-
Notifications
You must be signed in to change notification settings - Fork 2.5k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
plugin-ext: attach security cookie to webviews
When on Electron, we use a cookie to tell if an http client can use the backend services. Cookies are bound to domains to which requests will be made, and also subdomains in certain situations. Because we are using `localhost` the cookie cannot be shared across subdomains. This commit works around this limitation by passing the security token from electron-main process to the renderer-process via a global variable, and the token is then set inside a cookie for each new webview endpoint created by the plugin system in the frontend. Signed-off-by: Paul Maréchal <[email protected]>
- Loading branch information
1 parent
46255a2
commit 4dad2c2
Showing
10 changed files
with
205 additions
and
30 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
23 changes: 23 additions & 0 deletions
23
packages/core/src/electron-browser/token/electron-token-frontend-module.ts
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,23 @@ | ||
| /******************************************************************************** | ||
| * Copyright (C) 2020 Ericsson and others. | ||
| * | ||
| * This program and the accompanying materials are made available under the | ||
| * terms of the Eclipse Public License v. 2.0 which is available at | ||
| * http://www.eclipse.org/legal/epl-2.0. | ||
| * | ||
| * This Source Code may also be made available under the following Secondary | ||
| * Licenses when the conditions for such availability set forth in the Eclipse | ||
| * Public License v. 2.0 are satisfied: GNU General Public License, version 2 | ||
| * with the GNU Classpath Exception which is available at | ||
| * https://www.gnu.org/software/classpath/license.html. | ||
| * | ||
| * SPDX-License-Identifier: EPL-2.0 OR GPL-2.0 WITH Classpath-exception-2.0 | ||
| ********************************************************************************/ | ||
|
|
||
| import * as electron from 'electron'; | ||
| import { ContainerModule } from 'inversify'; | ||
| import { ElectronSecurityToken } from '../../electron-common/electron-token'; | ||
|
|
||
| export default new ContainerModule(bind => { | ||
| bind(ElectronSecurityToken).toConstantValue(electron.remote.getGlobal(ElectronSecurityToken)); | ||
| }); |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
43 changes: 43 additions & 0 deletions
43
packages/plugin-ext/src/main/browser/webview/webview-widget-factory.ts
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,43 @@ | ||
| /******************************************************************************** | ||
| * Copyright (C) 2020 Ericsson and others. | ||
| * | ||
| * This program and the accompanying materials are made available under the | ||
| * terms of the Eclipse Public License v. 2.0 which is available at | ||
| * http://www.eclipse.org/legal/epl-2.0. | ||
| * | ||
| * This Source Code may also be made available under the following Secondary | ||
| * Licenses when the conditions for such availability set forth in the Eclipse | ||
| * Public License v. 2.0 are satisfied: GNU General Public License, version 2 | ||
| * with the GNU Classpath Exception which is available at | ||
| * https://www.gnu.org/software/classpath/license.html. | ||
| * | ||
| * SPDX-License-Identifier: EPL-2.0 OR GPL-2.0 WITH Classpath-exception-2.0 | ||
| ********************************************************************************/ | ||
|
|
||
| import { interfaces } from 'inversify'; | ||
| import { WebviewWidget, WebviewWidgetIdentifier, WebviewWidgetExternalEndpoint } from './webview'; | ||
| import { WebviewEnvironment } from './webview-environment'; | ||
|
|
||
| export class WebviewWidgetFactory { | ||
|
|
||
| readonly id = WebviewWidget.FACTORY_ID; | ||
|
|
||
| protected readonly container: interfaces.Container; | ||
|
|
||
| constructor(container: interfaces.Container) { | ||
| this.container = container; | ||
| } | ||
|
|
||
| async createWidget(identifier: WebviewWidgetIdentifier): Promise<WebviewWidget> { | ||
| const externalEndpoint = await this.container.get(WebviewEnvironment).externalEndpoint(); | ||
| let endpoint = externalEndpoint.replace('{{uuid}}', identifier.id); | ||
| if (endpoint[endpoint.length - 1] === '/') { | ||
| endpoint = endpoint.slice(0, endpoint.length - 1); | ||
| } | ||
| const child = this.container.createChild(); | ||
| child.bind(WebviewWidgetIdentifier).toConstantValue(identifier); | ||
| child.bind(WebviewWidgetExternalEndpoint).toConstantValue(endpoint); | ||
| return child.get(WebviewWidget); | ||
| } | ||
|
|
||
| } |
23 changes: 23 additions & 0 deletions
23
packages/plugin-ext/src/main/electron-browser/plugin-ext-frontend-electron-module.ts
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,23 @@ | ||
| /******************************************************************************** | ||
| * Copyright (C) 2020 Ericsson and others. | ||
| * | ||
| * This program and the accompanying materials are made available under the | ||
| * terms of the Eclipse Public License v. 2.0 which is available at | ||
| * http://www.eclipse.org/legal/epl-2.0. | ||
| * | ||
| * This Source Code may also be made available under the following Secondary | ||
| * Licenses when the conditions for such availability set forth in the Eclipse | ||
| * Public License v. 2.0 are satisfied: GNU General Public License, version 2 | ||
| * with the GNU Classpath Exception which is available at | ||
| * https://www.gnu.org/software/classpath/license.html. | ||
| * | ||
| * SPDX-License-Identifier: EPL-2.0 OR GPL-2.0 WITH Classpath-exception-2.0 | ||
| ********************************************************************************/ | ||
|
|
||
| import { interfaces } from 'inversify'; | ||
| import { WebviewWidgetFactory } from '../browser/webview/webview-widget-factory'; | ||
| import { ElectronWebviewWidgetFactory } from './webview/electron-webview-widget-factory'; | ||
|
|
||
| export const bindElectronFrontend: interfaces.ContainerModuleCallBack = (bind, unbind, isBound, rebind) => { | ||
| rebind(WebviewWidgetFactory).toDynamicValue(ctx => new ElectronWebviewWidgetFactory(ctx.container)).inSingletonScope(); | ||
| }; |
52 changes: 52 additions & 0 deletions
52
packages/plugin-ext/src/main/electron-browser/webview/electron-webview-widget-factory.ts
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,52 @@ | ||
| /******************************************************************************** | ||
| * Copyright (C) 2020 Ericsson and others. | ||
| * | ||
| * This program and the accompanying materials are made available under the | ||
| * terms of the Eclipse Public License v. 2.0 which is available at | ||
| * http://www.eclipse.org/legal/epl-2.0. | ||
| * | ||
| * This Source Code may also be made available under the following Secondary | ||
| * Licenses when the conditions for such availability set forth in the Eclipse | ||
| * Public License v. 2.0 are satisfied: GNU General Public License, version 2 | ||
| * with the GNU Classpath Exception which is available at | ||
| * https://www.gnu.org/software/classpath/license.html. | ||
| * | ||
| * SPDX-License-Identifier: EPL-2.0 OR GPL-2.0 WITH Classpath-exception-2.0 | ||
| ********************************************************************************/ | ||
|
|
||
| import { remote } from 'electron'; | ||
| import { ElectronSecurityToken } from '@theia/core/lib/electron-common/electron-token'; | ||
| import { WebviewWidgetFactory } from '../../browser/webview/webview-widget-factory'; | ||
| import { WebviewWidgetIdentifier, WebviewWidget } from '../../browser/webview/webview'; | ||
|
|
||
| export class ElectronWebviewWidgetFactory extends WebviewWidgetFactory { | ||
|
|
||
| async createWidget(identifier: WebviewWidgetIdentifier): Promise<WebviewWidget> { | ||
| const widget = await super.createWidget(identifier); | ||
| this.attachElectronSecurityCookie(widget.externalEndpoint); | ||
| return widget; | ||
| } | ||
|
|
||
| /** | ||
| * Attach the ElectronSecurityToken to a cookie that will be sent with each webview request. | ||
| * | ||
| * @param endpoint cookie's target url | ||
| */ | ||
| protected attachElectronSecurityCookie(endpoint: string): Promise<void> { | ||
| return new Promise((resolve, reject) => { | ||
| remote.session.defaultSession!.cookies.set({ | ||
| url: endpoint, | ||
| name: ElectronSecurityToken, | ||
| value: JSON.stringify(this.container.get(ElectronSecurityToken)), | ||
| httpOnly: true, | ||
| }, error => { | ||
| if (error) { | ||
| reject(error); | ||
| } else { | ||
| resolve(); | ||
| } | ||
| }); | ||
| }); | ||
| } | ||
|
|
||
| } |
24 changes: 24 additions & 0 deletions
24
packages/plugin-ext/src/plugin-ext-frontend-electron-module.ts
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,24 @@ | ||
| /******************************************************************************** | ||
| * Copyright (C) 2020 Ericsson and others. | ||
| * | ||
| * This program and the accompanying materials are made available under the | ||
| * terms of the Eclipse Public License v. 2.0 which is available at | ||
| * http://www.eclipse.org/legal/epl-2.0. | ||
| * | ||
| * This Source Code may also be made available under the following Secondary | ||
| * Licenses when the conditions for such availability set forth in the Eclipse | ||
| * Public License v. 2.0 are satisfied: GNU General Public License, version 2 | ||
| * with the GNU Classpath Exception which is available at | ||
| * https://www.gnu.org/software/classpath/license.html. | ||
| * | ||
| * SPDX-License-Identifier: EPL-2.0 OR GPL-2.0 WITH Classpath-exception-2.0 | ||
| ********************************************************************************/ | ||
|
|
||
| import { ContainerModule } from 'inversify'; | ||
| import { bindMainFrontend } from './main/browser/plugin-ext-frontend-module'; | ||
| import { bindElectronFrontend } from './main/electron-browser/plugin-ext-frontend-electron-module'; | ||
|
|
||
| export default new ContainerModule((bind, unbind, isBound, rebind) => { | ||
| bindMainFrontend(bind, unbind, isBound, rebind); | ||
| bindElectronFrontend(bind, unbind, isBound, rebind); | ||
| }); |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters