Security: Authentication, Authorization, CSRF, XSS and CSP

package org.example.bookshelf.security;

import jakarta.enterprise.context.ApplicationScoped;
import jakarta.security.enterprise.authentication.mechanism.http.FormAuthenticationMechanismDefinition;
import jakarta.security.enterprise.authentication.mechanism.http.LoginToContinue;

@FormAuthenticationMechanismDefinition(
        loginToContinue = @LoginToContinue(
                loginPage = "/login-form.xhtml",
                errorPage = "/login-error.xhtml"))
@ApplicationScoped
public class SecurityConfig {
}

<!DOCTYPE html>
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:h="jakarta.faces.html">
<h:head><title>Sign in</title></h:head>
<h:body>
    <h1>Sign in</h1>
    <form method="post" action="j_security_check">
        <label for="u">User name</label>
        <input id="u" type="text" name="j_username" autocomplete="username"/>
        <label for="p">Password</label>
        <input id="p" type="password" name="j_password" autocomplete="current-password"/>
        <input type="submit" value="Sign in"/>
    </form>
</h:body>
</html>

package org.example.bookshelf.security;

import jakarta.enterprise.context.ApplicationScoped;
import jakarta.security.enterprise.authentication.mechanism.http.CustomFormAuthenticationMechanismDefinition;
import jakarta.security.enterprise.authentication.mechanism.http.LoginToContinue;

@CustomFormAuthenticationMechanismDefinition(
        loginToContinue = @LoginToContinue(
                loginPage = "/login.xhtml",
                errorPage = "",
                useForwardToLogin = false))
@ApplicationScoped
public class SecurityConfig {
}

<!DOCTYPE html>
<html xmlns="http://www.w3.org/1999/xhtml"
      xmlns:h="jakarta.faces.html"
      xmlns:f="jakarta.faces.core"
      xmlns:pt="jakarta.faces.passthrough">
<h:head><title>Sign in</title></h:head>
<h:body>
    <h1>Sign in</h1>
    <h:messages id="msgs" globalOnly="true"/>
    <h:form id="login" prependId="true">
        <h:outputLabel for="user" value="User name"/>
        <h:inputText id="user" value="#{loginBean.username}" required="true"
                     pt:autocomplete="username" pt:autocapitalize="none"/>
        <h:outputLabel for="pw" value="Password"/>
        <h:inputSecret id="pw" value="#{loginBean.password}" required="true"
                       redisplay="false" pt:autocomplete="current-password"/>
        <h:commandButton id="go" value="Sign in" action="#{loginBean.login}"/>
    </h:form>
</h:body>
</html>

package org.example.bookshelf.web;

import static jakarta.security.enterprise.authentication.mechanism.http.AuthenticationParameters.withParams;

import jakarta.enterprise.context.RequestScoped;
import jakarta.faces.application.FacesMessage;
import jakarta.faces.context.ExternalContext;
import jakarta.faces.context.FacesContext;
import jakarta.inject.Inject;
import jakarta.inject.Named;
import jakarta.security.enterprise.AuthenticationStatus;
import jakarta.security.enterprise.SecurityContext;
import jakarta.security.enterprise.credential.Password;
import jakarta.security.enterprise.credential.UsernamePasswordCredential;
import jakarta.servlet.ServletException;
import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;

@Named
@RequestScoped
public class LoginBean {

    private String username;
    private String password;

    @Inject
    SecurityContext securityContext;

    @Inject
    FacesContext facesContext;

    public String login() {
        ExternalContext external = facesContext.getExternalContext();
        AuthenticationStatus status = securityContext.authenticate(
                (HttpServletRequest) external.getRequest(),
                (HttpServletResponse) external.getResponse(),
                withParams().credential(new UsernamePasswordCredential(username, new Password(password))));
        password = null;
        switch (status) {
            case SEND_CONTINUE -> {
                // the mechanism has already sent a redirect to the page the caller asked for first
                facesContext.responseComplete();
                return null;
            }
            case SEND_FAILURE -> {
                // one message for "unknown user" and "wrong password": do not reveal which accounts exist
                facesContext.addMessage(null, new FacesMessage(FacesMessage.SEVERITY_ERROR,
                        "Invalid user name or password", null));
                return null;
            }
            case SUCCESS -> {
                // logged in directly from the login page: go to a fixed landing page
                return "/index.xhtml?faces-redirect=true";
            }
            default -> {
                return null;
            }
        }
    }

    public String logout() throws ServletException {
        ExternalContext external = facesContext.getExternalContext();
        ((HttpServletRequest) external.getRequest()).logout();
        external.invalidateSession();
        return "/login.xhtml?faces-redirect=true";
    }

    public String getUsername() {
        return username;
    }

    public void setUsername(String username) {
        this.username = username;
    }

    public String getPassword() {
        return password;
    }

    public void setPassword(String password) {
        this.password = password;
    }
}

package org.example.bookshelf.security;

import jakarta.annotation.PostConstruct;
import jakarta.enterprise.context.ApplicationScoped;
import jakarta.inject.Inject;
import jakarta.security.enterprise.identitystore.Pbkdf2PasswordHash;
import java.util.Map;

/** The one place that knows how passwords are hashed: PBKDF2 with HMAC-SHA-256 and the OWASP work factor, not the 2048 iterations of the default. */
@ApplicationScoped
public class PasswordService {

    @Inject
    Pbkdf2PasswordHash hasher;

    @PostConstruct
    void configure() {
        hasher.initialize(Map.of(
                "Pbkdf2PasswordHash.Algorithm", "PBKDF2WithHmacSHA256",
                "Pbkdf2PasswordHash.Iterations", "600000"));
    }

    /** Returns the encoded form: algorithm:iterations:base64(salt):base64(hash). */
    public String hash(char[] password) {
        return hasher.generate(password);
    }

    public boolean matches(char[] password, String storedHash) {
        return hasher.verify(password, storedHash);
    }
}

package org.example.bookshelf.security;

import jakarta.annotation.PostConstruct;
import jakarta.enterprise.context.ApplicationScoped;
import jakarta.inject.Inject;
import jakarta.security.enterprise.credential.UsernamePasswordCredential;
import jakarta.security.enterprise.identitystore.CredentialValidationResult;
import jakarta.security.enterprise.identitystore.IdentityStore;
import java.util.UUID;

@ApplicationScoped
public class BookshelfIdentityStore implements IdentityStore {

    @Inject
    AccountRepository accounts;

    @Inject
    PasswordService passwords;

    /** Hash of a random password nobody knows. Verified when the user does not exist, so both paths cost the same. */
    private String decoyHash;

    @PostConstruct
    void init() {
        decoyHash = passwords.hash(UUID.randomUUID().toString().toCharArray());
    }

    /** Called by the IdentityStoreHandler for UsernamePasswordCredential. */
    public CredentialValidationResult validate(UsernamePasswordCredential credential) {
        var account = accounts.find(credential.getCaller());
        String hash = account.map(Account::passwordHash).orElse(decoyHash);
        boolean valid = passwords.matches(credential.getPassword().getValue(), hash);
        if (account.isPresent() && valid) {
            return new CredentialValidationResult(account.get().username(), account.get().groups());
        }
        return CredentialValidationResult.INVALID_RESULT;
    }
}

package org.example.bookshelf.security;

import jakarta.annotation.PostConstruct;
import jakarta.enterprise.context.ApplicationScoped;
import jakarta.inject.Inject;
import java.util.Map;
import java.util.Optional;
import java.util.Set;
import java.util.concurrent.ConcurrentHashMap;

/**
 * Stand-in for a JPA repository. The demo accounts are seeded from the environment, so no password
 * is ever written into the source: BOOKSHELF_SEED_ADMIN_PASSWORD and BOOKSHELF_SEED_MEMBER_PASSWORD.
 */
@ApplicationScoped
public class AccountRepository {

    private final Map<String, Account> accounts = new ConcurrentHashMap<>();

    @Inject
    PasswordService passwords;

    @PostConstruct
    void seed() {
        register("admin", System.getenv("BOOKSHELF_SEED_ADMIN_PASSWORD"), Set.of("ADMIN", "MEMBER"));
        register("mira", System.getenv("BOOKSHELF_SEED_MEMBER_PASSWORD"), Set.of("MEMBER"));
    }

    /** Only the hash is kept. */
    public void register(String username, String password, Set<String> groups) {
        if (password != null && !password.isEmpty()) {
            accounts.put(username, new Account(username, passwords.hash(password.toCharArray()), groups));
        }
    }

    public Optional<Account> find(String username) {
        return Optional.ofNullable(accounts.get(username));
    }
}

package org.example.bookshelf.security;

import java.util.Set;

/** A stored account: the password is never kept, only the encoded PBKDF2 hash. */
public record Account(String username, String passwordHash, Set<String> groups) {
}

package org.example.bookshelf.security;

import jakarta.enterprise.context.ApplicationScoped;
import jakarta.security.enterprise.identitystore.DatabaseIdentityStoreDefinition;
import jakarta.security.enterprise.identitystore.Pbkdf2PasswordHash;

@DatabaseIdentityStoreDefinition(
        dataSourceLookup = "java:app/jdbc/bookshelf",
        callerQuery = "select password_hash from account where username = ?",
        groupsQuery = "select group_name from account_group where username = ?",
        hashAlgorithm = Pbkdf2PasswordHash.class,
        hashAlgorithmParameters = {
                "Pbkdf2PasswordHash.Algorithm=PBKDF2WithHmacSHA256",
                "Pbkdf2PasswordHash.Iterations=600000",
                "Pbkdf2PasswordHash.SaltSizeBytes=32",
                "Pbkdf2PasswordHash.KeySizeBytes=32"})
@ApplicationScoped
public class DatabaseStoreConfig {
}

package org.example.bookshelf.security;

import jakarta.enterprise.context.ApplicationScoped;
import jakarta.security.enterprise.identitystore.LdapIdentityStoreDefinition;

@LdapIdentityStoreDefinition(
        url = "${ldapConfig.url}",
        bindDn = "${ldapConfig.bindDn}",
        bindDnPassword = "${ldapConfig.bindPassword}",
        callerBaseDn = "ou=people,dc=example,dc=org",
        callerNameAttribute = "uid",
        groupSearchBase = "ou=groups,dc=example,dc=org",
        groupNameAttribute = "cn",
        groupMemberAttribute = "member")
@ApplicationScoped
public class LdapStoreConfig {
}

package org.example.bookshelf.security;

import jakarta.enterprise.context.ApplicationScoped;
import jakarta.inject.Named;

/** Reads the provider settings from the environment; nothing is hard-coded and nothing secret is in the WAR. */
@Named("openIdConfig")
@ApplicationScoped
public class OpenIdConfig {

    public String getIssuerUri() {
        return System.getenv("BOOKSHELF_OIDC_ISSUER");
    }

    public String getClientId() {
        return System.getenv("BOOKSHELF_OIDC_CLIENT_ID");
    }

    public String getClientSecret() {
        return System.getenv("BOOKSHELF_OIDC_CLIENT_SECRET");
    }
}

package org.example.bookshelf.security;

import jakarta.enterprise.context.ApplicationScoped;
import jakarta.security.enterprise.authentication.mechanism.http.OpenIdAuthenticationMechanismDefinition;
import jakarta.security.enterprise.authentication.mechanism.http.openid.ClaimsDefinition;
import jakarta.security.enterprise.authentication.mechanism.http.openid.LogoutDefinition;
import jakarta.security.enterprise.authentication.mechanism.http.openid.PromptType;

@OpenIdAuthenticationMechanismDefinition(
        providerURI = "${openIdConfig.issuerUri}",
        clientId = "${openIdConfig.clientId}",
        clientSecret = "${openIdConfig.clientSecret}",
        redirectURI = "${baseURL}/callback",
        scope = {"openid", "email", "profile"},
        useNonce = true,
        useSession = true,
        redirectToOriginalResource = true,
        tokenAutoRefresh = true,
        claimsDefinition = @ClaimsDefinition(callerNameClaim = "email", callerGroupsClaim = "groups"),
        logout = @LogoutDefinition(notifyProvider = true, redirectURI = "${baseURL}/"))
@ApplicationScoped
public class OidcSecurityConfig {
}

package org.example.bookshelf.web;

import jakarta.enterprise.context.RequestScoped;
import jakarta.inject.Inject;
import jakarta.inject.Named;
import jakarta.security.enterprise.identitystore.openid.OpenIdContext;

@Named
@RequestScoped
public class ProfileBean {

    @Inject
    OpenIdContext openId;

    /** The "sub" claim: the provider's stable identifier of the user. */
    public String getSubject() {
        return openId.getSubject();
    }

    /** A claim from the ID token; absent when the provider did not send it. */
    public String getEmail() {
        return openId.getClaims().getEmail().orElse("");
    }
}

<p id="role">isUserInRole(ADMIN)=#{request.isUserInRole('ADMIN')} MEMBER=#{facesContext.externalContext.isUserInRole('MEMBER')} remoteUser=#{request.remoteUser}</p>
<h:form id="f">
    <h:commandButton id="adminBtn" value="Delete withdrawn titles" action="#{adminBean.delete}"
                     rendered="#{request.isUserInRole('ADMIN')}"/>
    <h:commandButton id="guardedBtn" value="Delete withdrawn titles (always rendered)" action="#{adminBean.delete}"/>
    <h:commandButton id="rotate" value="Rotate session id" action="#{sessionHygieneBean.rotate}"/>
    <h:commandButton id="logout" value="Sign out" action="#{loginBean.logout}"/>
</h:form>

package org.example.bookshelf.security;

import jakarta.enterprise.util.Nonbinding;
import jakarta.interceptor.InterceptorBinding;
import java.lang.annotation.Retention;
import java.lang.annotation.RetentionPolicy;
import java.lang.annotation.Target;
import java.lang.annotation.ElementType;

/** The caller must be in at least one of the listed roles, whatever the view layer shows. */
@InterceptorBinding
@Retention(RetentionPolicy.RUNTIME)
@Target({ElementType.TYPE, ElementType.METHOD})
public @interface RolesRequired {
    @Nonbinding
    String[] value();
}

package org.example.bookshelf.security;

import jakarta.annotation.Priority;
import jakarta.inject.Inject;
import jakarta.interceptor.AroundInvoke;
import jakarta.interceptor.Interceptor;
import jakarta.interceptor.InvocationContext;
import jakarta.servlet.http.HttpServletRequest;
import java.util.Arrays;

@RolesRequired({})
@Interceptor
@Priority(Interceptor.Priority.APPLICATION)
public class RolesRequiredInterceptor {

    @Inject
    HttpServletRequest request;

    @AroundInvoke
    public Object check(InvocationContext context) throws Exception {
        RolesRequired required = context.getMethod().getAnnotation(RolesRequired.class);
        if (required == null) {
            required = context.getMethod().getDeclaringClass().getAnnotation(RolesRequired.class);
        }
        boolean allowed = required != null && Arrays.stream(required.value()).anyMatch(request::isUserInRole);
        if (!allowed) {
            throw new SecurityException("Caller is not allowed to call " + context.getMethod().getName());
        }
        return context.proceed();
    }
}

package org.example.bookshelf.service;

import jakarta.enterprise.context.ApplicationScoped;
import java.util.concurrent.atomic.AtomicInteger;
import org.example.bookshelf.security.RolesRequired;

/** Stand-in for the service that removes withdrawn titles; it only counts the calls that were allowed. */
@ApplicationScoped
public class CatalogueAdmin {

    private final AtomicInteger calls = new AtomicInteger();

    @RolesRequired("ADMIN")
    public int deleteAll() {
        return calls.incrementAndGet();
    }

    public int deletes() {
        return calls.get();
    }
}

package org.example.bookshelf.web;

import jakarta.enterprise.context.RequestScoped;
import jakarta.faces.application.FacesMessage;
import jakarta.faces.context.FacesContext;
import jakarta.inject.Inject;
import jakarta.inject.Named;
import org.example.bookshelf.service.CatalogueAdmin;

@Named
@RequestScoped
public class AdminBean {

    @Inject
    CatalogueAdmin catalogue;

    @Inject
    FacesContext facesContext;

    public String delete() {
        try {
            int calls = catalogue.deleteAll();
            facesContext.addMessage(null, new FacesMessage("deleted, count=" + calls));
        } catch (SecurityException e) {
            // the service refused: the view must not be the only place that knows the rule
            facesContext.addMessage(null, new FacesMessage(FacesMessage.SEVERITY_ERROR, "denied by service", null));
        }
        return null;
    }
}

package org.example.bookshelf.web;

import jakarta.enterprise.context.RequestScoped;
import jakarta.faces.context.ExternalContext;
import jakarta.faces.context.FacesContext;
import jakarta.inject.Inject;
import jakarta.inject.Named;
import java.io.IOException;

@Named
@RequestScoped
public class AccessGuard {

    @Inject
    FacesContext facesContext;

    /** Called from f:viewAction: answer 403 and stop the lifecycle when the caller lacks the role. */
    public void require(String role) throws IOException {
        ExternalContext external = facesContext.getExternalContext();
        if (!external.isUserInRole(role)) {
            external.responseSendError(403, "Forbidden");
            facesContext.responseComplete();
        }
    }
}

<!DOCTYPE html>
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:h="jakarta.faces.html" xmlns:f="jakarta.faces.core">
<f:metadata><f:viewAction action="#{accessGuard.require('ADMIN')}" onPostback="true"/></f:metadata>
<h:head><title>Guarded</title></h:head>
<h:body><h:form id="f"><h:commandButton id="b" value="inc" action="#{cspBean.inc}"/><h:outputText id="o" value="count=#{cspBean.count}"/></h:form></h:body>
</html>

<security-constraint>
    <web-resource-collection>
        <web-resource-name>Administration</web-resource-name>
        <url-pattern>/admin/*</url-pattern>
    </web-resource-collection>
    <auth-constraint><role-name>ADMIN</role-name></auth-constraint>
</security-constraint>
<security-constraint>
    <web-resource-collection>
        <web-resource-name>Members</web-resource-name>
        <url-pattern>/members/*</url-pattern>
    </web-resource-collection>
    <auth-constraint><role-name>**</role-name></auth-constraint>
</security-constraint>
<deny-uncovered-http-methods/>
<security-role><role-name>ADMIN</role-name></security-role>
<security-role><role-name>MEMBER</role-name></security-role>

<!DOCTYPE html>
<html xmlns="http://www.w3.org/1999/xhtml"
      xmlns:h="jakarta.faces.html"
      xmlns:f="jakarta.faces.core">
<h:head>
    <title>Hostile data, safe output</title>
    <h:outputScript name="title.js" library="bookshelf" target="head"/>
</h:head>
<h:body>
    <!-- 1. text: escaped by default, in a component and in plain template text -->
    <p id="t1"><h:outputText value="#{payloadBean.title}"/></p>
    <p id="t3">#{payloadBean.title}</p>

    <!-- 2. data for a script: an attribute (escaped for HTML), read with dataset by a script file -->
    <button id="b2" type="button" data-title="#{payloadBean.quoteBreak}">Show the title</button>
    <p id="shown"></p>

    <!-- 3. the rare field that must hold markup: sanitised, then written unescaped -->
    <p id="t5"><h:outputText value="#{payloadBean.htmlReview}" escape="false" converter="bookshelf.safeHtml"/></p>
</h:body>
</html>

document.addEventListener('DOMContentLoaded', function () {
    document.querySelectorAll('[data-title]').forEach(function (button) {
        button.addEventListener('click', function () {
            // textContent never parses markup, whatever the title contains
            document.getElementById('shown').textContent = button.dataset.title;
        });
    });
});

<!-- Mojarra 4.0.16 and later (including 4.1): nonce and header from the implementation -->
<context-param>
    <param-name>com.sun.faces.enableCspNonce</param-name>
    <param-value>true</param-value>
</context-param>
<!-- optional: a different policy; #{nonce} stands for the nonce of the response -->
<context-param>
    <param-name>com.sun.faces.cspPolicy</param-name>
    <param-value>script-src 'self' 'nonce-#{nonce}' 'strict-dynamic'; object-src 'none'; base-uri 'self'</param-value>
</context-param>

<!-- PrimeFaces: on, or reportOnly to find the violations first -->
<context-param>
    <param-name>primefaces.CSP</param-name>
    <param-value>reportOnly</param-value>
</context-param>
<context-param>
    <param-name>primefaces.CSP_REPORT_ONLY_POLICY</param-name>
    <param-value>script-src 'self'; report-uri /csp-reports</param-value>
</context-param>

<!DOCTYPE html>
<html xmlns="http://www.w3.org/1999/xhtml"
      xmlns:h="jakarta.faces.html" xmlns:f="jakarta.faces.core">
<h:head><title>CSP</title>
    <h:outputScript name="app.js" library="bookshelf"/>
    <!-- an inline script without a nonce: the policy blocks it -->
    <script>window.__inline = 'ran';</script>
</h:head>
<h:body>
    <h:form id="f">
        <h:outputText id="out" value="count=#{cspBean.count}"/>
        <h:commandButton id="hello" value="hello" action="#{cspBean.inc}" onclick="window.__onclick=1;"><f:ajax render="out"/></h:commandButton>
        <h:commandLink id="lnk" value="link" action="#{cspBean.inc}" onclick="window.__linkclick=1;"/>
    </h:form>
</h:body>
</html>

<session-config>
    <cookie-config>
        <http-only>true</http-only>
        <attribute>
            <attribute-name>SameSite</attribute-name>
            <attribute-value>Lax</attribute-value>
        </attribute>
    </cookie-config>
    <tracking-mode>COOKIE</tracking-mode>
</session-config>

package org.example.bookshelf.web;

import jakarta.enterprise.context.RequestScoped;
import jakarta.faces.context.FacesContext;
import jakarta.inject.Inject;
import jakarta.inject.Named;
import java.util.Map;

@Named
@RequestScoped
public class ThemeCookieBean {

    @Inject
    FacesContext facesContext;

    public String dark() {
        facesContext.getExternalContext().addResponseCookie("bookshelf.theme", "dark", Map.of(
                "path", "/bookshelf",
                "maxAge", 31_536_000,
                "secure", true,
                "httpOnly", true,
                "SameSite", "Strict"));
        return null;
    }
}

package org.example.bookshelf.web;

import jakarta.enterprise.context.RequestScoped;
import jakarta.faces.application.FacesMessage;
import jakarta.faces.context.FacesContext;
import jakarta.inject.Inject;
import jakarta.inject.Named;
import jakarta.servlet.http.HttpServletRequest;

@Named
@RequestScoped
public class SessionHygieneBean {

    @Inject
    FacesContext facesContext;

    /** For code that authenticates by itself (not through the container): always rotate the id right after a successful login. */
    public String rotate() {
        HttpServletRequest request = (HttpServletRequest) facesContext.getExternalContext().getRequest();
        request.getSession().setAttribute("marker", "kept");
        String before = request.getSession().getId();
        String after = request.changeSessionId();
        facesContext.addMessage(null, new FacesMessage("rotated=" + !before.equals(after) + " marker=" + request.getSession().getAttribute("marker")));
        return null;
    }
}

package org.example.bookshelf.web;

import jakarta.servlet.Filter;
import jakarta.servlet.FilterChain;
import jakarta.servlet.ServletException;
import jakarta.servlet.ServletRequest;
import jakarta.servlet.ServletResponse;
import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;
import java.io.IOException;

/** Adds the response headers that do not depend on the page: sniffing, referrer, framing and caching of private areas. */
public class SecurityHeadersFilter implements Filter {

    @Override
    public void doFilter(ServletRequest req, ServletResponse res, FilterChain chain) throws IOException, ServletException {
        HttpServletRequest request = (HttpServletRequest) req;
        HttpServletResponse response = (HttpServletResponse) res;
        response.setHeader("X-Content-Type-Options", "nosniff");
        response.setHeader("Referrer-Policy", "strict-origin-when-cross-origin");
        response.setHeader("Content-Security-Policy", "frame-ancestors 'none'");
        String path = request.getServletPath();
        if (path.startsWith("/members/") || path.startsWith("/admin/")) {
            response.setHeader("Cache-Control", "no-store");
        }
        chain.doFilter(req, res);
    }
}

<filter>
    <filter-name>securityHeaders</filter-name>
    <filter-class>org.example.bookshelf.web.SecurityHeadersFilter</filter-class>
</filter>
<filter>
    <filter-name>sameOrigin</filter-name>
    <filter-class>org.example.bookshelf.web.SameOriginFilter</filter-class>
</filter>
<filter-mapping>
    <filter-name>securityHeaders</filter-name>
    <url-pattern>/*</url-pattern>
</filter-mapping>