org.apache.myfaces.shared_impl.util
Class StateUtils

java.lang.Object
  extended by org.apache.myfaces.shared_impl.util.StateUtils

public final class StateUtils
extends java.lang.Object

This Class exposes a handful of methods related to encryption, compression and serialization.

To enable encryption, a secret must be provided. StateUtils looks first for the org.apache.myfaces.SECRET init param. If a secret cannot be located, encryption is not used.

All parameters are interpretted as base 64 encoded keys. In other words, if your secret is "76543210", you would put "NzY1NDMyMTA=" in the deployment descriptor. This is needed so that key values are not limited to just values composed of printable characters.

If you are using CBC mode encryption, you must specify an initialization vector. StateUtils will throw an exception otherwise.

If you are using the AES algorithm and getting a SecurityException complaining about keysize, you most likely need to get the unlimited strength jurisdiction policy files from a place like http://java.sun.com/j2se/1.4.2/download.html .

Author:
Dennis C. Byrne, ich
See Also:
org.apache.myfaces.webapp.StartupServletContextListener

Field Summary
static java.lang.String DEFAULT_ALGORITHM
           
static java.lang.String DEFAULT_ALGORITHM_PARAMS
           
static java.lang.String INIT_ALGORITHM
           
static java.lang.String INIT_ALGORITHM_IV
           
static java.lang.String INIT_ALGORITHM_PARAM
           
static java.lang.String INIT_PREFIX
           
static java.lang.String INIT_SECRET
           
static java.lang.String INIT_SECRET_KEY_CACHE
           
static java.lang.String SERIAL_FACTORY
           
static java.lang.String ZIP_CHARSET
           
 
Method Summary
static byte[] compress(byte[] bytes)
           
static java.lang.String construct(java.lang.Object object, javax.faces.context.ExternalContext ctx)
          This fires during the Render Response phase.
static byte[] decode(byte[] bytes)
           
static byte[] decompress(byte[] bytes)
           
static byte[] decrypt(byte[] secure, javax.faces.context.ExternalContext ctx)
           
static boolean enableCompression(javax.faces.context.ExternalContext ctx)
           
static byte[] encode(byte[] bytes)
           
static java.lang.String encode64(java.lang.Object obj)
           
static byte[] encrypt(byte[] insecure, javax.faces.context.ExternalContext ctx)
           
static byte[] getAsByteArray(java.lang.Object object, javax.faces.context.ExternalContext ctx)
           
static java.lang.Object getAsObject(byte[] bytes, javax.faces.context.ExternalContext ctx)
           
static void initSecret(javax.servlet.ServletContext ctx)
          Does nothing if the user has disabled the SecretKey cache.
static boolean isSecure(javax.faces.context.ExternalContext ctx)
           
static void main(java.lang.String[] args)
           
static java.lang.Object reconstruct(java.lang.String string, javax.faces.context.ExternalContext ctx)
          This fires during the Restore View phase.
 
Methods inherited from class java.lang.Object
clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait
 

Field Detail

ZIP_CHARSET

public static final java.lang.String ZIP_CHARSET
See Also:
Constant Field Values

DEFAULT_ALGORITHM

public static final java.lang.String DEFAULT_ALGORITHM
See Also:
Constant Field Values

DEFAULT_ALGORITHM_PARAMS

public static final java.lang.String DEFAULT_ALGORITHM_PARAMS
See Also:
Constant Field Values

INIT_PREFIX

public static final java.lang.String INIT_PREFIX
See Also:
Constant Field Values

INIT_SECRET

public static final java.lang.String INIT_SECRET
See Also:
Constant Field Values

INIT_ALGORITHM

public static final java.lang.String INIT_ALGORITHM
See Also:
Constant Field Values

INIT_SECRET_KEY_CACHE

public static final java.lang.String INIT_SECRET_KEY_CACHE
See Also:
Constant Field Values

INIT_ALGORITHM_IV

public static final java.lang.String INIT_ALGORITHM_IV
See Also:
Constant Field Values

INIT_ALGORITHM_PARAM

public static final java.lang.String INIT_ALGORITHM_PARAM
See Also:
Constant Field Values

SERIAL_FACTORY

public static final java.lang.String SERIAL_FACTORY
See Also:
Constant Field Values
Method Detail

enableCompression

public static boolean enableCompression(javax.faces.context.ExternalContext ctx)

isSecure

public static boolean isSecure(javax.faces.context.ExternalContext ctx)

construct

public static java.lang.String construct(java.lang.Object object,
                                         javax.faces.context.ExternalContext ctx)
This fires during the Render Response phase.


getAsByteArray

public static byte[] getAsByteArray(java.lang.Object object,
                                    javax.faces.context.ExternalContext ctx)

encrypt

public static byte[] encrypt(byte[] insecure,
                             javax.faces.context.ExternalContext ctx)

compress

public static byte[] compress(byte[] bytes)

encode

public static byte[] encode(byte[] bytes)

reconstruct

public static java.lang.Object reconstruct(java.lang.String string,
                                           javax.faces.context.ExternalContext ctx)
This fires during the Restore View phase.


decode

public static byte[] decode(byte[] bytes)

decompress

public static byte[] decompress(byte[] bytes)

decrypt

public static byte[] decrypt(byte[] secure,
                             javax.faces.context.ExternalContext ctx)

getAsObject

public static java.lang.Object getAsObject(byte[] bytes,
                                           javax.faces.context.ExternalContext ctx)

encode64

public static java.lang.String encode64(java.lang.Object obj)

main

public static void main(java.lang.String[] args)
                 throws java.io.UnsupportedEncodingException
Throws:
java.io.UnsupportedEncodingException

initSecret

public static void initSecret(javax.servlet.ServletContext ctx)
Does nothing if the user has disabled the SecretKey cache. This is useful when dealing with a JCA provider whose SecretKey implementation is not thread safe. Instantiates a SecretKey instance based upon what the user has specified in the deployment descriptor. The SecretKey is then stored in application scope where it can be used for all requests.



Copyright © 2011. All Rights Reserved.