SimpleSAML\Utils\HTTP Class Reference

Collaboration diagram for SimpleSAML\Utils\HTTP:

Static Public Member Functions
static	getServerHTTPS ()
	Retrieve HTTPS status from $_SERVER environment variables. More...
static	getServerPort ()
	Retrieve the port number from $_SERVER environment variables. More...
static	checkSessionCookie ($retryURL=null)
	Check for session cookie, and show missing-cookie page if it is missing. More...
static	checkURLAllowed ($url, array $trustedSites=null)
	Check if a URL is valid and is in our list of allowed URLs. More...
static	fetch ($url, $context=array(), $getHeaders=false)
	Helper function to retrieve a file or URL with proxy support, also supporting proxy basic authorization. More...
static	getAcceptLanguage ()
	This function parses the Accept-Language HTTP header and returns an associative array with each language and the score for that language. More...
static	guessBasePath ()
	Try to guess the base SimpleSAMLphp path from the current request. More...
static	getBaseURL ()
	Retrieve the base URL of the SimpleSAMLphp installation. More...
static	getFirstPathElement ($trailingslash=true)
	Retrieve the first element of the URL path. More...
static	getPOSTRedirectURL ($destination, $data)
	Create a link which will POST data. More...
static	getSelfHost ()
	Retrieve our own host. More...
static	getSelfHostWithPath ()
	Retrieve our own host together with the URL path. More...
static	getSelfURLNoQuery ()
	Retrieve the current URL using the base URL in the configuration, without the query parameters. More...
static	isHTTPS ()
	This function checks if we are using HTTPS as protocol. More...
static	normalizeURL ($url)
	Normalizes a URL to an absolute URL and validate it. More...
static	parseQueryString ($query_string)
	Parse a query string into an array. More...
static	redirectTrustedURL ($url, $parameters=array())
	This function redirects to the specified URL without performing any security checks. More...
static	redirectUntrustedURL ($url, $parameters=array())
	This function redirects to the specified URL after performing the appropriate security checks on it. More...
static	resolveURL ($url, $base=null)
	Resolve a (possibly relative) URL relative to a given base URL. More...
static	setCookie ($name, $value, $params=null, $throw=true)
	Set a cookie. More...
static	submitPOSTData ($destination, $data)
	Submit a POST form to a specific destination. More...

Static Private Member Functions
static	getSecurePOSTRedirectURL ($destination, $data)
	Obtain a URL where we can redirect to securely post a form with the given data to a specific destination. More...
static	getServerHost ()
	Retrieve Host value from $_SERVER environment variables. More...
static	redirect ($url, $parameters=array())
	This function redirects the user to the specified address. More...
static	savePOSTData (\SimpleSAML_Session $session, $destination, $data)
	Save the given HTTP POST data and the destination where it should be posted to a given session. More...

Detailed Description

Definition at line 12 of file HTTP.php.

Member Function Documentation

checkSessionCookie()

static SimpleSAML\Utils\HTTP::checkSessionCookie (   $retryURL = null )

static

Check for session cookie, and show missing-cookie page if it is missing.

Parameters

string | null

$retryURL

The URL the user should access to retry the operation. Defaults to null.

Returns

void If there is a session cookie, nothing will be returned. Otherwise, the user will be redirected to a page telling about the missing cookie.

Exceptions

InvalidArgumentException If $retryURL is neither a string nor null.

Author

Olav Morken, UNINETT AS olav..nosp@m.mork.nosp@m.en@un.nosp@m.inet.nosp@m.t.no

Definition at line 287 of file HTTP.php.

    {
        if (!is_null($retryURL) && !is_string($retryURL)) {
            throw new \InvalidArgumentException('Invalid input parameters.');
        }
 
        $session = \SimpleSAML_Session::getSessionFromRequest();
        if ($session->hasSessionCookie()) {
            return;
        }
 
        // we didn't have a session cookie. Redirect to the no-cookie page
 
        $url = Module::getModuleURL('core/no_cookie.php');
        if ($retryURL !== null) {
            $url = self::addURLParameters($url, array('retryURL' => $retryURL));
        }
        self::redirectTrustedURL($url);
    }

Referenced by SimpleSAML_Utilities\checkCookie(), sspmod_saml_IdP_SAML1\receiveAuthnRequest(), and sspmod_saml_IdP_SAML2\receiveAuthnRequest().

Here is the caller graph for this function:

checkURLAllowed()

static SimpleSAML\Utils\HTTP::checkURLAllowed (   $url, array  $trustedSites = null  )

static

Check if a URL is valid and is in our list of allowed URLs.

Parameters

string	$url	The URL to check.
array	$trustedSites	An optional white list of domains. If none specified, the 'trusted.url.domains' configuration directive will be used.

Returns

string The normalized URL itself if it is allowed. An empty string if the $url parameter is empty as defined by the empty() function.

Exceptions

InvalidArgumentException If the URL is malformed.

Exceptions

SimpleSAML_Error_Exception If the URL is not allowed by configuration.

Author

Jaime Perez, UNINETT AS jaime.nosp@m..per.nosp@m.ez@un.nosp@m.inet.nosp@m.t.no

Definition at line 322 of file HTTP.php.

    {
        if (empty($url)) {
            return '';
        }
        $url = self::normalizeURL($url);
 
        if (filter_var($url, FILTER_VALIDATE_URL) === false) {
            throw new \SimpleSAML_Error_Exception('Invalid URL: '.$url);
        }
 
        // get the white list of domains
        if ($trustedSites === null) {
            $trustedSites = \SimpleSAML_Configuration::getInstance()->getValue('trusted.url.domains', array());
        }
 
        // validates the URL's host is among those allowed
        if (is_array($trustedSites)) {
            assert(is_array($trustedSites));
            $components = parse_url($url);
            $hostname = $components['host'];
 
            // check for userinfo
            if ((isset($components['user']) && strpos($components['user'], '\\') !== false) ||
                (isset($components['pass']) && strpos($components['pass'], '\\') !== false)
            ) {
                throw new \SimpleSAML_Error_Exception('Invalid URL: '.$url);
            }
 
            // allow URLs with standard ports specified (non-standard ports must then be allowed explicitly)
            if (isset($components['port']) &&
                (($components['scheme'] === 'http' && $components['port'] !== 80) ||
                 ($components['scheme'] === 'https' && $components['port'] !== 443))
            ) {
                $hostname = $hostname.':'.$components['port'];
            }
 
            $self_host = self::getSelfHostWithNonStandardPort();
 
            $trustedRegex = \SimpleSAML_Configuration::getInstance()->getValue('trusted.url.regex', false);
 
            $trusted = false;
            if ($trustedRegex) {
                // add self host to the white list
                $trustedSites[] = preg_quote($self_host);
                foreach ($trustedSites as $regex) {
                    // Add start and end delimiters.
                    $regex = "@^{$regex}$@";
                    if (preg_match($regex, $hostname)) {
                        $trusted = true;
                        break;
                    }
                }
            } else {
                // add self host to the white list
                $trustedSites[] = $self_host;
                $trusted = in_array($hostname, $trustedSites, true);
            }
 
            // throw exception due to redirection to untrusted site
            if (!$trusted) {
                throw new \SimpleSAML_Error_Exception('URL not allowed: '.$url);
            }
        }
        return $url;
    }

Referenced by SimpleSAML_XHTML_IdPDisco\__construct().

Here is the caller graph for this function:

fetch()

static SimpleSAML\Utils\HTTP::fetch (   $url,   $context = array(),   $getHeaders = false  )

static

Helper function to retrieve a file or URL with proxy support, also supporting proxy basic authorization.

An exception will be thrown if we are unable to retrieve the data.

Parameters

string	$url	The path or URL we should fetch.
array	$context	Extra context options. This parameter is optional.
boolean	$getHeaders	Whether to also return response headers. Optional.

Returns

string|array An array if $getHeaders is set, containing the data and the headers respectively; string otherwise.

Exceptions

InvalidArgumentException If the input parameters are invalid.

Exceptions

SimpleSAML_Error_Exception If the file or URL cannot be retrieved.

Author

Andjelko Horvat

Olav Morken, UNINETT AS olav..nosp@m.mork.nosp@m.en@un.nosp@m.inet.nosp@m.t.no

Marco Ferrante, University of Genova marco.nosp@m.@csi.nosp@m.ta.un.nosp@m.ige..nosp@m.it

Definition at line 409 of file HTTP.php.

    {
        if (!is_string($url)) {
            throw new \InvalidArgumentException('Invalid input parameters.');
        }
 
        $config = \SimpleSAML_Configuration::getInstance();
 
        $proxy = $config->getString('proxy', null);
        if ($proxy !== null) {
            if (!isset($context['http']['proxy'])) {
                $context['http']['proxy'] = $proxy;
            }
            $proxy_auth = $config->getString('proxy.auth', false);
            if ($proxy_auth !== false) {
                $context['http']['header'] = "Proxy-Authorization: Basic".base64_encode($proxy_auth);
            }
            if (!isset($context['http']['request_fulluri'])) {
                $context['http']['request_fulluri'] = true;
            }
            /*
             * If the remote endpoint over HTTPS uses the SNI extension (Server Name Indication RFC 4366), the proxy
             * could introduce a mismatch between the names in the Host: HTTP header and the SNI_server_name in TLS
             * negotiation (thanks to Cristiano Valli @ GARR-IDEM to have pointed this problem).
             * See: https://bugs.php.net/bug.php?id=63519
             * These controls will force the same value for both fields.
             * Marco Ferrante (marco@csita.unige.it), Nov 2012
             */
            if (preg_match('#^https#i', $url)
                && defined('OPENSSL_TLSEXT_SERVER_NAME')
                && OPENSSL_TLSEXT_SERVER_NAME
            ) {
                // extract the hostname
                $hostname = parse_url($url, PHP_URL_HOST);
                if (!empty($hostname)) {
                    $context['ssl'] = array(
                        'SNI_server_name' => $hostname,
                        'SNI_enabled'     => true,
                    );
                } else {
                    Logger::warning('Invalid URL format or local URL used through a proxy');
                }
            }
        }
 
        $context = stream_context_create($context);
        $data = file_get_contents($url, false, $context);
        if ($data === false) {
            $error = error_get_last();
            throw new \SimpleSAML_Error_Exception('Error fetching '.var_export($url, true).':'.
                (is_array($error) ? $error['message'] : 'no error available'));
        }
 
        // data and headers
        if ($getHeaders) {
            if (isset($http_response_header)) {
                $headers = array();
                foreach ($http_response_header as $h) {
                    if (preg_match('@^HTTP/1\.[01]\s+\d{3}\s+@', $h)) {
                        $headers = array(); // reset
                        $headers[0] = $h;
                        continue;
                    }
                    $bits = explode(':', $h, 2);
                    if (count($bits) === 2) {
                        $headers[strtolower($bits[0])] = trim($bits[1]);
                    }
                }
            } else {
                // no HTTP headers, probably a different protocol, e.g. file
                $headers = null;
            }
            return array($data, $headers);
        }
 
        return $data;
    }

Referenced by sspmod_cas_Auth_Source_CAS\casServiceValidate(), sspmod_cas_Auth_Source_CAS\casValidate(), sspmod_authwindowslive_Auth_Source_LiveID\finalStep(), sspmod_metarefresh_MetaLoader\loadSource(), SimpleSAML_Metadata_SAMLParser\parseDescriptorsFile(), and SimpleSAML_Metadata_SAMLParser\parseFile().

Here is the caller graph for this function:

getAcceptLanguage()

static SimpleSAML\Utils\HTTP::getAcceptLanguage ( )

static

This function parses the Accept-Language HTTP header and returns an associative array with each language and the score for that language.

If a language includes a region, then the result will include both the language with the region and the language without the region.

The returned array will be in the same order as the input.

Returns

array An associative array with each language and the score for that language.

Author

Olav Morken, UNINETT AS olav..nosp@m.mork.nosp@m.en@un.nosp@m.inet.nosp@m.t.no

Definition at line 499 of file HTTP.php.

    {
        if (!array_key_exists('HTTP_ACCEPT_LANGUAGE', $_SERVER)) {
            // no Accept-Language header, return an empty set
            return array();
        }
 
        $languages = explode(',', strtolower($_SERVER['HTTP_ACCEPT_LANGUAGE']));
 
        $ret = array();
 
        foreach ($languages as $l) {
            $opts = explode(';', $l);
 
            $l = trim(array_shift($opts)); // the language is the first element
 
            $q = 1.0;
 
            // iterate over all options, and check for the quality option
            foreach ($opts as $o) {
                $o = explode('=', $o);
                if (count($o) < 2) {
                    // skip option with no value
                    continue;
                }
 
                $name = trim($o[0]);
                $value = trim($o[1]);
 
                if ($name === 'q') {
                    $q = (float) $value;
                }
            }
 
            // remove the old key to ensure that the element is added to the end
            unset($ret[$l]);
 
            // set the quality in the result
            $ret[$l] = $q;
 
            if (strpos($l, '-')) {
                // the language includes a region part
 
                // extract the language without the region
                $l = explode('-', $l);
                $l = $l[0];
 
                // add this language to the result (unless it is defined already)
                if (!array_key_exists($l, $ret)) {
                    $ret[$l] = $q;
                }
            }
        }
        return $ret;
    }

Referenced by SimpleSAML\Locale\Language\getHTTPLanguage().

Here is the caller graph for this function:

getBaseURL()

static SimpleSAML\Utils\HTTP::getBaseURL ( )

static

Retrieve the base URL of the SimpleSAMLphp installation.

The URL will always end with a '/'. For example: https://idp.example.org/simplesaml/

Returns

string The absolute base URL for the SimpleSAMLphp installation.

Exceptions

SimpleSAML\Error\CriticalConfigurationError If 'baseurlpath' has an invalid format.

Author

Olav Morken, UNINETT AS olav..nosp@m.mork.nosp@m.en@un.nosp@m.inet.nosp@m.t.no

Definition at line 598 of file HTTP.php.

    {
        $globalConfig = \SimpleSAML_Configuration::getInstance();
        $baseURL = $globalConfig->getString('baseurlpath', 'simplesaml/');
 
        if (preg_match('#^https?://.*/?$#D', $baseURL, $matches)) {
            // full URL in baseurlpath, override local server values
            return rtrim($baseURL, '/').'/';
        } elseif (
            (preg_match('#^/?([^/]?.*/)$#D', $baseURL, $matches)) ||
            (preg_match('#^\*(.*)/$#D', $baseURL, $matches)) ||
            ($baseURL === '')
        ) {
            // get server values
            $protocol = 'http';
            $protocol .= (self::getServerHTTPS()) ? 's' : '';
            $protocol .= '://';
 
            $hostname = self::getServerHost();
            $port = self::getServerPort();
            $path = $globalConfig->getBasePath();
 
            return $protocol.$hostname.$port.$path;
        } else {
            /*
             * Invalid 'baseurlpath'. We cannot recover from this, so throw a critical exception and try to be graceful
             * with the configuration. Use a guessed base path instead of the one provided.
             */
            $c = $globalConfig->toArray();
            $c['baseurlpath'] = self::guessBasePath();
            throw new \SimpleSAML\Error\CriticalConfigurationError(
                'Invalid value for \'baseurlpath\' in config.php. Valid format is in the form: '.
                '[(http|https)://(hostname|fqdn)[:port]]/[path/to/simplesaml/]. It must end with a \'/\'.',
                null,
                $c
            );
        }
    }

Referenced by SimpleSAML_Metadata_MetaDataStorageHandlerFlatFile\generateDynamicHostedEntityID(), SimpleSAML_Metadata_MetaDataStorageHandlerPdo\generateDynamicHostedEntityID(), and SimpleSAML_Error_Error\show().

Here is the caller graph for this function:

getFirstPathElement()

static SimpleSAML\Utils\HTTP::getFirstPathElement (   $trailingslash = true )

static

Retrieve the first element of the URL path.

Parameters

boolean

$trailingslash

Whether to add a trailing slash to the element or not. Defaults to true.

Returns

string The first element of the URL path, with an optional, trailing slash.

Author

Andreas Solberg, UNINETT AS andre.nosp@m.as.s.nosp@m.olber.nosp@m.g@un.nosp@m.inett.nosp@m..no

Definition at line 647 of file HTTP.php.

    {
        if (preg_match('|^/(.*?)/|', $_SERVER['SCRIPT_NAME'], $matches)) {
            return ($trailingslash ? '/' : '').$matches[1];
        }
        return '';
    }

getPOSTRedirectURL()

static SimpleSAML\Utils\HTTP::getPOSTRedirectURL (   $destination,   $data  )

static

Create a link which will POST data.

Parameters

string	$destination	The destination URL.
array	$data	The name-value pairs which will be posted to the destination.

Returns

string A URL which can be accessed to post the data.

Exceptions

InvalidArgumentException If $destination is not a string or $data is not an array.

Author

Andjelko Horvat

Jaime Perez, UNINETT AS jaime.nosp@m..per.nosp@m.ez@un.nosp@m.inet.nosp@m.t.no

Definition at line 668 of file HTTP.php.

    {
        if (!is_string($destination) || !is_array($data)) {
            throw new \InvalidArgumentException('Invalid input parameters.');
        }
 
        $config = \SimpleSAML_Configuration::getInstance();
        $allowed = $config->getBoolean('enable.http_post', false);
 
        if ($allowed && preg_match("#^http:#", $destination) && self::isHTTPS()) {
            // we need to post the data to HTTP
            $url = self::getSecurePOSTRedirectURL($destination, $data);
        } else { // post the data directly
            $session = \SimpleSAML_Session::getSessionFromRequest();
            $id = self::savePOSTData($session, $destination, $data);
            $url = Module::getModuleURL('core/postredirect.php', array('RedirId' => $id));
        }
 
        return $url;
    }

Referenced by SimpleSAML\Auth\Simple\login().

Here is the caller graph for this function:

getSecurePOSTRedirectURL()

static SimpleSAML\Utils\HTTP::getSecurePOSTRedirectURL (   $destination,   $data  )

staticprivate

Obtain a URL where we can redirect to securely post a form with the given data to a specific destination.

Parameters

string	$destination	The destination URL.
array	$data	An associative array containing the data to be posted to $destination.

Exceptions

SimpleSAML_Error_Exception If the current session is transient.

Returns

string A URL which allows to securely post a form to $destination.

Author

Jaime Perez, UNINETT AS jaime.nosp@m..per.nosp@m.ez@un.nosp@m.inet.nosp@m.t.no

Definition at line 26 of file HTTP.php.

    {
        $session = \SimpleSAML_Session::getSessionFromRequest();
        $id = self::savePOSTData($session, $destination, $data);
 
        // get the session ID
        $session_id = $session->getSessionId();
        if (is_null($session_id)) {
            // this is a transient session, it is pointless to continue
            throw new \SimpleSAML_Error_Exception('Cannot save POST data to a transient session.');
        }
 
        // encrypt the session ID and the random ID
        $info = base64_encode(Crypto::aesEncrypt($session_id.':'.$id));
 
        $url = Module::getModuleURL('core/postredirect.php', array('RedirInfo' => $info));
        return preg_replace('#^https:#', 'http:', $url);
    }

References $data, $destination, $id, $info, $session, $url, SimpleSAML\Utils\Crypto\aesEncrypt(), SimpleSAML\Module\getModuleURL(), SimpleSAML_Session\getSessionFromRequest(), and SimpleSAML\Utils\HTTP\savePOSTData().

Here is the call graph for this function:

getSelfHost()

static SimpleSAML\Utils\HTTP::getSelfHost ( )

static

Retrieve our own host.

E.g. www.example.com

Returns

string The current host.

Author

Jaime Perez, UNINETT AS jaime.nosp@m..per.nosp@m.ez@un.nosp@m.inet.nosp@m.t.no

Definition at line 699 of file HTTP.php.

    {
        $decomposed = explode(':', self::getSelfHostWithNonStandardPort());
        return array_shift($decomposed);
    }

Referenced by SimpleSAML_Metadata_MetaDataStorageHandler\getMetaDataCurrentEntityID(), SimpleSAML\Auth\Simple\getProcessedURL(), and SimpleSAML_Metadata_MetaDataStorageSource\lookupIndexFromEntityId().

Here is the caller graph for this function:

getSelfHostWithPath()

static SimpleSAML\Utils\HTTP::getSelfHostWithPath ( )

static

Retrieve our own host together with the URL path.

Please note this function will return the base URL for the current SP, as defined in the global configuration.

Returns

string The current host (with non-default ports included) plus the URL path.

Author

Andreas Solberg, UNINETT AS andre.nosp@m.as.s.nosp@m.olber.nosp@m.g@un.nosp@m.inett.nosp@m..no

Olav Morken, UNINETT AS olav..nosp@m.mork.nosp@m.en@un.nosp@m.inet.nosp@m.t.no

Definition at line 738 of file HTTP.php.

    {
        $baseurl = explode("/", self::getBaseURL());
        $elements = array_slice($baseurl, 3 - count($baseurl), count($baseurl) - 4);
        $path = implode("/", $elements);
        return self::getSelfHostWithNonStandardPort()."/".$path;
    }

Referenced by SimpleSAML_Metadata_MetaDataStorageHandler\getMetaDataCurrentEntityID().

Here is the caller graph for this function:

getSelfURLNoQuery()

static SimpleSAML\Utils\HTTP::getSelfURLNoQuery ( )

static

Retrieve the current URL using the base URL in the configuration, without the query parameters.

Returns

string The current URL, not including query parameters.

Author

Andreas Solberg, UNINETT AS andre.nosp@m.as.s.nosp@m.olber.nosp@m.g@un.nosp@m.inett.nosp@m..no

Jaime Perez, UNINETT AS jaime.nosp@m..per.nosp@m.ez@un.nosp@m.inet.nosp@m.t.no

Definition at line 846 of file HTTP.php.

    {
        $url = self::getSelfURL();
        $pos = strpos($url, '?');
        if (!$pos) {
            return $url;
        }
        return substr($url, 0, $pos);
    }

Referenced by sspmod_saml_Message\processAssertion(), and sspmod_saml_Message\processResponse().

Here is the caller graph for this function:

getServerHost()

static SimpleSAML\Utils\HTTP::getServerHost ( )

staticprivate

Retrieve Host value from $_SERVER environment variables.

Returns

string The current host name, including the port if needed. It will use localhost when unable to determine the current host.

Author

Olav Morken, UNINETT AS olav..nosp@m.mork.nosp@m.en@un.nosp@m.inet.nosp@m.t.no

Definition at line 54 of file HTTP.php.

    {
        if (array_key_exists('HTTP_HOST', $_SERVER)) {
            $current = $_SERVER['HTTP_HOST'];
        } elseif (array_key_exists('SERVER_NAME', $_SERVER)) {
            $current = $_SERVER['SERVER_NAME'];
        } else {
            // almost certainly not what you want, but...
            $current = 'localhost';
        }
 
        if (strstr($current, ":")) {
            $decomposed = explode(":", $current);
            $port = array_pop($decomposed);
            if (!is_numeric($port)) {
                array_push($decomposed, $port);
            }
            $current = implode($decomposed, ":");
        }
        return $current;
    }

References $_SERVER, and $current.

getServerHTTPS()

static SimpleSAML\Utils\HTTP::getServerHTTPS ( )

static

Retrieve HTTPS status from $_SERVER environment variables.

Returns

boolean True if the request was performed through HTTPS, false otherwise.

Author

Olav Morken, UNINETT AS olav..nosp@m.mork.nosp@m.en@un.nosp@m.inet.nosp@m.t.no

Definition at line 84 of file HTTP.php.

    {
        if (!array_key_exists('HTTPS', $_SERVER)) {
            // not an https-request
            return false;
        }
 
        if ($_SERVER['HTTPS'] === 'off') {
            // IIS with HTTPS off
            return false;
        }
 
        // otherwise, HTTPS will be non-empty
        return !empty($_SERVER['HTTPS']);
    }

References $_SERVER.

Referenced by SimpleSAML\Auth\Simple\getProcessedURL().

Here is the caller graph for this function:

getServerPort()

static SimpleSAML\Utils\HTTP::getServerPort ( )

static

Retrieve the port number from $_SERVER environment variables.

Returns

string The port number prepended by a colon, if it is different than the default port for the protocol (80 for HTTP, 443 for HTTPS), or an empty string otherwise.

Author

Olav Morken, UNINETT AS olav..nosp@m.mork.nosp@m.en@un.nosp@m.inet.nosp@m.t.no

Definition at line 109 of file HTTP.php.

    {
        $port = (isset($_SERVER['SERVER_PORT'])) ? $_SERVER['SERVER_PORT'] : '80';
        if (self::getServerHTTPS()) {
            if ($port !== '443') {
                return ':'.$port;
            }
        } else {
            if ($port !== '80') {
                return ':'.$port;
            }
        }
        return '';
    }

References $_SERVER.

Referenced by SimpleSAML\Auth\Simple\getProcessedURL().

Here is the caller graph for this function:

guessBasePath()

static SimpleSAML\Utils\HTTP::guessBasePath ( )

static

Try to guess the base SimpleSAMLphp path from the current request.

This method offers just a guess, so don't rely on it.

Returns

string The guessed base path that should correspond to the root installation of SimpleSAMLphp.

Definition at line 563 of file HTTP.php.

    {
        if (!array_key_exists('REQUEST_URI', $_SERVER) || !array_key_exists('SCRIPT_FILENAME', $_SERVER)) {
            return '/';
        }
        // get the name of the current script
        $path = explode('/', $_SERVER['SCRIPT_FILENAME']);
        $script = array_pop($path);
 
        // get the portion of the URI up to the script, i.e.: /simplesaml/some/directory/script.php
        if (!preg_match('#^/(?:[^/]+/)*'.$script.'#', $_SERVER['REQUEST_URI'], $matches)) {
            return '/';
        }
        $uri_s = explode('/', $matches[0]);
        $file_s = explode('/', $_SERVER['SCRIPT_FILENAME']);
 
        // compare both arrays from the end, popping elements matching out of them
        while ($uri_s[count($uri_s) - 1] === $file_s[count($file_s) - 1]) {
            array_pop($uri_s);
            array_pop($file_s);
        }
        // we are now left with the minimum part of the URI that does not match anything in the file system, use it
        return join('/', $uri_s).'/';
    }

Referenced by SimpleSAML\Error\CriticalConfigurationError\__construct().

Here is the caller graph for this function:

isHTTPS()

static SimpleSAML\Utils\HTTP::isHTTPS ( )

static

This function checks if we are using HTTPS as protocol.

Returns

boolean True if the HTTPS is used, false otherwise.

Author

Olav Morken, UNINETT AS olav..nosp@m.mork.nosp@m.en@un.nosp@m.inet.nosp@m.t.no

Jaime Perez, UNINETT AS jaime.nosp@m..per.nosp@m.ez@un.nosp@m.inet.nosp@m.t.no

Definition at line 865 of file HTTP.php.

    {
        return strpos(self::getSelfURL(), 'https://') === 0;
    }

normalizeURL()

static SimpleSAML\Utils\HTTP::normalizeURL (   $url )

static

Normalizes a URL to an absolute URL and validate it.

In addition to resolving the URL, this function makes sure that it is a link to an http or https site.

Parameters

string

$url

The relative URL.

Returns

string An absolute URL for the given relative URL.

Exceptions

InvalidArgumentException If $url is not a string or a valid URL.

Author

Olav Morken, UNINETT AS olav..nosp@m.mork.nosp@m.en@un.nosp@m.inet.nosp@m.t.no

Jaime Perez, UNINETT AS jaime.nosp@m..per.nosp@m.ez@un.nosp@m.inet.nosp@m.t.no

Definition at line 883 of file HTTP.php.

    {
        if (!is_string($url)) {
            throw new \InvalidArgumentException('Invalid input parameters.');
        }
 
        $url = self::resolveURL($url, self::getSelfURL());
 
        // verify that the URL is to a http or https site
        if (!preg_match('@^https?://@i', $url)) {
            throw new \InvalidArgumentException('Invalid URL: '.$url);
        }
 
        return $url;
    }

parseQueryString()

static SimpleSAML\Utils\HTTP::parseQueryString (   $query_string )

static

Parse a query string into an array.

This function parses a query string into an array, similar to the way the builtin 'parse_str' works, except it doesn't handle arrays, and it doesn't do "magic quotes".

Query parameters without values will be set to an empty string.

Parameters

string

$query_string

The query string which should be parsed.

Returns

array The query string as an associative array.

Exceptions

InvalidArgumentException If $query_string is not a string.

Author

Olav Morken, UNINETT AS olav..nosp@m.mork.nosp@m.en@un.nosp@m.inet.nosp@m.t.no

Definition at line 915 of file HTTP.php.

    {
        if (!is_string($query_string)) {
            throw new \InvalidArgumentException('Invalid input parameters.');
        }
 
        $res = array();
        if (empty($query_string)) {
            return $res;
        }
 
        foreach (explode('&', $query_string) as $param) {
            $param = explode('=', $param);
            $name = urldecode($param[0]);
            if (count($param) === 1) {
                $value = '';
            } else {
                $value = urldecode($param[1]);
            }
            $res[$name] = $value;
        }
        return $res;
    }

redirect()

static SimpleSAML\Utils\HTTP::redirect (   $url,   $parameters = array()  )

staticprivate

This function redirects the user to the specified address.

This function will use the "HTTP 303 See Other" redirection if the current request used the POST method and the HTTP version is 1.1. Otherwise, a "HTTP 302 Found" redirection will be used.

The function will also generate a simple web page with a clickable link to the target page.

Parameters

string	$url	The URL we should redirect to. This URL may include query parameters. If this URL is a relative URL (starting with '/'), then it will be turned into an absolute URL by prefixing it with the absolute URL to the root of the website.
string[]	$parameters	An array with extra query string parameters which should be appended to the URL. The name of the parameter is the array index. The value of the parameter is the value stored in the index. Both the name and the value will be urlencoded. If the value is NULL, then the parameter will be encoded as just the name, without a value.

Returns

void This function never returns.

Exceptions

InvalidArgumentException If $url is not a string or is empty, or $parameters is not an array.

Author

Olav Morken, UNINETT AS olav..nosp@m.mork.nosp@m.en@un.nosp@m.inet.nosp@m.t.no

Mads Freek Petersen

Jaime Perez, UNINETT AS jaime.nosp@m..per.nosp@m.ez@un.nosp@m.inet.nosp@m.t.no

Definition at line 148 of file HTTP.php.

    {
        if (!is_string($url) || empty($url) || !is_array($parameters)) {
            throw new \InvalidArgumentException('Invalid input parameters.');
        }
        if (!empty($parameters)) {
            $url = self::addURLParameters($url, $parameters);
        }
 
        /* Set the HTTP result code. This is either 303 See Other or
         * 302 Found. HTTP 303 See Other is sent if the HTTP version
         * is HTTP/1.1 and the request type was a POST request.
         */
        if ($_SERVER['SERVER_PROTOCOL'] === 'HTTP/1.1' &&
            $_SERVER['REQUEST_METHOD'] === 'POST'
        ) {
            $code = 303;
        } else {
            $code = 302;
        }
 
        if (strlen($url) > 2048) {
            Logger::warning('Redirecting to a URL longer than 2048 bytes.');
        }
 
        if (!headers_sent()) {
            // set the location header
            header('Location: '.$url, true, $code);
 
            // disable caching of this response
            header('Pragma: no-cache');
            header('Cache-Control: no-cache, no-store, must-revalidate');
        }
 
        // show a minimal web page with a clickable link to the URL
        echo '<?xml version="1.0" encoding="UTF-8"?>'."\n";
        echo '<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"';
        echo ' "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">'."\n";
        echo '<html xmlns="http://www.w3.org/1999/xhtml">'."\n";
        echo "  <head>\n";
        echo '    <meta http-equiv="content-type" content="text/html; charset=utf-8">'."\n";
        echo '    <meta http-equiv="refresh" content="0;URL=\''.htmlspecialchars($url).'\'">'."\n";
        echo "    <title>Redirect</title>\n";
        echo "  </head>\n";
        echo "  <body>\n";
        echo "    <h1>Redirect</h1>\n";
        echo '      <p>You were redirected to: <a id="redirlink" href="'.htmlspecialchars($url).'">';
        echo htmlspecialchars($url)."</a>\n";
        echo '        <script type="text/javascript">document.getElementById("redirlink").focus();</script>'."\n";
        echo "      </p>\n";
        echo "  </body>\n";
        echo '</html>';
 
        // end script execution
        exit;
    }

References $_SERVER, $code, $url, and SimpleSAML\Logger\warning().

Here is the call graph for this function:

redirectTrustedURL()

static SimpleSAML\Utils\HTTP::redirectTrustedURL (   $url,   $parameters = array()  )

static

This function redirects to the specified URL without performing any security checks.

Please, do NOT use this function with user supplied URLs.

This function will use the "HTTP 303 See Other" redirection if the current request used the POST method and the HTTP version is 1.1. Otherwise, a "HTTP 302 Found" redirection will be used.

The function will also generate a simple web page with a clickable link to the target URL.

Parameters

string	$url	The URL we should redirect to. This URL may include query parameters. If this URL is a relative URL (starting with '/'), then it will be turned into an absolute URL by prefixing it with the absolute URL to the root of the website.
string[]	$parameters	An array with extra query string parameters which should be appended to the URL. The name of the parameter is the array index. The value of the parameter is the value stored in the index. Both the name and the value will be urlencoded. If the value is NULL, then the parameter will be encoded as just the name, without a value.

Returns

void This function never returns.

Exceptions

InvalidArgumentException If $url is not a string or $parameters is not an array.

Author

Jaime Perez, UNINETT AS jaime.nosp@m..per.nosp@m.ez@un.nosp@m.inet.nosp@m.t.no

Definition at line 962 of file HTTP.php.

    {
        if (!is_string($url) || !is_array($parameters)) {
            throw new \InvalidArgumentException('Invalid input parameters.');
        }
 
        $url = self::normalizeURL($url);
        self::redirect($url, $parameters);
    }

Referenced by sspmod_saml_Auth_Source_SP\askForIdPChange(), sspmod_authfacebook_Auth_Source_Facebook\authenticate(), sspmod_authwindowslive_Auth_Source_LiveID\authenticate(), sspmod_authYubiKey_Auth_Source_YubiKey\authenticate(), sspmod_cas_Auth_Source_CAS\authenticate(), sspmod_core_Auth_UserPassBase\authenticate(), sspmod_core_Auth_UserPassOrgBase\authenticate(), sspmod_exampleauth_Auth_Source_External\authenticate(), sspmod_multiauth_Auth_Source_MultiAuth\authenticate(), SimpleSAML_IdP\finishLogoutRedirect(), sspmod_oauth_Consumer\getAuthorizeRequest(), SimpleSAML_XHTML_IdPDisco\handleRequest(), SimpleSAML_Auth_Default\initLogout(), SimpleSAML_Auth_Source\loginCompleted(), sspmod_cas_Auth_Source_CAS\logout(), SimpleSAML_Auth_Default\logoutCompleted(), SimpleSAML\Auth\Simple\logoutCompleted(), SimpleSAML\IdP\TraditionalLogoutHandler\logoutNextSP(), sspmod_consent_Logout\postLogout(), sspmod_authX509_Auth_Process_ExpiryWarning\process(), sspmod_consent_Auth_Process_Consent\process(), sspmod_core_Auth_Process_WarnShortSSOInterval\process(), sspmod_exampleauth_Auth_Process_RedirectTest\process(), sspmod_expirycheck_Auth_Process_ExpiryDate\process(), sspmod_preprodwarning_Auth_Process_Warning\process(), SimpleSAML_Utilities\redirectTrustedURL(), SimpleSAML_Auth_ProcessingChain\resumeProcessing(), sspmod_cdc_Server\send(), sspmod_adfs_IdP_ADFS\sendLogoutResponse(), SimpleSAML_XHTML_IdPDisco\start(), sspmod_saml_Auth_Source_SP\startDisco(), SimpleSAML\IdP\IFrameLogoutHandler\startLogout(), sspmod_saml_Auth_Source_SP\startSSO1(), SimpleSAML_Auth_State\throwException(), sspmod_authorize_Auth_Process_Authorize\unauthorized(), and sspmod_saml_Auth_Process_ExpectedAuthnContextClassRef\unauthorized().

Here is the caller graph for this function:

redirectUntrustedURL()

static SimpleSAML\Utils\HTTP::redirectUntrustedURL (   $url,   $parameters = array()  )

static

This function redirects to the specified URL after performing the appropriate security checks on it.

Particularly, it will make sure that the provided URL is allowed by the 'redirect.trustedsites' directive in the configuration.

If the aforementioned option is not set or the URL does correspond to a trusted site, it performs a redirection to it. If the site is not trusted, an exception will be thrown.

Parameters

string	$url	The URL we should redirect to. This URL may include query parameters. If this URL is a relative URL (starting with '/'), then it will be turned into an absolute URL by prefixing it with the absolute URL to the root of the website.
string[]	$parameters	An array with extra query string parameters which should be appended to the URL. The name of the parameter is the array index. The value of the parameter is the value stored in the index. Both the name and the value will be urlencoded. If the value is NULL, then the parameter will be encoded as just the name, without a value.

Returns

void This function never returns.

Exceptions

InvalidArgumentException If $url is not a string or $parameters is not an array.

Author

Jaime Perez, UNINETT AS jaime.nosp@m..per.nosp@m.ez@un.nosp@m.inet.nosp@m.t.no

Definition at line 994 of file HTTP.php.

    {
        if (!is_string($url) || !is_array($parameters)) {
            throw new \InvalidArgumentException('Invalid input parameters.');
        }
 
        $url = self::checkURLAllowed($url);
        self::redirect($url, $parameters);
    }

Referenced by sspmod_saml_Auth_Source_SP\handleUnsolicitedAuth(), SimpleSAML_Auth_State\loadState(), and SimpleSAML_Utilities\redirectUntrustedURL().

Here is the caller graph for this function:

resolveURL()

static SimpleSAML\Utils\HTTP::resolveURL (   $url,   $base = null  )

static

Resolve a (possibly relative) URL relative to a given base URL.

This function supports these forms of relative URLs:

• ^\w+: Absolute URL. E.g. "http://www.example.com:port/path?query#fragment".
• ^// Same protocol. E.g. "//www.example.com:port/path?query#fragment"
• ^/ Same protocol and host. E.g. "/path?query#fragment".
• ^? Same protocol, host and path, replace query string & fragment. E.g. "?query#fragment".
• ^# Same protocol, host, path and query, replace fragment. E.g. "#fragment".
• The rest: Relative to the base path.

Parameters

string	$url	The relative URL.
string	$base	The base URL. Defaults to the base URL of this installation of SimpleSAMLphp.

Returns

string An absolute URL for the given relative URL.

Exceptions

InvalidArgumentException If the base URL cannot be parsed into a valid URL, or the given parameters are not strings.

Author

Olav Morken, UNINETT AS olav..nosp@m.mork.nosp@m.en@un.nosp@m.inet.nosp@m.t.no

Jaime Perez, UNINETT AS jaime.nosp@m..per.nosp@m.ez@un.nosp@m.inet.nosp@m.t.no

Definition at line 1026 of file HTTP.php.

    {
        if ($base === null) {
            $base = self::getBaseURL();
        }
 
        if (!is_string($url) || !is_string($base)) {
            throw new \InvalidArgumentException('Invalid input parameters.');
        }
 
        if (!preg_match('/^((((\w+:)\/\/[^\/]+)(\/[^?#]*))(?:\?[^#]*)?)(?:#.*)?/', $base, $baseParsed)) {
            throw new \InvalidArgumentException('Unable to parse base url: '.$base);
        }
 
        $baseDir = dirname($baseParsed[5].'filename');
        $baseScheme = $baseParsed[4];
        $baseHost = $baseParsed[3];
        $basePath = $baseParsed[2];
        $baseQuery = $baseParsed[1];
 
        if (preg_match('$^\w+:$', $url)) {
            return $url;
        }
 
        if (substr($url, 0, 2) === '//') {
            return $baseScheme.$url;
        }
 
        if ($url[0] === '/') {
            return $baseHost.$url;
        }
        if ($url[0] === '?') {
            return $basePath.$url;
        }
        if ($url[0] === '#') {
            return $baseQuery.$url;
        }
 
        // we have a relative path. Remove query string/fragment and save it as $tail
        $queryPos = strpos($url, '?');
        $fragmentPos = strpos($url, '#');
        if ($queryPos !== false || $fragmentPos !== false) {
            if ($queryPos === false) {
                $tailPos = $fragmentPos;
            } elseif ($fragmentPos === false) {
                $tailPos = $queryPos;
            } elseif ($queryPos < $fragmentPos) {
                $tailPos = $queryPos;
            } else {
                $tailPos = $fragmentPos;
            }
 
            $tail = substr($url, $tailPos);
            $dir = substr($url, 0, $tailPos);
        } else {
            $dir = $url;
            $tail = '';
        }
 
        $dir = System::resolvePath($dir, $baseDir);
 
        return $baseHost.$dir.$tail;
    }

Referenced by showEntry().

Here is the caller graph for this function:

savePOSTData()

static SimpleSAML\Utils\HTTP::savePOSTData ( \SimpleSAML_Session  $session,   $destination,   $data  )

staticprivate

Save the given HTTP POST data and the destination where it should be posted to a given session.

Parameters

\SimpleSAML_Session	$session	The session where to temporarily store the data.
string	$destination	The destination URL where the form should be posted.
array	$data	An associative array with the data to be posted to $destination.

Returns

string A random identifier that can be used to retrieve the data from the current session.

Author

Andjelko Horvat

Jaime Perez, UNINETT AS jaime.nosp@m..per.nosp@m.ez@un.nosp@m.inet.nosp@m.t.no

Definition at line 218 of file HTTP.php.

    {
        // generate a random ID to avoid replay attacks
        $id = Random::generateID();
        $postData = array(
            'post' => $data,
            'url'  => $destination,
        );
 
        // save the post data to the session, tied to the random ID
        $session->setData('core_postdatalink', $id, $postData);
 
        return $id;
    }

Referenced by SimpleSAML\Utils\HTTP\getSecurePOSTRedirectURL().

Here is the caller graph for this function:

setCookie()

static SimpleSAML\Utils\HTTP::setCookie (   $name,   $value,   $params = null,   $throw = true  )

static

Set a cookie.

Parameters

string	$name	The name of the cookie.
string | NULL	$value	The value of the cookie. Set to NULL to delete the cookie.
array | NULL	$params	Cookie parameters.
bool	$throw	Whether to throw exception if setcookie() fails.

Exceptions

InvalidArgumentException If any parameter has an incorrect type.

Exceptions

SimpleSAML\Error\CannotSetCookie If the headers were already sent and the cookie cannot be set.

Returns

void

Author

Andjelko Horvat

Jaime Perez, UNINETT AS jaime.nosp@m..per.nosp@m.ez@un.nosp@m.inet.nosp@m.t.no

Definition at line 1107 of file HTTP.php.

    {
        if (!(is_string($name) && // $name must be a string
            (is_string($value) || is_null($value)) && // $value can be a string or null
            (is_array($params) || is_null($params)) && // $params can be an array or null
            is_bool($throw)) // $throw must be boolean
        ) {
            throw new \InvalidArgumentException('Invalid input parameters.');
        }
 
        $default_params = array(
            'lifetime' => 0,
            'expire'   => null,
            'path'     => '/',
            'domain'   => null,
            'secure'   => false,
            'httponly' => true,
            'raw'      => false,
        );
 
        if ($params !== null) {
            $params = array_merge($default_params, $params);
        } else {
            $params = $default_params;
        }
 
        // Do not set secure cookie if not on HTTPS
        if ($params['secure'] && !self::isHTTPS()) {
            if ($throw) {
                throw new \SimpleSAML\Error\CannotSetCookie(
                    'Setting secure cookie on plain HTTP is not allowed.',
                    \SimpleSAML\Error\CannotSetCookie::SECURE_COOKIE
                );
            }
            Logger::warning('Error setting cookie: setting secure cookie on plain HTTP is not allowed.');
            return;
        }
 
        if ($value === null) {
            $expire = time() - 365 * 24 * 60 * 60;
        } elseif (isset($params['expire'])) {
            $expire = $params['expire'];
        } elseif ($params['lifetime'] === 0) {
            $expire = 0;
        } else {
            $expire = time() + $params['lifetime'];
        }
 
        if ($params['raw']) {
            $success = @setrawcookie(
                $name,
                $value,
                $expire,
                $params['path'],
                $params['domain'],
                $params['secure'],
                $params['httponly']
            );
        } else {
            $success = @setcookie(
                $name,
                $value,
                $expire,
                $params['path'],
                $params['domain'],
                $params['secure'],
                $params['httponly']
            );
        }
 
        if (!$success) {
            if ($throw) {
                throw new \SimpleSAML\Error\CannotSetCookie(
                    'Headers already sent.',
                    \SimpleSAML\Error\CannotSetCookie::HEADERS_SENT
                );
            }
            Logger::warning('Error setting cookie: headers already sent.');
        }
    }

Referenced by sspmod_consent_Consent_Store_Cookie\_setConsentCookie(), SimpleSAML_Session\doLogin(), SimpleSAML_AuthMemCookie\doLogout(), sspmod_cdc_Server\handleDelete(), sspmod_cdc_Server\setCDC(), SimpleSAML_XHTML_IdPDisco\setCookie(), SimpleSAML_Utilities\setCookie(), SimpleSAML\Locale\Language\setLanguageCookie(), sspmod_discopower_PowerIdPDisco\setPreviousIdP(), sspmod_multiauth_Auth_Source_MultiAuth\setPreviousSource(), and SimpleSAML_Session\updateSessionCookies().

Here is the caller graph for this function:

submitPOSTData()

static SimpleSAML\Utils\HTTP::submitPOSTData (   $destination,   $data  )

static

Submit a POST form to a specific destination.

This function never returns.

Parameters

string	$destination	The destination URL.
array	$data	An associative array with the data to be posted to $destination.

Exceptions

InvalidArgumentException If $destination is not a string or $data is not an array.

Returns

void

Author

Olav Morken, UNINETT AS olav..nosp@m.mork.nosp@m.en@un.nosp@m.inet.nosp@m.t.no

Andjelko Horvat

Jaime Perez, UNINETT AS jaime.nosp@m..per.nosp@m.ez@un.nosp@m.inet.nosp@m.t.no

Definition at line 1205 of file HTTP.php.

    {
        if (!is_string($destination) || !is_array($data)) {
            throw new \InvalidArgumentException('Invalid input parameters.');
        }
 
        $config = \SimpleSAML_Configuration::getInstance();
        $allowed = $config->getBoolean('enable.http_post', false);
 
        if ($allowed && preg_match("#^http:#", $destination) && self::isHTTPS()) {
            // we need to post the data to HTTP
            self::redirect(self::getSecurePOSTRedirectURL($destination, $data));
        }
 
        $p = new \SimpleSAML_XHTML_Template($config, 'post.php');
        $p->data['destination'] = $destination;
        $p->data['post'] = $data;
        $p->show();
        exit(0);
    }

Referenced by SimpleSAML_Utilities\postRedirect(), sspmod_cdc_Server\send(), and SimpleSAML\Bindings\Shib13\HTTPPost\sendResponse().

Here is the caller graph for this function:

---

The documentation for this class was generated from the following file:

• libs/composer/vendor/simplesamlphp/simplesamlphp/lib/SimpleSAML/Utils/HTTP.php