Package org.forgerock.openam.services.baseurl

Class BaseURLProviders

  • public final class BaseURLProviders
extends Object
    Tells apart the base URL providers that read the request from the ones that do not.

    • Method Detail

      • isRequestDerived

        public static boolean isRequestDerived​(BaseURLProvider provider)
        Tells whether the base URL a provider yields is built out of the incoming request.

        Anything a caller can put in a request - the Forwarded and X-Forwarded-* headers, the host it was addressed to - is a value the caller chose, unless every route into the container rewrites it. A base URL built out of one may be perfectly good for rendering links back to OpenAM, but it says nothing about which origins this server actually answers on, so security decisions may not rest on it.

        The extension provider is asked about its delegate rather than about itself: it is a wrapper around the class named in base-url-extension-class, and that setting takes any BaseURLProvider, including the header based ones shipped here. What the wrapper is asked to wrap is what decides the answer. An extension class of your own is taken at its word - a provider that reads request headers of its own accord can not be told apart from one that does not - so an extension used on a realm whose goto URL list is empty has to yield an origin the deployment fixed rather than one the caller supplied.

        Parameters:
        provider - The provider configured for a realm, may be null.
        Returns:
        true if its base URL comes from the request, or if there is no provider to ask.