String incomingSecretKeyValue = extContext.getRequestParameterMap().
get(ResponseStateManager.NON_POSTBACK_VIEW_TOKEN_PARAM);
String correctSecretKeyValue = rsm.getCryptographicallyStrongTokenFromSession(context);
if (null == incomingSecretKeyValue ||
!correctSecretKeyValue.equals(incomingSecretKeyValue)) {
throw new ProtectedViewException();
}
String sep = "/";
// Check the referer header
if (headers.containsKey("Referer")) {
String referer = headers.get("Referer");
boolean refererIsInProtectedSet = isProtectedView(referer, urlPatterns);
if (!refererIsInProtectedSet) {
boolean refererOriginatesInThisWebapp = false;
try {
refererOriginatesInThisWebapp = originatesInWebapp(context, referer, vdl);
} catch(URISyntaxException ue) {
throw new ProtectedViewException(ue);
}
if (!refererOriginatesInThisWebapp) {
String message = FacesLogger.LIFECYCLE.interpolateMessage(context,
"jsf.lifecycle.invalid.referer", new String [] { referer, viewId });
if (LOGGER.isLoggable(Level.SEVERE)) {
LOGGER.log(Level.SEVERE, message);
}
throw new ProtectedViewException(message);
}
}
}
// Check the origin header
if (headers.containsKey("Origin")) {
String origin = headers.get("Origin");
boolean originIsInProtectedSet = isProtectedView(origin, urlPatterns);
if (!originIsInProtectedSet) {
boolean originOriginatesInThisWebapp = false;
try {
originOriginatesInThisWebapp = originatesInWebapp(context, origin, vdl);
} catch(URISyntaxException ue) {
throw new ProtectedViewException(ue);
}
if (!originOriginatesInThisWebapp) {
String message = FacesLogger.LIFECYCLE.interpolateMessage(context,
"jsf.lifecycle.invalid.origin", new String [] { origin, viewId });
if (LOGGER.isLoggable(Level.SEVERE)) {
LOGGER.log(Level.SEVERE, message);
}
throw new ProtectedViewException(message);
}
}
}
}
}