Skip to content

[BCLOUD-4792] Obscure app secret when logging authentication calls #18

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
gmowhiz merged 1 commit into from
May 3, 2023
Merged

[BCLOUD-4792] Obscure app secret when logging authentication calls #18

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
43 changes: 28 additions & 15 deletions src/main/java/com/bitheads/brainclouds2s/BrainCloudS2S.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,7 +20,8 @@

public class BrainCloudS2S implements Runnable {

public static final String DEFAULT_S2S_URL = "https://api.braincloudservers.com/s2sdispatcher";

public static final String DEFAULT_S2S_URL = "https://api.braincloudservers.com/s2sdispatcher";


private static final int CLIENT_NETWORK_ERROR_TIMEOUT = 90001;
Expand All @@ -32,6 +33,10 @@ public class BrainCloudS2S implements Runnable {
private static final int STATE_AUTHENTICATING = 1;
private static final int STATE_CONNECTED = 2;

private static final String MESSAGES = "messages";
private static final String DATA = "data";
private static final String SERVER_SECRET = "serverSecret";

private boolean _isInitialized = false;
private int _state = STATE_DISCONNECTED;
private boolean _autoAuth = false;
Expand Down Expand Up @@ -209,7 +214,7 @@ private JSONObject createPacket(JSONObject json) {
messages.put(json);

allMessages = new JSONObject();
allMessages.put("messages", messages);
allMessages.put(MESSAGES, messages);
}
allMessages.put("sessionId", _sessionId);
allMessages.put("packetId", _packetId);
Expand Down Expand Up @@ -277,18 +282,18 @@ public void authenticate(IS2SCallback callback) {
JSONObject authenticateData = new JSONObject();
authenticateData.put("appId", _appId);
authenticateData.put("serverName", _serverName);
authenticateData.put("serverSecret", _serverSecret);
authenticateData.put(SERVER_SECRET, _serverSecret);

JSONObject authenticateMsg = new JSONObject();
authenticateMsg.put("service", "authenticationV2");
authenticateMsg.put("operation", "AUTHENTICATE");
authenticateMsg.put("data", authenticateData);
authenticateMsg.put(DATA, authenticateData);

JSONArray messages = new JSONArray();
messages.put(authenticateMsg);

JSONObject allMessages = new JSONObject();
allMessages.put("messages", messages);
allMessages.put(MESSAGES, messages);
_packetId = 0;
allMessages.put("packetId", _packetId);

Expand All @@ -300,7 +305,7 @@ public void authenticate(IS2SCallback callback) {

if (message.getInt("status") == 200) {

JSONObject data = message.getJSONObject("data");
JSONObject data = message.getJSONObject(DATA);

_state = STATE_CONNECTED;
_packetId = rawResponse.getLong("packetId") + 1;
Expand Down Expand Up @@ -379,15 +384,23 @@ private void sendRawRequest(JSONObject jsonRequest, IS2SCallback callback) {
connection.setDoOutput(true);
connection.setRequestMethod("POST");
connection.setRequestProperty("Content-Type", "application/json");

String body = jsonRequest.toString() + "\r\n\r\n";

connection.setRequestProperty("charset", "utf-8");
byte[] postData;
postData = body.getBytes("UTF-8");
connection.setRequestProperty("Content-Length", Integer.toString(postData.length));

logRequest(jsonRequest);
String body = new StringBuilder().append(jsonRequest.toString()).append("\r\n\r\n").toString();
byte[] postData = body.getBytes("UTF-8");
connection.setRequestProperty("Content-Length", Integer.toString(postData.length));

// Don't log the app secret if this is an authentication
if (_state == STATE_AUTHENTICATING) {
JSONArray messages = jsonRequest.getJSONArray(MESSAGES);
JSONObject authMessage = messages.getJSONObject(0);
JSONObject authData = authMessage.getJSONObject(DATA);
String serverSecret = authData.getString(SERVER_SECRET);
if (serverSecret != null && serverSecret.length() > 5) {
authData.put(SERVER_SECRET, new StringBuilder().append(serverSecret.substring(0, 6)).append("******").toString());
}
}
logRequest(jsonRequest);

connection.connect();

Expand Down Expand Up @@ -600,11 +613,11 @@ public void runCallbacks(long timeoutMS) {
}


private void logRequest(JSONObject jsonRequest) {
private void logRequest(JSONObject request) {

if (_loggingEnabled) {
String msg = new StringBuilder("OUTGOING: ")
.append(jsonRequest.toString(2))
.append(request.toString(2))
.append(", t: ").append(new Date().toString())
.toString();
LogString(msg);
Expand Down