| // Copyright 2015 The Chromium Authors. All rights reserved. |
| // Use of this source code is governed by a BSD-style license that can be |
| // found in the LICENSE file. |
| |
| #include "components/signin/ios/browser/account_consistency_service.h" |
| |
| #import <WebKit/WebKit.h> |
| |
| #include "base/logging.h" |
| #import "base/mac/foundation_util.h" |
| #include "base/macros.h" |
| #include "base/strings/sys_string_conversions.h" |
| #include "components/google/core/browser/google_util.h" |
| #include "components/pref_registry/pref_registry_syncable.h" |
| #include "components/prefs/scoped_user_pref_update.h" |
| #include "components/signin/core/browser/account_reconcilor.h" |
| #include "components/signin/core/browser/profile_management_switches.h" |
| #include "components/signin/core/browser/signin_client.h" |
| #include "components/signin/core/browser/signin_header_helper.h" |
| #include "ios/web/public/browser_state.h" |
| #include "ios/web/public/web_state/web_state_policy_decider.h" |
| #include "ios/web/public/web_view_creation_util.h" |
| #include "net/base/mac/url_conversions.h" |
| #include "net/base/registry_controlled_domains/registry_controlled_domain.h" |
| #include "url/gurl.h" |
| |
| #if !defined(__has_feature) || !__has_feature(objc_arc) |
| #error "This file requires ARC support." |
| #endif |
| |
| namespace { |
| |
| // Threshold (in hours) used to control whether the CHROME_CONNECTED cookie |
| // should be added again on a domain it was previously set. |
| const int kHoursThresholdToReAddCookie = 24; |
| |
| // JavaScript template used to set (or delete) the CHROME_CONNECTED cookie. |
| // It takes 3 arguments: the domain of the cookie, its value and its expiration |
| // date. It also clears the legacy X-CHROME-CONNECTED cookie. |
| NSString* const kChromeConnectedCookieTemplate = |
| @"<html><script>domain=\"%@\";" |
| "document.cookie=\"X-CHROME-CONNECTED=; path=/; domain=\" + domain + \";" |
| " expires=Thu, 01-Jan-1970 00:00:01 GMT\";" |
| "document.cookie=\"CHROME_CONNECTED=%@; path=/; domain=\" + domain + \";" |
| " expires=\" + new Date(%f).toGMTString() + \"; secure;\"</script></html>"; |
| |
| // WebStatePolicyDecider that monitors the HTTP headers on Gaia responses, |
| // reacting on the X-Chrome-Manage-Accounts header and notifying its delegate. |
| // It also notifies the AccountConsistencyService of domains it should add the |
| // CHROME_CONNECTED cookie to. |
| class AccountConsistencyHandler : public web::WebStatePolicyDecider { |
| public: |
| AccountConsistencyHandler(web::WebState* web_state, |
| AccountConsistencyService* service, |
| AccountReconcilor* account_reconcilor, |
| id<ManageAccountsDelegate> delegate); |
| |
| private: |
| // web::WebStatePolicyDecider override |
| bool ShouldAllowResponse(NSURLResponse* response, |
| bool for_main_frame) override; |
| void WebStateDestroyed() override; |
| |
| AccountConsistencyService* account_consistency_service_; // Weak. |
| AccountReconcilor* account_reconcilor_; // Weak. |
| __weak id<ManageAccountsDelegate> delegate_; |
| }; |
| } |
| |
| AccountConsistencyHandler::AccountConsistencyHandler( |
| web::WebState* web_state, |
| AccountConsistencyService* service, |
| AccountReconcilor* account_reconcilor, |
| id<ManageAccountsDelegate> delegate) |
| : web::WebStatePolicyDecider(web_state), |
| account_consistency_service_(service), |
| account_reconcilor_(account_reconcilor), |
| delegate_(delegate) {} |
| |
| bool AccountConsistencyHandler::ShouldAllowResponse(NSURLResponse* response, |
| bool for_main_frame) { |
| NSHTTPURLResponse* http_response = |
| base::mac::ObjCCast<NSHTTPURLResponse>(response); |
| if (!http_response) |
| return true; |
| |
| GURL url = net::GURLWithNSURL(http_response.URL); |
| if (google_util::IsGoogleDomainUrl( |
| url, google_util::ALLOW_SUBDOMAIN, |
| google_util::DISALLOW_NON_STANDARD_PORTS)) { |
| // User is showing intent to navigate to a Google domain. Add the |
| // CHROME_CONNECTED cookie to the domain if necessary. |
| std::string domain = net::registry_controlled_domains::GetDomainAndRegistry( |
| url, net::registry_controlled_domains::EXCLUDE_PRIVATE_REGISTRIES); |
| account_consistency_service_->AddChromeConnectedCookieToDomain( |
| domain, true /* force_update_if_too_old */); |
| account_consistency_service_->AddChromeConnectedCookieToDomain( |
| "google.com", true /* force_update_if_too_old */); |
| } |
| |
| if (!gaia::IsGaiaSignonRealm(url.GetOrigin())) |
| return true; |
| NSString* manage_accounts_header = [[http_response allHeaderFields] |
| objectForKey:@"X-Chrome-Manage-Accounts"]; |
| if (!manage_accounts_header) |
| return true; |
| |
| signin::ManageAccountsParams params = signin::BuildManageAccountsParams( |
| base::SysNSStringToUTF8(manage_accounts_header)); |
| |
| account_reconcilor_->OnReceivedManageAccountsResponse(params.service_type); |
| switch (params.service_type) { |
| case signin::GAIA_SERVICE_TYPE_INCOGNITO: { |
| GURL continue_url = GURL(params.continue_url); |
| DLOG_IF(ERROR, !params.continue_url.empty() && !continue_url.is_valid()) |
| << "Invalid continuation URL: \"" << continue_url << "\""; |
| [delegate_ onGoIncognito:continue_url]; |
| break; |
| } |
| case signin::GAIA_SERVICE_TYPE_SIGNUP: |
| case signin::GAIA_SERVICE_TYPE_ADDSESSION: |
| [delegate_ onAddAccount]; |
| break; |
| case signin::GAIA_SERVICE_TYPE_SIGNOUT: |
| case signin::GAIA_SERVICE_TYPE_REAUTH: |
| case signin::GAIA_SERVICE_TYPE_DEFAULT: |
| [delegate_ onManageAccounts]; |
| break; |
| case signin::GAIA_SERVICE_TYPE_NONE: |
| NOTREACHED(); |
| break; |
| } |
| |
| // WKWebView loads a blank page even if the response code is 204 |
| // ("No Content"). http://crbug.com/368717 |
| // |
| // Manage accounts responses are handled via native UI. Abort this request |
| // for the following reasons: |
| // * Avoid loading a blank page in WKWebView. |
| // * Avoid adding this request to history. |
| return false; |
| } |
| |
| void AccountConsistencyHandler::WebStateDestroyed() { |
| account_consistency_service_->RemoveWebStateHandler(web_state()); |
| } |
| |
| // WKWebView navigation delegate that calls its callback every time a navigation |
| // has finished. |
| @interface AccountConsistencyNavigationDelegate : NSObject<WKNavigationDelegate> |
| |
| // Designated initializer. |callback| will be called every time a navigation has |
| // finished. |callback| must not be empty. |
| - (instancetype)initWithCallback:(const base::Closure&)callback |
| NS_DESIGNATED_INITIALIZER; |
| |
| - (instancetype)init NS_UNAVAILABLE; |
| @end |
| |
| @implementation AccountConsistencyNavigationDelegate { |
| // Callback that will be called every time a navigation has finished. |
| base::Closure _callback; |
| } |
| |
| - (instancetype)initWithCallback:(const base::Closure&)callback { |
| self = [super init]; |
| if (self) { |
| DCHECK(!callback.is_null()); |
| _callback = callback; |
| } |
| return self; |
| } |
| |
| - (instancetype)init { |
| NOTREACHED(); |
| return nil; |
| } |
| |
| #pragma mark - WKNavigationDelegate |
| |
| - (void)webView:(WKWebView*)webView |
| didFinishNavigation:(WKNavigation*)navigation { |
| _callback.Run(); |
| } |
| |
| @end |
| |
| const char AccountConsistencyService::kDomainsWithCookiePref[] = |
| "signin.domains_with_cookie"; |
| |
| AccountConsistencyService::CookieRequest |
| AccountConsistencyService::CookieRequest::CreateAddCookieRequest( |
| const std::string& domain) { |
| AccountConsistencyService::CookieRequest cookie_request; |
| cookie_request.request_type = ADD_CHROME_CONNECTED_COOKIE; |
| cookie_request.domain = domain; |
| return cookie_request; |
| } |
| |
| AccountConsistencyService::CookieRequest |
| AccountConsistencyService::CookieRequest::CreateRemoveCookieRequest( |
| const std::string& domain, |
| base::OnceClosure callback) { |
| AccountConsistencyService::CookieRequest cookie_request; |
| cookie_request.request_type = REMOVE_CHROME_CONNECTED_COOKIE; |
| cookie_request.domain = domain; |
| cookie_request.callback = std::move(callback); |
| return cookie_request; |
| } |
| |
| AccountConsistencyService::CookieRequest::CookieRequest() = default; |
| |
| AccountConsistencyService::CookieRequest::~CookieRequest() = default; |
| |
| AccountConsistencyService::CookieRequest::CookieRequest( |
| AccountConsistencyService::CookieRequest&&) = default; |
| |
| AccountConsistencyService::AccountConsistencyService( |
| web::BrowserState* browser_state, |
| AccountReconcilor* account_reconcilor, |
| scoped_refptr<content_settings::CookieSettings> cookie_settings, |
| GaiaCookieManagerService* gaia_cookie_manager_service, |
| SigninClient* signin_client, |
| SigninManager* signin_manager) |
| : browser_state_(browser_state), |
| account_reconcilor_(account_reconcilor), |
| cookie_settings_(cookie_settings), |
| gaia_cookie_manager_service_(gaia_cookie_manager_service), |
| signin_client_(signin_client), |
| signin_manager_(signin_manager), |
| applying_cookie_requests_(false) { |
| gaia_cookie_manager_service_->AddObserver(this); |
| signin_manager_->AddObserver(this); |
| ActiveStateManager::FromBrowserState(browser_state_)->AddObserver(this); |
| LoadFromPrefs(); |
| if (signin_manager_->IsAuthenticated()) { |
| AddChromeConnectedCookies(); |
| } else { |
| RemoveChromeConnectedCookies(base::OnceClosure()); |
| } |
| } |
| |
| AccountConsistencyService::~AccountConsistencyService() { |
| DCHECK(!web_view_); |
| DCHECK(!navigation_delegate_); |
| } |
| |
| // static |
| void AccountConsistencyService::RegisterPrefs( |
| user_prefs::PrefRegistrySyncable* registry) { |
| registry->RegisterDictionaryPref( |
| AccountConsistencyService::kDomainsWithCookiePref); |
| } |
| |
| void AccountConsistencyService::SetWebStateHandler( |
| web::WebState* web_state, |
| id<ManageAccountsDelegate> delegate) { |
| DCHECK_EQ(0u, web_state_handlers_.count(web_state)); |
| web_state_handlers_[web_state].reset(new AccountConsistencyHandler( |
| web_state, this, account_reconcilor_, delegate)); |
| } |
| |
| void AccountConsistencyService::RemoveWebStateHandler( |
| web::WebState* web_state) { |
| DCHECK_LT(0u, web_state_handlers_.count(web_state)); |
| web_state_handlers_.erase(web_state); |
| } |
| |
| bool AccountConsistencyService::ShouldAddChromeConnectedCookieToDomain( |
| const std::string& domain, |
| bool force_update_if_too_old) { |
| auto it = last_cookie_update_map_.find(domain); |
| if (it == last_cookie_update_map_.end()) { |
| // |domain| isn't in the map, always add the cookie. |
| return true; |
| } |
| if (!force_update_if_too_old) { |
| // |domain| is in the map and the cookie is considered valid. Don't add it |
| // again. |
| return false; |
| } |
| return (base::Time::Now() - it->second) > |
| base::TimeDelta::FromHours(kHoursThresholdToReAddCookie); |
| } |
| |
| void AccountConsistencyService::RemoveChromeConnectedCookies( |
| base::OnceClosure callback) { |
| DCHECK(!browser_state_->IsOffTheRecord()); |
| if (last_cookie_update_map_.empty()) { |
| if (!callback.is_null()) |
| std::move(callback).Run(); |
| return; |
| } |
| std::map<std::string, base::Time> last_cookie_update_map = |
| last_cookie_update_map_; |
| auto iter_last_item = std::prev(last_cookie_update_map.end()); |
| for (auto iter = last_cookie_update_map.begin(); iter != iter_last_item; |
| iter++) { |
| RemoveChromeConnectedCookieFromDomain(iter->first, base::OnceClosure()); |
| } |
| RemoveChromeConnectedCookieFromDomain(iter_last_item->first, |
| std::move(callback)); |
| } |
| |
| void AccountConsistencyService::AddChromeConnectedCookieToDomain( |
| const std::string& domain, |
| bool force_update_if_too_old) { |
| if (!ShouldAddChromeConnectedCookieToDomain(domain, |
| force_update_if_too_old)) { |
| return; |
| } |
| last_cookie_update_map_[domain] = base::Time::Now(); |
| cookie_requests_.push_back(CookieRequest::CreateAddCookieRequest(domain)); |
| ApplyCookieRequests(); |
| } |
| |
| void AccountConsistencyService::RemoveChromeConnectedCookieFromDomain( |
| const std::string& domain, |
| base::OnceClosure callback) { |
| DCHECK_NE(0ul, last_cookie_update_map_.count(domain)); |
| last_cookie_update_map_.erase(domain); |
| cookie_requests_.push_back( |
| CookieRequest::CreateRemoveCookieRequest(domain, std::move(callback))); |
| ApplyCookieRequests(); |
| } |
| |
| void AccountConsistencyService::LoadFromPrefs() { |
| const base::DictionaryValue* dict = |
| signin_client_->GetPrefs()->GetDictionary(kDomainsWithCookiePref); |
| for (base::DictionaryValue::Iterator it(*dict); !it.IsAtEnd(); it.Advance()) { |
| last_cookie_update_map_[it.key()] = base::Time(); |
| } |
| } |
| |
| void AccountConsistencyService::Shutdown() { |
| gaia_cookie_manager_service_->RemoveObserver(this); |
| signin_manager_->RemoveObserver(this); |
| ActiveStateManager::FromBrowserState(browser_state_)->RemoveObserver(this); |
| ResetWKWebView(); |
| web_state_handlers_.clear(); |
| } |
| |
| void AccountConsistencyService::ApplyCookieRequests() { |
| if (applying_cookie_requests_) { |
| // A cookie request is already being applied, the following ones will be |
| // handled as soon as the current one is done. |
| return; |
| } |
| if (cookie_requests_.empty()) { |
| return; |
| } |
| if (!ActiveStateManager::FromBrowserState(browser_state_)->IsActive()) { |
| // Web view usage isn't active for now, ignore cookie requests for now and |
| // wait to be notified that it became active again. |
| return; |
| } |
| applying_cookie_requests_ = true; |
| |
| const GURL url("https://" + cookie_requests_.front().domain); |
| std::string cookie_value = ""; |
| // Expiration date of the cookie in the JavaScript convention of time, a |
| // number of milliseconds since the epoch. |
| double expiration_date = 0; |
| switch (cookie_requests_.front().request_type) { |
| case ADD_CHROME_CONNECTED_COOKIE: |
| cookie_value = signin::BuildMirrorRequestCookieIfPossible( |
| url, signin_manager_->GetAuthenticatedAccountInfo().gaia, |
| signin::AccountConsistencyMethod::kMirror, cookie_settings_.get(), |
| signin::PROFILE_MODE_DEFAULT); |
| if (cookie_value.empty()) { |
| // Don't add the cookie. Tentatively correct |last_cookie_update_map_|. |
| last_cookie_update_map_.erase(cookie_requests_.front().domain); |
| FinishedApplyingCookieRequest(false); |
| return; |
| } |
| // Create expiration date of Now+2y to roughly follow the APISID cookie. |
| expiration_date = |
| (base::Time::Now() + base::TimeDelta::FromDays(730)).ToJsTime(); |
| break; |
| case REMOVE_CHROME_CONNECTED_COOKIE: |
| // Nothing to do. Default values correspond to removing the cookie (no |
| // value, expiration date in the past). |
| break; |
| } |
| NSString* html = [NSString |
| stringWithFormat:kChromeConnectedCookieTemplate, |
| base::SysUTF8ToNSString(url.host()), |
| base::SysUTF8ToNSString(cookie_value), expiration_date]; |
| // Load an HTML string with embedded JavaScript that will set or remove the |
| // cookie. By setting the base URL to |url|, this effectively allows to modify |
| // cookies on the correct domain without having to do a network request. |
| [GetWKWebView() loadHTMLString:html baseURL:net::NSURLWithGURL(url)]; |
| } |
| |
| void AccountConsistencyService::FinishedApplyingCookieRequest(bool success) { |
| DCHECK(!cookie_requests_.empty()); |
| CookieRequest& request = cookie_requests_.front(); |
| if (success) { |
| DictionaryPrefUpdate update( |
| signin_client_->GetPrefs(), |
| AccountConsistencyService::kDomainsWithCookiePref); |
| switch (request.request_type) { |
| case ADD_CHROME_CONNECTED_COOKIE: |
| // Add request.domain to prefs, use |true| as a dummy value (that is |
| // never used), as the dictionary is used as a set. |
| update->SetKey(request.domain, base::Value(true)); |
| break; |
| case REMOVE_CHROME_CONNECTED_COOKIE: |
| // Remove request.domain from prefs. |
| update->RemoveWithoutPathExpansion(request.domain, nullptr); |
| break; |
| } |
| } |
| base::OnceClosure callback(std::move(request.callback)); |
| cookie_requests_.pop_front(); |
| applying_cookie_requests_ = false; |
| ApplyCookieRequests(); |
| if (!callback.is_null()) { |
| std::move(callback).Run(); |
| } |
| } |
| |
| WKWebView* AccountConsistencyService::GetWKWebView() { |
| if (!ActiveStateManager::FromBrowserState(browser_state_)->IsActive()) { |
| // |browser_state_| is not active, WKWebView linked to this browser state |
| // should not exist or be created. |
| return nil; |
| } |
| if (!web_view_) { |
| web_view_ = BuildWKWebView(); |
| navigation_delegate_ = [[AccountConsistencyNavigationDelegate alloc] |
| initWithCallback:base::Bind(&AccountConsistencyService:: |
| FinishedApplyingCookieRequest, |
| base::Unretained(this), true)]; |
| [web_view_ setNavigationDelegate:navigation_delegate_]; |
| } |
| return web_view_; |
| } |
| |
| WKWebView* AccountConsistencyService::BuildWKWebView() { |
| return web::BuildWKWebView(CGRectZero, browser_state_); |
| } |
| |
| void AccountConsistencyService::ResetWKWebView() { |
| [web_view_ setNavigationDelegate:nil]; |
| [web_view_ stopLoading]; |
| web_view_ = nil; |
| navigation_delegate_ = nil; |
| applying_cookie_requests_ = false; |
| } |
| |
| void AccountConsistencyService::AddChromeConnectedCookies() { |
| DCHECK(!browser_state_->IsOffTheRecord()); |
| // These cookie request are preventive and not a strong signal (unlike |
| // navigation to a domain). Don't force update the old cookies in this case. |
| AddChromeConnectedCookieToDomain("google.com", |
| false /* force_update_if_too_old */); |
| AddChromeConnectedCookieToDomain("youtube.com", |
| false /* force_update_if_too_old */); |
| } |
| |
| void AccountConsistencyService::OnBrowsingDataRemoved() { |
| // CHROME_CONNECTED cookies have been removed, update internal state |
| // accordingly. |
| ResetWKWebView(); |
| for (auto& cookie_request : cookie_requests_) { |
| base::OnceClosure callback(std::move(cookie_request.callback)); |
| if (!callback.is_null()) { |
| std::move(callback).Run(); |
| } |
| } |
| cookie_requests_.clear(); |
| last_cookie_update_map_.clear(); |
| base::DictionaryValue dict; |
| signin_client_->GetPrefs()->Set(kDomainsWithCookiePref, dict); |
| |
| // APISID cookie has been removed, notify the GCMS. |
| gaia_cookie_manager_service_->ForceOnCookieChangeProcessing(); |
| } |
| |
| void AccountConsistencyService::OnAddAccountToCookieCompleted( |
| const std::string& account_id, |
| const GoogleServiceAuthError& error) { |
| AddChromeConnectedCookies(); |
| } |
| |
| void AccountConsistencyService::OnGaiaAccountsInCookieUpdated( |
| const std::vector<gaia::ListedAccount>& accounts, |
| const std::vector<gaia::ListedAccount>& signed_out_accounts, |
| const GoogleServiceAuthError& error) { |
| AddChromeConnectedCookies(); |
| } |
| |
| void AccountConsistencyService::GoogleSigninSucceeded( |
| const std::string& account_id, |
| const std::string& username) { |
| AddChromeConnectedCookies(); |
| } |
| |
| void AccountConsistencyService::GoogleSignedOut(const std::string& account_id, |
| const std::string& username) { |
| // There is not need to remove CHROME_CONNECTED cookies on |GoogleSignedOut| |
| // events as these cookies will be removed by the GaiaCookieManagerServer |
| // right before fetching the Gaia logout request. |
| } |
| |
| void AccountConsistencyService::OnActive() { |
| // |browser_state_| is now active. There might be some pending cookie requests |
| // to apply. |
| ApplyCookieRequests(); |
| } |
| |
| void AccountConsistencyService::OnInactive() { |
| // |browser_state_| is now inactive. Stop using |web_view_| and don't create |
| // a new one until it is active. |
| ResetWKWebView(); |
| } |
