Package co.ankatech.ankasecure.sdk.transport

Class ConfiguredOriginInterceptor

java.lang.Object
co.ankatech.ankasecure.sdk.transport.ConfiguredOriginInterceptor
All Implemented Interfaces:
okhttp3.Interceptor
public final class ConfiguredOriginInterceptor extends Object implements okhttp3.Interceptor
Refuses any request bound for an origin other than the one the SDK was configured with.

Why a client needs this at all

An HTTP client decides where to send a request from two things: what its caller asked for, and what the server said. The second one is the problem. A redirect is an instruction from the responding server about where to go next, and a client that follows it across origins has handed a remote party the ability to choose which host receives the next request - carrying whatever that request carries.

That is not hypothetical here. This interceptor exists because a containment test measured it: a token endpoint answering 302 with a Location on an unrelated host produced a live request to that host, from a client whose configuration named it nowhere. No credential survived the hop - the underlying library strips the authorization header and drops the body on a cross-host redirect - but "the library happens to strip it" is a property of a dependency, not a guarantee of this SDK, and the SDK's promise is about hosts, not about which fields survive.

What it enforces

Exactly one thing, stated as a property rather than as a list of blocked cases: every request this client emits goes to scheme://host:port as configured, and there is no input - no header, no body, no status, no redirect - that can produce a request anywhere else.

Registered TWICE on every client that uses it - as an APPLICATION interceptor and as a NETWORK interceptor - because the two refuse at different moments and neither subsumes the other:

  • the APPLICATION registration sees the request the caller made and refuses before a connection exists;
  • the NETWORK registration sees each individual request, so it still covers anything that rewrites a URL later, or a redirect a future change reintroduces - but it runs AFTER OkHttp's ConnectInterceptor, so by then DNS, TCP and a full TLS handshake with the foreign host have already happened.

That second point is why the network registration alone was not enough: request BYTES were contained while the CONNECTION was not, which leaves a blind connect primitive against any host a response can name. Redirect following is disabled as well, so the controls stay independent: one prevents the follow-up from being attempted, the others refuse it if anything ever reintroduces it.

  • Nested Class Summary

    Nested classes/interfaces inherited from interface okhttp3.Interceptor

    okhttp3.Interceptor.Chain, okhttp3.Interceptor.Companion

  • Field Summary

    Fields inherited from interface okhttp3.Interceptor

    Companion

  • Constructor Summary

    Constructors
    Constructor
    Description
    ConfiguredOriginInterceptor(String configuredBaseUrl)
     

  • Method Summary

    Modifier and Type
    Method
    Description
    okhttp3.Response
    intercept(okhttp3.Interceptor.Chain chain)
     
    String
    origin()
    The origin this interceptor pins to, for diagnostics.
    boolean
    permits(okhttp3.HttpUrl url)
    Whether a URL is on the configured origin.
    String
    toString()
     

    Methods inherited from class java.lang.Object

    equals, getClass, hashCode, notify, notifyAll, wait, wait, wait

  • Constructor Details

    • ConfiguredOriginInterceptor

      public ConfiguredOriginInterceptor(String configuredBaseUrl)
      Parameters:
      configuredBaseUrl - the absolute base the client was configured with, as scheme://host:port
      Throws:
      NullPointerException - if configuredBaseUrl is null
      IllegalArgumentException - if it is not a URL this interceptor can pin to

  • Method Details

    • intercept

      public okhttp3.Response intercept(okhttp3.Interceptor.Chain chain) throws IOException
      Specified by:
      intercept in interface okhttp3.Interceptor
      Throws:
      IOException

    • permits

      public boolean permits(okhttp3.HttpUrl url)
      Whether a URL is on the configured origin.
      Parameters:
      url - the URL to test; null is not permitted
      Returns:
      true when scheme, host and port all match

    • origin

      public String origin()
      The origin this interceptor pins to, for diagnostics.
      Returns:
      the origin as scheme://host:port

    • toString

      public String toString()
      Overrides:
      toString in class Object