1 // Copyright (c) 2011 The Chromium Authors. All rights reserved. 2 // Use of this source code is governed by a BSD-style license that can be 3 // found in the LICENSE file. 4 5 #ifndef NET_HTTP_HTTP_AUTH_CONTROLLER_H_ 6 #define NET_HTTP_HTTP_AUTH_CONTROLLER_H_ 7 8 #include <set> 9 #include <string> 10 11 #include "base/basictypes.h" 12 #include "base/memory/ref_counted.h" 13 #include "base/memory/scoped_ptr.h" 14 #include "base/threading/non_thread_safe.h" 15 #include "net/base/completion_callback.h" 16 #include "net/base/net_export.h" 17 #include "net/base/net_log.h" 18 #include "net/http/http_auth.h" 19 #include "url/gurl.h" 20 21 namespace net { 22 23 class AuthChallengeInfo; 24 class AuthCredentials; 25 class HttpAuthHandler; 26 class HttpAuthHandlerFactory; 27 class HttpAuthCache; 28 class HttpRequestHeaders; 29 struct HttpRequestInfo; 30 31 class NET_EXPORT_PRIVATE HttpAuthController 32 : public base::RefCounted<HttpAuthController>, 33 NON_EXPORTED_BASE(public base::NonThreadSafe) { 34 public: 35 // The arguments are self explanatory except possibly for |auth_url|, which 36 // should be both the auth target and auth path in a single url argument. 37 HttpAuthController(HttpAuth::Target target, 38 const GURL& auth_url, 39 HttpAuthCache* http_auth_cache, 40 HttpAuthHandlerFactory* http_auth_handler_factory); 41 42 // Generate an authentication token for |target| if necessary. The return 43 // value is a net error code. |OK| will be returned both in the case that 44 // a token is correctly generated synchronously, as well as when no tokens 45 // were necessary. 46 virtual int MaybeGenerateAuthToken(const HttpRequestInfo* request, 47 const CompletionCallback& callback, 48 const BoundNetLog& net_log); 49 50 // Adds either the proxy auth header, or the origin server auth header, 51 // as specified by |target_|. 52 virtual void AddAuthorizationHeader( 53 HttpRequestHeaders* authorization_headers); 54 55 // Checks for and handles HTTP status code 401 or 407. 56 // |HandleAuthChallenge()| returns OK on success, or a network error code 57 // otherwise. It may also populate |auth_info_|. 58 virtual int HandleAuthChallenge(scoped_refptr<HttpResponseHeaders> headers, 59 bool do_not_send_server_auth, 60 bool establishing_tunnel, 61 const BoundNetLog& net_log); 62 63 // Store the supplied credentials and prepare to restart the auth. 64 virtual void ResetAuth(const AuthCredentials& credentials); 65 66 virtual bool HaveAuthHandler() const; 67 68 virtual bool HaveAuth() const; 69 70 virtual scoped_refptr<AuthChallengeInfo> auth_info(); 71 72 virtual bool IsAuthSchemeDisabled(HttpAuth::Scheme scheme) const; 73 virtual void DisableAuthScheme(HttpAuth::Scheme scheme); 74 virtual void DisableEmbeddedIdentity(); 75 76 private: 77 // Actions for InvalidateCurrentHandler() 78 enum InvalidateHandlerAction { 79 INVALIDATE_HANDLER_AND_CACHED_CREDENTIALS, 80 INVALIDATE_HANDLER_AND_DISABLE_SCHEME, 81 INVALIDATE_HANDLER 82 }; 83 84 // So that we can mock this object. 85 friend class base::RefCounted<HttpAuthController>; 86 87 virtual ~HttpAuthController(); 88 89 // Searches the auth cache for an entry that encompasses the request's path. 90 // If such an entry is found, updates |identity_| and |handler_| with the 91 // cache entry's data and returns true. 92 bool SelectPreemptiveAuth(const BoundNetLog& net_log); 93 94 // Invalidates the current handler. If |action| is 95 // INVALIDATE_HANDLER_AND_CACHED_CREDENTIALS, then also invalidate 96 // the cached credentials used by the handler. 97 void InvalidateCurrentHandler(InvalidateHandlerAction action); 98 99 // Invalidates any auth cache entries after authentication has failed. 100 // The identity that was rejected is |identity_|. 101 void InvalidateRejectedAuthFromCache(); 102 103 // Sets |identity_| to the next identity that the transaction should try. It 104 // chooses candidates by searching the auth cache and the URL for a 105 // username:password. Returns true if an identity was found. 106 bool SelectNextAuthIdentityToTry(); 107 108 // Populates auth_info_ with the challenge information, so that 109 // URLRequestHttpJob can prompt for credentials. 110 void PopulateAuthChallenge(); 111 112 // If |result| indicates a permanent failure, disables the current 113 // auth scheme for this controller and returns true. Returns false 114 // otherwise. 115 bool DisableOnAuthHandlerResult(int result); 116 117 void OnIOComplete(int result); 118 119 // Indicates if this handler is for Proxy auth or Server auth. 120 HttpAuth::Target target_; 121 122 // Holds the {scheme, host, path, port} for the authentication target. 123 const GURL auth_url_; 124 125 // Holds the {scheme, host, port} for the authentication target. 126 const GURL auth_origin_; 127 128 // The absolute path of the resource needing authentication. 129 // For proxy authentication the path is empty. 130 const std::string auth_path_; 131 132 // |handler_| encapsulates the logic for the particular auth-scheme. 133 // This includes the challenge's parameters. If NULL, then there is no 134 // associated auth handler. 135 scoped_ptr<HttpAuthHandler> handler_; 136 137 // |identity_| holds the credentials that should be used by 138 // the handler_ to generate challenge responses. This identity can come from 139 // a number of places (url, cache, prompt). 140 HttpAuth::Identity identity_; 141 142 // |auth_token_| contains the opaque string to pass to the proxy or 143 // server to authenticate the client. 144 std::string auth_token_; 145 146 // Contains information about the auth challenge. 147 scoped_refptr<AuthChallengeInfo> auth_info_; 148 149 // True if we've used the username:password embedded in the URL. This 150 // makes sure we use the embedded identity only once for the transaction, 151 // preventing an infinite auth restart loop. 152 bool embedded_identity_used_; 153 154 // True if default credentials have already been tried for this transaction 155 // in response to an HTTP authentication challenge. 156 bool default_credentials_used_; 157 158 // These two are owned by the HttpNetworkSession/IOThread, which own the 159 // objects which reference |this|. Therefore, these raw pointers are valid 160 // for the lifetime of this object. 161 HttpAuthCache* const http_auth_cache_; 162 HttpAuthHandlerFactory* const http_auth_handler_factory_; 163 164 std::set<HttpAuth::Scheme> disabled_schemes_; 165 166 CompletionCallback callback_; 167 }; 168 169 } // namespace net 170 171 #endif // NET_HTTP_HTTP_AUTH_CONTROLLER_H_ 172