Skip to content

Commit f8e12dd

Browse files
frwiqueueitfrwiqueueit
committed
KnownUser 3.5.1 initial commit
1 parent 25bd4bc commit f8e12dd

20 files changed

Lines changed: 4568 additions & 1 deletion

‎Documentation/ConfigProviderExample.png‎

9.42 KB
Loading

‎Documentation/KnownUserFlow.png‎

29.5 KB
Loading

‎Documentation/README.md‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
# Integration Configuration downloader
2+
This folder contains some extra info on how to implement the Integration Configuration downloader.
3+
4+
5+
## Downloading the Integration Configuration
6+
The KnownUser library needs the Triggers and Actions to know which pages to protect and which queues to use.
7+
These Triggers and Actions are specified in the Go Queue-it self-service portal.
8+
9+
It is recommended to make a timer function that can download and cache the configuration for e.g. 5-10 minutes.
10+
You can find your configuration file here https://[your-customer-id].queue-it.net/status/integrationconfig/[your-customer-id] after a succesful publish.
11+
Please contact Queue-it support through the Go Queue-it self-service portal to get further help on this.
12+
13+
![Configuration Provider flow](https://github.com/queueit/KnownUser.V3.Python/blob/master/Documentation/ConfigProviderExample.png)
14+
15+
16+
17+

‎README.md‎

Lines changed: 281 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,283 @@
1+
>You can find the latest released version [here](https://github.com/queueit/KnownUser.V3.Python/releases/latest)
2+
13
# KnownUser.V3.Python
4+
The Queue-it Security Framework is used to ensure that end users cannot bypass the queue by adding a server-side integration to your server.
5+
It supports Python >= 2.7.
6+
7+
## Introduction
8+
When a user is redirected back from the queue to your website, the queue engine can attache a query string parameter (`queueittoken`) containing some information about the user.
9+
The most important fields of the `queueittoken` are:
10+
11+
- q - the users unique queue identifier
12+
- ts - a timestamp of how long this redirect is valid
13+
- h - a hash of the token
14+
15+
16+
The high level logic is as follows:
17+
18+
![The KnownUser validation flow](https://github.com/queueit/KnownUser.V3.Python/blob/master/Documentation/KnownUserFlow.png)
19+
20+
1. User requests a page on your server
21+
2. The validation method sees that the has no Queue-it session cookie and no `queueittoken` and sends him to the correct queue based on the configuration
22+
3. User waits in the queue
23+
4. User is redirected back to your website, now with a `queueittoken`
24+
5. The validation method validates the `queueittoken` and creates a Queue-it session cookie
25+
6. The user browses to a new page and the Queue-it session cookie will let him go there without queuing again
26+
27+
## How to validate a user
28+
To validate that the current user is allowed to enter your website (has been through the queue) these steps are needed:
29+
30+
1. Providing the queue configuration to the KnownUser validation
31+
2. Validate the `queueittoken` and store a session cookie
32+
33+
34+
### 1. Providing the queue configuration
35+
The recommended way is to use the Go Queue-it self-service portal to setup the configuration.
36+
The configuration specifies a set of Triggers and Actions. A Trigger is an expression matching one, more or all URLs on your website.
37+
When a user enter your website and the URL matches a Trigger-expression the corresponding Action will be triggered.
38+
The Action specifies which queue the users should be send to.
39+
In this way you can specify which queue(s) should protect which page(s) on the fly without changing the server-side integration.
40+
41+
This configuration can then be downloaded to your application server.
42+
Read more about how *[here](https://github.com/queueit/KnownUser.V3.Python/tree/master/Documentation)*.
43+
The configuration should be downloaded and cached for 5-10 minutes.
44+
45+
### 2. Validate the `queueittoken` and store a session cookie
46+
To validate that the user has been through the queue, use the `KnownUser.validateRequestByIntegrationConfig()` method.
47+
This call will validate the timestamp and hash and if valid create a "QueueITAccepted-SDFrts345E-V3_[EventId]" cookie with a TTL as specified in the configuration.
48+
If the timestamp or hash is invalid, the user is send back to the queue.
49+
50+
51+
## Implementation
52+
The KnownUser validation must be done on *all requests except requests for static resources like images, css files and ...*.
53+
So, if you add the KnownUser validation logic to a central place, then be sure that the Triggers only fire on page requests (including ajax requests) and not on e.g. image.
54+
55+
If we have the `integrationconfig.json` copied in the folder beside other knownuser files inside web application folder then
56+
the following method is all that is needed to validate that a user has been through the queue:
57+
58+
Example using Django v.1.8
59+
```python
60+
from django.http import HttpResponse
61+
62+
import django
63+
import sys
64+
import re
65+
66+
from queueit_knownuserv3.http_context_providers import Django_1_8_Provider
67+
from queueit_knownuserv3.models import QueueEventConfig
68+
from queueit_knownuserv3.known_user import KnownUser
69+
70+
71+
def index(request):
72+
try:
73+
with open('integrationconfiguration.json', 'r') as myfile:
74+
integrationsConfigString = myfile.read()
75+
76+
customerId = "" # Your Queue-it customer ID
77+
secretKey = "" # Your 72 char secret key as specified in Go Queue-it self-service platform
78+
79+
response = HttpResponse()
80+
httpContextProvider = Django_1_8_Provider(request, response)
81+
requestUrl = httpContextProvider.getOriginalRequestUrl()
82+
requestUrlWithoutToken = re.sub(
83+
"([\\?&])(" + KnownUser.QUEUEIT_TOKEN_KEY + "=[^&]*)",
84+
'',
85+
requestUrl,
86+
flags=re.IGNORECASE)
87+
# The requestUrlWithoutToken is used to match Triggers and as the Target url (where to return the users to).
88+
# It is therefor important that this is exactly the url of the users browsers. So, if your webserver is
89+
# behind e.g. a load balancer that modifies the host name or port, reformat requestUrlWithoutToken before proceeding.
90+
91+
queueitToken = request.GET.get(KnownUser.QUEUEIT_TOKEN_KEY)
92+
93+
validationResult = KnownUser.validateRequestByIntegrationConfig(
94+
requestUrlWithoutToken, queueitToken, integrationsConfigString,
95+
customerId, secretKey, httpContextProvider)
96+
97+
if (validationResult.doRedirect()):
98+
response["Expires"] = "Fri, 01 Jan 1990 00:00:00 GMT"
99+
response[
100+
"Cache-Control"] = "no-store, no-cache, must-revalidate, max-age=0"
101+
response["Pragma"] = "no-cache"
102+
response.status_code = 302
103+
response["Location"] = validationResult.redirectUrl
104+
105+
else:
106+
# Request can continue, we remove queueittoken from url to avoid sharing of user specific token
107+
if (requestUrl != requestUrlWithoutToken
108+
and not(validationResult.actionType == None)):
109+
response.status_code = 302
110+
response["Location"] = requestUrlWithoutToken
111+
112+
return response
113+
114+
except StandardError as stdErr:
115+
# Log the Error
116+
print stdErr.message
117+
raise
118+
```
119+
120+
## Alternative Implementation
121+
122+
### Queue configuration
123+
124+
If your application server (maybe due to security reasons) is not allowed to do external GET requests, then you have three options:
125+
126+
1. Manually download the configuration file from Queue-it Go self-service portal, save it on your application server and load it from local disk
127+
2. Use an internal gateway server to download the configuration file and save to application server
128+
3. Specify the configuration in code without using the Trigger/Action paradigm. In this case it is important *only to queue-up page requests* and not requests for resources or AJAX calls.
129+
This can be done by adding custom filtering logic before caling the `KnownUser.resolveRequestByLocalEventConfig()` method.
130+
131+
The following is an example of how to specify the configuration in code:
132+
133+
Example using Django v.1.8
134+
```python
135+
from django.http import HttpResponse
136+
137+
import django
138+
import sys
139+
import re
140+
141+
from queueit_knownuserv3.http_context_providers import Django_1_8_Provider
142+
from queueit_knownuserv3.models import QueueEventConfig
143+
from queueit_knownuserv3.known_user import KnownUser
144+
145+
146+
def index(request):
147+
try:
148+
149+
customerId = "" # Your Queue-it customer ID
150+
secretKey = "" # Your 72 char secret key as specified in Go Queue-it self-service platform
151+
152+
eventConfig = QueueEventConfig()
153+
eventConfig.eventId = "" # ID of the queue to use
154+
eventConfig.queueDomain = "xxx.queue-it.net" #Domian name of the queue - usually in the format [CustomerId].queue-it.net
155+
# eventConfig.cookieDomain = ".my-shop.com" #Optional - Domain name where the Queue-it session cookie should be saved
156+
eventConfig.cookieValidityMinute = 15 #Optional - Validity of the Queue-it session cookie. Default is 10 minutes
157+
eventConfig.extendCookieValidity = true #Optional - Should the Queue-it session cookie validity time be extended each time the validation runs? Default is true.
158+
# eventConfig.culture = "da-DK" #Optional - Culture of the queue ticket layout in the format specified here: https://msdn.microsoft.com/en-us/library/ee825488(v=cs.20).aspx Default is to use what is specified on Event
159+
# eventConfig.layoutName = "NameOfYourCustomLayout" #Optional - Name of the queue ticket layout - e.g. "Default layout by Queue-it". Default is to take what is specified on the Event
160+
161+
response = HttpResponse()
162+
httpContextProvider = Django_1_8_Provider(request, response)
163+
requestUrl = httpContextProvider.getOriginalRequestUrl()
164+
requestUrlWithoutToken = re.sub(
165+
"([\\?&])(" + KnownUser.QUEUEIT_TOKEN_KEY + "=[^&]*)",
166+
'',
167+
requestUrl,
168+
flags=re.IGNORECASE)
169+
# The requestUrlWithoutToken is used to match Triggers and as the Target url (where to return the users to).
170+
# It is therefor important that this is exactly the url of the users browsers. So, if your webserver is
171+
# behind e.g. a load balancer that modifies the host name or port, reformat requestUrlWithoutToken before proceeding.
172+
173+
queueitToken = request.GET.get(KnownUser.QUEUEIT_TOKEN_KEY)
174+
175+
validationResult = KnownUser.resolveQueueRequestByLocalConfig(
176+
requestUrlWithoutToken, queueitToken, queueConfig, customerId, secretKey,
177+
httpContextProvider)
178+
179+
if (validationResult.doRedirect()):
180+
response["Expires"] = "Fri, 01 Jan 1990 00:00:00 GMT"
181+
response[
182+
"Cache-Control"] = "no-store, no-cache, must-revalidate, max-age=0"
183+
response["Pragma"] = "no-cache"
184+
response.status_code = 302
185+
response["Location"] = validationResult.redirectUrl
186+
187+
else:
188+
# Request can continue, we remove queueittoken from url to avoid sharing of user specific token
189+
if (requestUrl != requestUrlWithoutToken
190+
and not(validationResult.actionType == None)):
191+
response.status_code = 302
192+
response["Location"] = requestUrlWithoutToken
193+
194+
return response
195+
196+
except StandardError as stdErr:
197+
# Log the Error
198+
print stdErr.message
199+
raise
200+
```
201+
### Protecting ajax calls on static pages
202+
If you have some static html pages (might be behind cache servers) and you have some ajax calls from those pages needed to be protected by KnownUser library you need to follow these steps:
203+
1) You are using v.3.5.1 (or later) of the KnownUser library.
204+
2) Make sure KnownUser code will not run on static pages (by ignoring those URLs in your integration configuration).
205+
3) Add below JavaScript tags to static pages :
206+
```
207+
<script type="text/javascript" src="//static.queue-it.net/script/queueclient.min.js"></script>
208+
<script
209+
data-queueit-intercept-domain="{YOUR_CURRENT_DOMAIN}"
210+
data-queueit-intercept="true"
211+
data-queueit-c="{YOUR_CUSTOMER_ID}"
212+
type="text/javascript"
213+
src="//static.queue-it.net/script/queueconfigloader.min.js">
214+
</script>
215+
```
216+
4) Use the following method to protect all dynamic calls (including dynamic pages and ajax calls).
217+
218+
Example using Django v.1.8
219+
```python
220+
from django.http import HttpResponse
221+
222+
import django
223+
import sys
224+
import re
225+
226+
from queueit_knownuserv3.http_context_providers import Django_1_8_Provider
227+
from queueit_knownuserv3.models import QueueEventConfig
228+
from queueit_knownuserv3.known_user import KnownUser
229+
230+
231+
def index(request):
232+
try:
233+
with open('integrationconfiguration.json', 'r') as myfile:
234+
integrationsConfigString = myfile.read()
235+
236+
customerId = "queueitknownusertst"
237+
secretKey = "954656b7-bcfa-4de5-9c82-ff3805edd953737070fd-2f5d-4a11-b5ac-5c23e1b097b1"
238+
239+
response = HttpResponse()
240+
httpContextProvider = Django_1_8_Provider(request, response)
241+
requestUrl = httpContextProvider.getOriginalRequestUrl()
242+
requestUrlWithoutToken = re.sub(
243+
"([\\?&])(" + KnownUser.QUEUEIT_TOKEN_KEY + "=[^&]*)",
244+
'',
245+
requestUrl,
246+
flags=re.IGNORECASE)
247+
# The requestUrlWithoutToken is used to match Triggers and as the Target url (where to return the users to).
248+
# It is therefor important that this is exactly the url of the users browsers. So, if your webserver is
249+
# behind e.g. a load balancer that modifies the host name or port, reformat requestUrlWithoutToken before proceeding.
250+
251+
queueitToken = request.GET.get(KnownUser.QUEUEIT_TOKEN_KEY)
252+
253+
validationResult = KnownUser.validateRequestByIntegrationConfig(
254+
requestUrlWithoutToken, queueitToken, integrationsConfigString,
255+
customerId, secretKey, httpContextProvider)
256+
257+
if (validationResult.doRedirect()):
258+
response["Expires"] = "Fri, 01 Jan 1990 00:00:00 GMT"
259+
response[
260+
"Cache-Control"] = "no-store, no-cache, must-revalidate, max-age=0"
261+
response["Pragma"] = "no-cache"
262+
263+
if (not validationResult.isAjaxResult):
264+
response.status_code = 302
265+
response["Location"] = validationResult.redirectUrl
266+
else:
267+
headerKey = validationResult.getAjaxQueueRedirectHeaderKey()
268+
response[headerKey] = validationResult.getAjaxRedirectUrl()
269+
else:
270+
# Request can continue, we remove queueittoken from url to avoid sharing of user specific token
271+
if (requestUrl != requestUrlWithoutToken
272+
and not(validationResult.actionType == None)):
273+
print "redirecting to: " + requestUrlWithoutToken
274+
response.status_code = 302
275+
response["Location"] = requestUrlWithoutToken
276+
277+
return response
2278

3-
TBA. Please reach out to us if you need to integrate your Python based website with Queue-it.
279+
except StandardError as stdErr:
280+
# Log the Error
281+
print stdErr.message
282+
raise
283+
```

‎SDK/.gitignore‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
################################################################################
2+
# This .gitignore file was automatically created by Microsoft(R) Visual Studio.
3+
################################################################################
4+
5+
*.pyc
6+
/.vs

‎SDK/_run_all_tests.py‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
import unittest
2+
3+
suite = unittest.TestLoader().discover("")
4+
unittest.TextTestRunner(verbosity=1).run(suite)

‎SDK/queueit_knownuserv3/__init__.py‎

Whitespace-only changes.

‎SDK/queueit_knownuserv3/http_context_providers.py‎

Lines changed: 68 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,68 @@
1+
from queueit_helpers import QueueitHelpers
2+
3+
4+
class HttpContextProvider:
5+
ERROR_MSG = "Please implement/use specific provider"
6+
7+
def getProviderName(self):
8+
raise NotImplementedError(self.ERROR_MSG)
9+
10+
def setCookie(self, name, value, expire, domain):
11+
raise NotImplementedError(self.ERROR_MSG)
12+
13+
def getCookie(self, name):
14+
raise NotImplementedError(self.ERROR_MSG)
15+
16+
def getHeader(self, name):
17+
raise NotImplementedError(self.ERROR_MSG)
18+
19+
def getRequestIp(self, name):
20+
raise NotImplementedError(self.ERROR_MSG)
21+
22+
def getOriginalRequestUrl(self):
23+
raise NotImplementedError(self.ERROR_MSG)
24+
25+
26+
class Django_1_8_Provider(HttpContextProvider):
27+
def __init__(self, request, response):
28+
self.request = request
29+
self.response = response
30+
31+
def getProviderName(self):
32+
return "django_1_8"
33+
34+
def setCookie(self, name, value, expire, domain):
35+
if (str(domain) == ""):
36+
domain = None
37+
38+
if (value is not None):
39+
value = QueueitHelpers.urlEncode(value)
40+
41+
self.response.set_cookie(
42+
name,
43+
value,
44+
max_age=None,
45+
expires=expire,
46+
path='/',
47+
domain=domain,
48+
secure=None,
49+
httponly=False)
50+
51+
def getCookie(self, name):
52+
value = self.request.COOKIES.get(name)
53+
if (value is not None):
54+
value = QueueitHelpers.urlDecode(value)
55+
return value
56+
57+
def getHeader(self, name):
58+
if (name is None or name == ""):
59+
return None
60+
61+
key = "HTTP_" + name.replace("-", "_").upper()
62+
return self.request.META.get(key)
63+
64+
def getRequestIp(self):
65+
return self.request.META.get("REMOTE_ADDR")
66+
67+
def getOriginalRequestUrl(self):
68+
return self.request.build_absolute_uri()

0 commit comments

Comments
 (0)