","archive_url":"https://api.github.com/repos/SonarSource/sonarqube/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/SonarSource/sonarqube/downloads","issues_url":"https://api.github.com/repos/SonarSource/sonarqube/issues{/number}","pulls_url":"https://api.github.com/repos/SonarSource/sonarqube/pulls{/number}","milestones_url":"https://api.github.com/repos/SonarSource/sonarqube/milestones{/number}","notifications_url":"https://api.github.com/repos/SonarSource/sonarqube/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/SonarSource/sonarqube/labels{/name}","releases_url":"https://api.github.com/repos/SonarSource/sonarqube/releases{/id}","deployments_url":"https://api.github.com/repos/SonarSource/sonarqube/deployments","created_at":"2011-01-05T11:05:17Z","updated_at":"2016-07-08T05:20:36Z","pushed_at":"2016-07-08T11:47:18Z","git_url":"git://github.com/SonarSource/sonarqube.git","ssh_url":"git@github.com:SonarSource/sonarqube.git","clone_url":"https://github.com/SonarSource/sonarqube.git","svn_url":"https://github.com/SonarSource/sonarqube","homepage":"http://www.sonarqube.org","size":188766,"stargazers_count":1169,"watchers_count":1169,"language":"Java","has_issues":false,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":490,"mirror_url":null,"open_issues_count":11,"forks":490,"open_issues":11,"watchers":1169,"default_branch":"master"}},"base":{"label":"SonarSource:master","ref":"master","sha":"d618b5cf39dc272232c69717de76229dd7fcdd9c","user":{"login":"SonarSource","id":545988,"avatar_url":"https://avatars.githubusercontent.com/u/545988?v=3","gravatar_id":"","url":"https://api.github.com/users/SonarSource","html_url":"https://github.com/SonarSource","followers_url":"https://api.github.com/users/SonarSource/followers","following_url":"https://api.github.com/users/SonarSource/following{/other_user}","gists_url":"https://api.github.com/users/SonarSource/gists{/gist_id}","starred_url":"https://api.github.com/users/SonarSource/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/SonarSource/subscriptions","organizations_url":"https://api.github.com/users/SonarSource/orgs","repos_url":"https://api.github.com/users/SonarSource/repos","events_url":"https://api.github.com/users/SonarSource/events{/privacy}","received_events_url":"https://api.github.com/users/SonarSource/received_events","type":"Organization","site_admin":false},"repo":{"id":1222504,"name":"sonarqube","full_name":"SonarSource/sonarqube","owner":{"login":"SonarSource","id":545988,"avatar_url":"https://avatars.githubusercontent.com/u/545988?v=3","gravatar_id":"","url":"https://api.github.com/users/SonarSource","html_url":"https://github.com/SonarSource","followers_url":"https://api.github.com/users/SonarSource/followers","following_url":"https://api.github.com/users/SonarSource/following{/other_user}","gists_url":"https://api.github.com/users/SonarSource/gists{/gist_id}","starred_url":"https://api.github.com/users/SonarSource/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/SonarSource/subscriptions","organizations_url":"https://api.github.com/users/SonarSource/orgs","repos_url":"https://api.github.com/users/SonarSource/repos","events_url":"https://api.github.com/users/SonarSource/events{/privacy}","received_events_url":"https://api.github.com/users/SonarSource/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/SonarSource/sonarqube","description":"Put your technical debt under control","fork":false,"url":"https://api.github.com/repos/SonarSource/sonarqube","forks_url":"https://api.github.com/repos/SonarSource/sonarqube/forks","keys_url":"https://api.github.com/repos/SonarSource/sonarqube/keys{/key_id}","collaborators_url":"https://api.github.com/repos/SonarSource/sonarqube/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/SonarSource/sonarqube/teams","hooks_url":"https://api.github.com/repos/SonarSource/sonarqube/hooks","issue_events_url":"https://api.github.com/repos/SonarSource/sonarqube/issues/events{/number}","events_url":"https://api.github.com/repos/SonarSource/sonarqube/events","assignees_url":"https://api.github.com/repos/SonarSource/sonarqube/assignees{/user}","branches_url":"https://api.github.com/repos/SonarSource/sonarqube/branches{/branch}","tags_url":"https://api.github.com/repos/SonarSource/sonarqube/tags","blobs_url":"https://api.github.com/repos/SonarSource/sonarqube/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/SonarSource/sonarqube/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/SonarSource/sonarqube/git/refs{/sha}","trees_url":"https://api.github.com/repos/SonarSource/sonarqube/git/trees{/sha}","statuses_url":"https://api.github.com/repos/SonarSource/sonarqube/statuses/{sha}","languages_url":"https://api.github.com/repos/SonarSource/sonarqube/languages","stargazers_url":"https://api.github.com/repos/SonarSource/sonarqube/stargazers","contributors_url":"https://api.github.com/repos/SonarSource/sonarqube/contributors","subscribers_url":"https://api.github.com/repos/SonarSource/sonarqube/subscribers","subscription_url":"https://api.github.com/repos/SonarSource/sonarqube/subscription","commits_url":"https://api.github.com/repos/SonarSource/sonarqube/commits{/sha}","git_commits_url":"https://api.github.com/repos/SonarSource/sonarqube/git/commits{/sha}","comments_url":"https://api.github.com/repos/SonarSource/sonarqube/comments{/number}","issue_comment_url":"https://api.github.com/repos/SonarSource/sonarqube/issues/comments{/number}","contents_url":"https://api.github.com/repos/SonarSource/sonarqube/contents/{+path}","compare_url":"https://api.github.com/repos/SonarSource/sonarqube/compare/{base}...{head}","merges_url":"https://api.github.com/repos/SonarSource/sonarqube/merges","archive_url":"https://api.github.com/repos/SonarSource/sonarqube/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/SonarSource/sonarqube/downloads","issues_url":"https://api.github.com/repos/SonarSource/sonarqube/issues{/number}","pulls_url":"https://api.github.com/repos/SonarSource/sonarqube/pulls{/number}","milestones_url":"https://api.github.com/repos/SonarSource/sonarqube/milestones{/number}","notifications_url":"https://api.github.com/repos/SonarSource/sonarqube/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/SonarSource/sonarqube/labels{/name}","releases_url":"https://api.github.com/repos/SonarSource/sonarqube/releases{/id}","deployments_url":"https://api.github.com/repos/SonarSource/sonarqube/deployments","created_at":"2011-01-05T11:05:17Z","updated_at":"2016-07-08T05:20:36Z","pushed_at":"2016-07-08T11:47:18Z","git_url":"git://github.com/SonarSource/sonarqube.git","ssh_url":"git@github.com:SonarSource/sonarqube.git","clone_url":"https://github.com/SonarSource/sonarqube.git","svn_url":"https://github.com/SonarSource/sonarqube","homepage":"http://www.sonarqube.org","size":188766,"stargazers_count":1169,"watchers_count":1169,"language":"Java","has_issues":false,"has_downloads":true,"has_wiki":false,"has_pages":false,"forks_count":490,"mirror_url":null,"open_issues_count":11,"forks":490,"open_issues":11,"watchers":1169,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/SonarSource/sonarqube/pulls/1090"},"html":{"href":"https://github.com/SonarSource/sonarqube/pull/1090"},"issue":{"href":"https://api.github.com/repos/SonarSource/sonarqube/issues/1090"},"comments":{"href":"https://api.github.com/repos/SonarSource/sonarqube/issues/1090/comments"},"review_comments":{"href":"https://api.github.com/repos/SonarSource/sonarqube/pulls/1090/comments"},"review_comment":{"href":"https://api.github.com/repos/SonarSource/sonarqube/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/SonarSource/sonarqube/pulls/1090/commits"},"statuses":{"href":"https://api.github.com/repos/SonarSource/sonarqube/statuses/7c723fffccd2dd2a9f1b2b97f4be10f0b5dd7526"}}}}
{"actor":{"display_login":"julienlancelot"}}