Initiated in index.jsp. Invalidates session and Security Shepherd tokens are removed. The user is logged out. @param csrfToken
(HttpServletRequest request, HttpServletResponse response)
| 44 | * @param csrfToken |
| 45 | */ |
| 46 | public void doGet (HttpServletRequest request, HttpServletResponse response) |
| 47 | throws ServletException, IOException |
| 48 | { |
| 49 | //Setting IpAddress To Log and taking header for original IP if forwarded from proxy |
| 50 | ShepherdLogManager.setRequestIp(request.getRemoteAddr(), request.getHeader("X-Forwarded-For")); |
| 51 | log.debug("**** servlets.Logout ***"); |
| 52 | HttpSession ses = request.getSession(true); |
| 53 | if(Validate.validateSession(ses)) |
| 54 | { |
| 55 | ShepherdLogManager.setRequestIp(request.getRemoteAddr(), request.getHeader("X-Forwarded-For"), ses.getAttribute("userName").toString()); |
| 56 | log.debug("Current User: " + ses.getAttribute("userName").toString()); |
| 57 | Cookie tokenCookie = Validate.getToken(request.getCookies()); |
| 58 | Object tokenParmeter = request.getParameter("csrfToken"); |
| 59 | if(Validate.validateTokens(tokenCookie, tokenParmeter)) |
| 60 | { |
| 61 | //Remove Everything |
| 62 | ses.removeAttribute("userStamp"); |
| 63 | ses.removeAttribute("userName"); |
| 64 | ses.removeAttribute("userRole"); |
| 65 | //Invalid Session on server |
| 66 | ses.invalidate(); |
| 67 | ses = request.getSession(true); |
| 68 | //Remove cookie |
| 69 | Cookie emptyCookie = new Cookie("token", ""); |
| 70 | response.addCookie(emptyCookie); |
| 71 | log.debug("User Logged Out"); |
| 72 | response.sendRedirect("login.jsp"); |
| 73 | } |
| 74 | else |
| 75 | { |
| 76 | log.error("CSRF Attack Detected"); |
| 77 | response.sendRedirect("index.jsp"); |
| 78 | } |
| 79 | } |
| 80 | else |
| 81 | { |
| 82 | log.error("Logout Function Called with no valid session"); |
| 83 | response.sendRedirect("login.jsp"); |
| 84 | } |
| 85 | log.debug("*** END Logout ***"); |
| 86 | } |
| 87 | } |