Skip to content

Commit a1eb7de

Browse files
ori-gold-pxori-gold-px
authored
Merge pull request #417 from PerimeterX/feature/user-identifiers-support
[ENT-20531] Feature/user identifiers support
2 parents a951644 + 6b918bc commit a1eb7de

7 files changed

Lines changed: 185 additions & 1 deletion

File tree

‎px_metadata.json‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,7 @@
3636
"sensitive_headers",
3737
"sensitive_routes",
3838
"telemetry_command",
39+
"user_identifiers",
3940
"vid_extraction"
4041
],
4142
"excluded_tests": [
@@ -51,6 +52,7 @@
5152
"test_cookie_v3_cookie_validation_failed_big_cookie",
5253
"test_client_ip_extraction_order_risk_api",
5354
"test_telemetry_command_verify_custom_function_hash",
54-
"test_first_party_timeout"
55+
"test_first_party_timeout",
56+
"test_huge_jwt_(cookie|header)_with_user_id_and_additional_fields"
5557
]
5658
}

‎src/main/java/com/perimeterx/internals/JwtUserIdentifiersExtractor.java‎

Lines changed: 105 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,105 @@
1+
package com.perimeterx.internals;
2+
3+
import com.fasterxml.jackson.databind.ObjectMapper;
4+
import com.perimeterx.models.PXContext;
5+
import com.perimeterx.models.configuration.PXConfiguration;
6+
7+
import javax.servlet.http.Cookie;
8+
import java.io.UnsupportedEncodingException;
9+
import java.net.URLDecoder;
10+
import java.nio.charset.StandardCharsets;
11+
import java.util.*;
12+
13+
public final class JwtUserIdentifiersExtractor {
14+
private static final ObjectMapper OM = new ObjectMapper();
15+
16+
private JwtUserIdentifiersExtractor() {}
17+
18+
public static void attachJwtIfConfigured(PXContext ctx, PXConfiguration cfg) {
19+
tryExtractFromCookie(ctx, cfg);
20+
if (ctx.getJwtAppUserId() != null || (ctx.getJwtAdditionalFields() != null && !ctx.getJwtAdditionalFields().isEmpty())) {
21+
return;
22+
}
23+
tryExtractFromHeader(ctx, cfg);
24+
}
25+
26+
private static void tryExtractFromCookie(PXContext ctx, PXConfiguration cfg) {
27+
String cookieName = nullToEmpty(cfg.getPxJwtCookieName());
28+
if (cookieName.isEmpty()) return;
29+
String token = findCookieValue(ctx, cookieName);
30+
buildAndSet(ctx, token, cfg.getPxJwtCookieUserIdFieldName(), safeList(cfg.getPxJwtCookieAdditionalFieldNames()));
31+
}
32+
33+
private static void tryExtractFromHeader(PXContext ctx, PXConfiguration cfg) {
34+
String headerName = nullToEmpty(cfg.getPxJwtHeaderName());
35+
if (headerName.isEmpty()) return;
36+
String raw = ctx.getRequest().getHeader(headerName);
37+
if (raw == null) return;
38+
String token = raw.startsWith("Bearer ") ? raw.substring(7).trim() : raw.trim();
39+
buildAndSet(ctx, token, cfg.getPxJwtHeaderUserIdFieldName(), safeList(cfg.getPxJwtHeaderAdditionalFieldNames()));
40+
}
41+
42+
private static void buildAndSet(PXContext ctx, String token, String userPath, List<String> additionalPaths) {
43+
if (isEmpty(token)) return;
44+
try {
45+
Map<String, Object> payload = decodePayload(token);
46+
String appUserId = asString(getByDotPath(payload, userPath));
47+
Map<String, Object> additional = collectByDotPaths(payload, additionalPaths);
48+
if (isEmpty(appUserId) && additional.isEmpty()) return;
49+
ctx.setJwtAppUserId(appUserId);
50+
ctx.setJwtAdditionalFields(additional.isEmpty() ? null : additional);
51+
} catch (Exception e) {
52+
ctx.logger.debug("JWT extraction skipped: invalid token", e);
53+
}
54+
}
55+
56+
private static Map<String, Object> decodePayload(String jwt) throws Exception {
57+
String[] parts = jwt.split("\\.");
58+
if (parts.length < 2) throw new IllegalArgumentException("Invalid JWT");
59+
byte[] json = Base64.getUrlDecoder().decode(parts[1]);
60+
return OM.readValue(json, Map.class);
61+
}
62+
63+
private static String findCookieValue(PXContext ctx, String name) {
64+
Cookie[] cookies = ctx.getRequest().getCookies();
65+
if (cookies == null) return null;
66+
for (Cookie c : cookies) {
67+
if (name.equals(c.getName())) {
68+
String v = c.getValue();
69+
try {
70+
return v != null ? URLDecoder.decode(v, StandardCharsets.UTF_8.toString()) : null;
71+
} catch (UnsupportedEncodingException e) {
72+
return v;
73+
}
74+
}
75+
}
76+
return null;
77+
}
78+
79+
private static Object getByDotPath(Map<String, Object> json, String path) {
80+
if (json == null || isEmpty(path)) return null;
81+
Object cur = json;
82+
for (String seg : path.split("\\.")) {
83+
if (!(cur instanceof Map)) return null;
84+
cur = ((Map<?, ?>) cur).get(seg);
85+
if (cur == null) return null;
86+
}
87+
return cur;
88+
}
89+
90+
private static Map<String, Object> collectByDotPaths(Map<String, Object> json, List<String> paths) {
91+
Map<String, Object> out = new LinkedHashMap<>();
92+
for (String p : paths) {
93+
Object v = getByDotPath(json, p);
94+
if (v != null) out.put(p, v);
95+
}
96+
return out;
97+
}
98+
99+
private static List<String> safeList(List<String> l) { return l == null ? Collections.emptyList() : l; }
100+
private static boolean isEmpty(String s) { return s == null || s.isEmpty(); }
101+
private static String nullToEmpty(String s) { return s == null ? "" : s; }
102+
private static String asString(Object v) { return v == null ? null : String.valueOf(v); }
103+
}
104+
105+

‎src/main/java/com/perimeterx/models/PXContext.java‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@
1313
import com.perimeterx.internals.cookie.cookieparsers.CookieHeaderParser;
1414
import com.perimeterx.internals.cookie.cookieparsers.HeaderParser;
1515
import com.perimeterx.internals.cookie.cookieparsers.MobileCookieHeaderParser;
16+
import com.perimeterx.internals.JwtUserIdentifiersExtractor;
1617
import com.perimeterx.models.configuration.ModuleMode;
1718
import com.perimeterx.models.configuration.PXConfiguration;
1819
import com.perimeterx.models.enforcererror.EnforcerErrorReasonInfo;
@@ -235,6 +236,10 @@ public class PXContext {
235236
private boolean isSensitiveRequest;
236237
private String additionalTokenInfo;
237238

239+
// JWT user identifiers
240+
private String jwtAppUserId;
241+
private Map<String, Object> jwtAdditionalFields;
242+
238243
/**
239244
* The cookie key used to decrypt the cookie
240245
*/
@@ -306,6 +311,12 @@ private void postInitContext(final HttpServletRequest request, PXConfiguration p
306311
} catch (Exception e) {
307312
logger.debug("failed to extract custom parameters from custom function", e);
308313
}
314+
315+
try {
316+
JwtUserIdentifiersExtractor.attachJwtIfConfigured(this, pxConfiguration);
317+
} catch (Exception e) {
318+
logger.debug("jwt identifiers extraction failed", e);
319+
}
309320
}
310321

311322
private IPXLogger getLogger(){

‎src/main/java/com/perimeterx/models/activities/CommonActivityDetails.java‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@
99
import com.perimeterx.models.httpmodels.Additional;
1010
import lombok.Getter;
1111

12+
import java.util.Map;
1213
import java.util.UUID;
1314

1415
@Getter
@@ -62,6 +63,12 @@ public class CommonActivityDetails implements ActivityDetails {
6263
@JsonProperty("cross_tab_session")
6364
public String pxCtsCookie;
6465

66+
@JsonProperty("app_user_id")
67+
public String appUserId;
68+
69+
@JsonProperty("jwt_additional_fields")
70+
public Map<String, Object> jwtAdditionalFields;
71+
6572
@JsonProperty("is_sensitive_route")
6673
public Boolean isSensitiveRoute;
6774

@@ -91,6 +98,8 @@ public CommonActivityDetails(PXContext context) {
9198
this.riskStartTime = additional.riskStartTime;
9299
this.enforcerStartTime = additional.enforcerStartTime;
93100
this.pxCtsCookie = additional.pxCtsCookie;
101+
this.appUserId = additional.appUserId;
102+
this.jwtAdditionalFields = additional.jwtAdditionalFields;
94103
this.isSensitiveRoute = additional.isSensitiveRoute;
95104
this.additionalTokenInfo = additional.additionalTokenInfo;
96105
}

‎src/main/java/com/perimeterx/models/configuration/PXConfiguration.java‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -334,6 +334,27 @@ public static void setPxLoggerSeverity(LoggerSeverity severity) {
334334

335335
@Builder.Default
336336
private Predicate<HttpServletRequest> filterByCustomFunction = req -> false;
337+
338+
// --- JWT user identifiers configuration ---
339+
@JsonProperty("px_jwt_cookie_name")
340+
private String pxJwtCookieName;
341+
342+
@JsonProperty("px_jwt_cookie_user_id_field_name")
343+
private String pxJwtCookieUserIdFieldName;
344+
345+
@Builder.Default
346+
@JsonProperty("px_jwt_cookie_additional_field_names")
347+
private List<String> pxJwtCookieAdditionalFieldNames = new ArrayList<>();
348+
349+
@JsonProperty("px_jwt_header_name")
350+
private String pxJwtHeaderName;
351+
352+
@JsonProperty("px_jwt_header_user_id_field_name")
353+
private String pxJwtHeaderUserIdFieldName;
354+
355+
@Builder.Default
356+
@JsonProperty("px_jwt_header_additional_field_names")
357+
private List<String> pxJwtHeaderAdditionalFieldNames = new ArrayList<>();
337358
/**
338359
* @return Configuration Object clone without cookieKey and authToken
339360
**/

‎src/main/java/com/perimeterx/models/httpmodels/Additional.java‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@
1212
import com.perimeterx.utils.Constants;
1313

1414
import java.util.Date;
15+
import java.util.Map;
1516
import java.util.Objects;
1617
import java.util.UUID;
1718

@@ -95,6 +96,12 @@ public class Additional {
9596
@JsonProperty("cross_tab_session")
9697
public String pxCtsCookie;
9798

99+
@JsonProperty("app_user_id")
100+
public String appUserId;
101+
102+
@JsonProperty("jwt_additional_fields")
103+
public Map<String, Object> jwtAdditionalFields;
104+
98105
@JsonProperty("is_sensitive_route")
99106
public Boolean isSensitiveRoute;
100107

@@ -122,6 +129,8 @@ public static Additional fromContext(PXContext ctx) {
122129
additional.enforcerStartTime = ctx.getEnforcerStartTime();
123130
additional.riskStartTime = new Date().getTime();
124131
additional.pxCtsCookie = ctx.getPxCtsCookie();
132+
additional.appUserId = ctx.getJwtAppUserId();
133+
additional.jwtAdditionalFields = ctx.getJwtAdditionalFields();
125134
additional.isSensitiveRoute = ctx.isSensitiveRequest();
126135
additional.additionalTokenInfo = ctx.getAdditionalTokenInfo();
127136

‎web/src/main/java/com/web/Config.java‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -160,6 +160,24 @@ public PXConfiguration getPxConfiguration() {
160160
case "px_secured_pxhd_enabled":
161161
builder.securedPxhdEnabled(enforcerConfig.getBoolean(key));
162162
break;
163+
case "px_jwt_cookie_name":
164+
builder.pxJwtCookieName(enforcerConfig.getString(key));
165+
break;
166+
case "px_jwt_cookie_user_id_field_name":
167+
builder.pxJwtCookieUserIdFieldName(enforcerConfig.getString(key));
168+
break;
169+
case "px_jwt_cookie_additional_field_names":
170+
builder.pxJwtCookieAdditionalFieldNames(extractStringList(key));
171+
break;
172+
case "px_jwt_header_name":
173+
builder.pxJwtHeaderName(enforcerConfig.getString(key));
174+
break;
175+
case "px_jwt_header_user_id_field_name":
176+
builder.pxJwtHeaderUserIdFieldName(enforcerConfig.getString(key));
177+
break;
178+
case "px_jwt_header_additional_field_names":
179+
builder.pxJwtHeaderAdditionalFieldNames(extractStringList(key));
180+
break;
163181
case "px_user_agent_max_length":
164182
case "px_risk_cookie_max_length":
165183
case "px_risk_cookie_max_iterations":
@@ -213,5 +231,14 @@ private int[] extractStatusCode(String key) {
213231
}
214232
return statusCode;
215233
}
234+
235+
private java.util.List<String> extractStringList(String key) {
236+
final JSONArray jsonField = enforcerConfig.getJSONArray(key);
237+
final java.util.List<String> out = new java.util.ArrayList<>(jsonField.length());
238+
for (int i = 0; i < jsonField.length(); i++) {
239+
out.add(jsonField.getString(i));
240+
}
241+
return out;
242+
}
216243
}
217244

0 commit comments

Comments
 (0)