Package com.inductiveautomation.perspective.designer.workspace

Class DesignerSessionHeaders

java.lang.Object

com.inductiveautomation.perspective.designer.workspace.DesignerSessionHeaders

public final class DesignerSessionHeaders
extends Object

Shared JxBrowser network callback for the embedded Perspective Designer browsers.

The browser tags requests with a "designer-session-id" header so the Gateway can resolve the shared Designer session (read side: Routes#getSession). Because the callback is registered engine-wide, attaching it unconditionally also sent the header on the cross-site requests a Perspective view can make (e.g. an <iframe>), leaking the session id to external origins (IGN-15539). It now attaches the header only when the request is bound to a connected Gateway address; every other request proceeds untouched.

Field Summary

Fields

Modifier and Type	Field	Description
static final String	DESIGNER_SESSION_ID_HEADER	Header the Gateway reads to associate a request with the shared Designer session.

Method Summary

Modifier and Type	Method	Description
static com.teamdev.jxbrowser.net.callback.BeforeStartTransactionCallback.Response	beforeStartTransaction(com.teamdev.jxbrowser.net.callback.BeforeStartTransactionCallback.Params params)	Attaches the "designer-session-id" header to requests bound for the connected Gateway, leaving all other requests untouched.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

DESIGNER_SESSION_ID_HEADER

public static final String DESIGNER_SESSION_ID_HEADER

Header the Gateway reads to associate a request with the shared Designer session.

See Also:

• PerspectiveModule.DESIGNER_SESSION_ID_HEADER
• Constant Field Values

Method Details

beforeStartTransaction

public static com.teamdev.jxbrowser.net.callback.BeforeStartTransactionCallback.Response beforeStartTransaction(com.teamdev.jxbrowser.net.callback.BeforeStartTransactionCallback.Params params)

Attaches the "designer-session-id" header to requests bound for the connected Gateway, leaving all other requests untouched.

Parameters:

params - the transaction parameters supplied by JxBrowser.

Returns:

an override carrying the session header for Gateway-bound requests, otherwise proceed().