From c476a566614f767b9fdec69672ce0b799a860d63 Mon Sep 17 00:00:00 2001 From: Alexander Skoblikov Date: Mon, 14 Jul 2025 20:06:52 +0300 Subject: [PATCH] dbeaver/pro#5816 link websession with address (#3564) * dbeaver/pro#5816 link websession with address * dbeaver/pro#5816 flag to disable ip binging --------- Co-authored-by: kseniaguzeeva <112612526+kseniaguzeeva@users.noreply.github.com> --- config/core/cloudbeaver.conf | 2 +- .../io/cloudbeaver/model/session/WebSession.java | 13 +++++++++---- .../cloudbeaver/model/config/CBServerConfig.java | 5 +++++ .../service/session/CBSessionManager.java | 16 +++++++++++++++- 4 files changed, 30 insertions(+), 6 deletions(-) diff --git a/config/core/cloudbeaver.conf b/config/core/cloudbeaver.conf index dcb0bb5f95..131895f48c 100644 --- a/config/core/cloudbeaver.conf +++ b/config/core/cloudbeaver.conf @@ -26,7 +26,7 @@ }, expireSessionAfterPeriod: "${CLOUDBEAVER_EXPIRE_SESSION_AFTER_PERIOD:1800000}", - + bindSessionToIp: "${CLOUDBEAVER_BIND_SESSION_TO_IP:true}", develMode: "${CLOUDBEAVER_DEVEL_MODE:false}", enableSecurityManager: false, diff --git a/server/bundles/io.cloudbeaver.model/src/io/cloudbeaver/model/session/WebSession.java b/server/bundles/io.cloudbeaver.model/src/io/cloudbeaver/model/session/WebSession.java index 0a3a8a4a27..0b97cadd10 100644 --- a/server/bundles/io.cloudbeaver.model/src/io/cloudbeaver/model/session/WebSession.java +++ b/server/bundles/io.cloudbeaver.model/src/io/cloudbeaver/model/session/WebSession.java @@ -90,7 +90,7 @@ public class WebSession extends BaseWebSession public static String RUNTIME_PARAM_AUTH_INFOS = "auth-infos"; private final AtomicInteger taskCount = new AtomicInteger(); - private String lastRemoteAddr; + private final String lastRemoteAddr; private String lastRemoteUserAgent; private String locale; @@ -118,7 +118,8 @@ public class WebSession extends BaseWebSession this(requestInfo.getId(), CommonUtils.toString(requestInfo.getLocale()), application, - sessionHandlers + sessionHandlers, + requestInfo.getLastRemoteAddress() ); updateSessionParameters(requestInfo); } @@ -127,9 +128,14 @@ public class WebSession extends BaseWebSession @NotNull String id, @Nullable String locale, @NotNull ServletApplication application, - @NotNull Map sessionHandlers + @NotNull Map sessionHandlers, + @NotNull String remoteAddr ) throws DBException { super(id, application); + if (CommonUtils.isEmpty(remoteAddr)) { + throw new DBException("Remote address cannot be empty"); + } + this.lastRemoteAddr = remoteAddr; this.lastAccessTime = this.createTime; this.sessionHandlers = sessionHandlers; setLocale(CommonUtils.toString(locale, this.locale)); @@ -458,7 +464,6 @@ public class WebSession extends BaseWebSession } public synchronized void updateSessionParameters(WebHttpRequestInfo requestInfo) { - this.lastRemoteAddr = requestInfo.getLastRemoteAddress(); this.lastRemoteUserAgent = requestInfo.getLastRemoteUserAgent(); this.cacheExpired = false; } diff --git a/server/bundles/io.cloudbeaver.server.ce/src/io/cloudbeaver/model/config/CBServerConfig.java b/server/bundles/io.cloudbeaver.server.ce/src/io/cloudbeaver/model/config/CBServerConfig.java index c3b9bc5a4c..aa3fca3a2f 100644 --- a/server/bundles/io.cloudbeaver.server.ce/src/io/cloudbeaver/model/config/CBServerConfig.java +++ b/server/bundles/io.cloudbeaver.server.ce/src/io/cloudbeaver/model/config/CBServerConfig.java @@ -52,6 +52,7 @@ public class CBServerConfig implements WebServerConfiguration { @SerializedName("database") private WebDatabaseConfig databaseConfiguration = new WebDatabaseConfig(); private String staticContent = ""; + private boolean bindSessionToIp = true; public CBServerConfig() { this.securityManagerConfiguration = createSecurityManagerConfiguration(); @@ -186,4 +187,8 @@ public class CBServerConfig implements WebServerConfiguration { public boolean isSecureCookies() { return secureCookies; } + + public boolean isBindSessionToIp() { + return bindSessionToIp; + } } diff --git a/server/bundles/io.cloudbeaver.server.ce/src/io/cloudbeaver/service/session/CBSessionManager.java b/server/bundles/io.cloudbeaver.server.ce/src/io/cloudbeaver/service/session/CBSessionManager.java index 4506d548ce..a8ca5b9944 100644 --- a/server/bundles/io.cloudbeaver.server.ce/src/io/cloudbeaver/service/session/CBSessionManager.java +++ b/server/bundles/io.cloudbeaver.server.ce/src/io/cloudbeaver/service/session/CBSessionManager.java @@ -1,6 +1,6 @@ /* * DBeaver - Universal Database Manager - * Copyright (C) 2010-2024 DBeaver Corp and others + * Copyright (C) 2010-2025 DBeaver Corp and others * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -156,6 +156,20 @@ public class CBSessionManager implements WebAppSessionManager { } } + String currentRemote = request.getRemoteAddr(); + if (application.getServerConfiguration().isBindSessionToIp() + && (CommonUtils.isEmpty(currentRemote) || !currentRemote.equals(webSession.getLastRemoteAddr())) + ) { + var error = new DBWebException( + "Session remote address mismatch. Expected: " + webSession.getLastRemoteAddr() + + ", actual: " + currentRemote, + DBWebException.ERROR_CODE_ACCESS_DENIED + ); + log.error(error); + webSession.addSessionError(error); + closeSession(webSession.getSessionId()); + } + return webSession; }