aboutsummaryrefslogtreecommitdiff
path: root/juick-www/src
diff options
context:
space:
mode:
Diffstat (limited to 'juick-www/src')
-rw-r--r--juick-www/src/main/java/com/juick/www/controllers/SocialLogin.java19
1 files changed, 6 insertions, 13 deletions
diff --git a/juick-www/src/main/java/com/juick/www/controllers/SocialLogin.java b/juick-www/src/main/java/com/juick/www/controllers/SocialLogin.java
index fdc2f6f2..522e9ab7 100644
--- a/juick-www/src/main/java/com/juick/www/controllers/SocialLogin.java
+++ b/juick-www/src/main/java/com/juick/www/controllers/SocialLogin.java
@@ -108,13 +108,10 @@ public class SocialLogin {
protected String doFacebookLogin(HttpServletRequest request,
@RequestParam(required = false) String code,
@RequestParam(required = false) String state,
- @CookieValue(required = false) String fbstate,
HttpServletResponse response) throws IOException, ExecutionException, InterruptedException {
if (StringUtils.isBlank(code)) {
- fbstate = UUID.randomUUID().toString();
-
- Cookie c = new Cookie("fbstate", fbstate);
- response.addCookie(c);
+ String fbstate = UUID.randomUUID().toString();
+ crosspostService.addFacebookState(fbstate);
OAuth20Service facebookAuthService = facebookBuilder
.apiSecret(FACEBOOK_SECRET)
.callback(FACEBOOK_REDIRECT)
@@ -124,12 +121,9 @@ public class SocialLogin {
return "redirect:" + facebookAuthService.getAuthorizationUrl();
}
- if (StringUtils.isBlank(fbstate) || !fbstate.equals(state)) {
+ if (!crosspostService.verifyFacebookState(state)) {
+ logger.error("state is missing");
throw new HttpBadRequestException();
- } else {
- Cookie c = new Cookie("fbstate", "-");
- c.setMaxAge(0);
- response.addCookie(c);
}
OAuth20Service facebookService = facebookBuilder
.apiKey(FACEBOOK_APPID)
@@ -163,8 +157,7 @@ public class SocialLogin {
response.addCookie(c);
return Utils.getPreviousPageByRequest(request).orElse("redirect:/");
} else if (fb.getVerified()) {
- String loginhash = UUID.randomUUID().toString();
- if (!crosspostService.createFacebookUser(fbID, loginhash, token.getAccessToken(), fb.getName(), fb.getLink())) {
+ if (!crosspostService.createFacebookUser(fbID, state, token.getAccessToken(), fb.getName(), fb.getLink())) {
if (StringUtils.isNotEmpty(fb.getEmail())) {
logger.info("found {} for facebook user {}", fb.getEmail(), fb.getLink());
Integer userId = crosspostService.getUIDbyFBID(fbID);
@@ -175,7 +168,7 @@ public class SocialLogin {
logger.info("email not found for facebook user {}", fb.getLink());
throw new HttpBadRequestException();
}
- return "redirect:/signup?type=fb&hash=" + loginhash;
+ return "redirect:/signup?type=fb&hash=" + state;
} else {
logger.error("Facebook account is not verified, id: {}", fbID);
throw new HttpBadRequestException();