entd: require a per-entd-invocation session id in every request

reference_extension/client.js

 // Copyright (c) 2010 The Chromium OS Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 /**
  * Namespace object for the client side code.
  */
 var client = new Object();
 
 /**
  * Port to contact the policy's callback server.
  */
 client.policyCallbackPort = 5199;
 
 /**
  * Initialize the client.
  */
 client.onLoad =
 function onLoad() {
   client.modalShade = document.getElementById('modal-shade');
   client.loadManifest();
 };
 
 client.onManifestLoaded =
 function onManifestLoaded() {
+  client.loadSessionId();
+}
+
+client.onSessionIdLoaded =
+function onSessionIdLoaded() {
   client.loadInfo();
 }
 
 /**
  * Called when client.initPkcs11() completes successfully.
  */
 client.onPkcs11Ready =
 function onPkcs11Ready() {
   client.loadTokens();
   client.loadCertificates();
@@ skipping 27 matching lines @@
 function getURL(url) {
   if (typeof 'chrome' != undefined && chrome.extension)
     return chrome.extension.getURL(url);
 
   return url;
 };
 
 /**
  * Load the manifest.json file for this extension.
  *
- * Once it loads, set the title of the options page to match.
  */
 client.loadManifest =
 function loadManifest() {
   var xhr = new XMLHttpRequest();
   xhr.onreadystatechange = function () {
     if (this.readyState != 4)
       return;
 
     if (this.status == 0) {
       // Status is 0 rather than 200 for this.  I assume that's because we're
       // loading from the chrome-extension: scheme, rather than a real
       // web server.
       client.manifest = JSON.parse(this.responseText);
       console.log('manifest: ' + this.responseText);
       client.onManifestLoaded();
     }
   };
 
   xhr.open('GET', client.getURL('manifest.json'));
   xhr.send();
 };
 
 /**
+ * Load the session-id.json file for this session of entd.
+ *
+ */
+client.loadSessionId =
+function loadSessionId() {
+  var xhr = new XMLHttpRequest();
+  xhr.onreadystatechange = function () {
+    if (this.readyState != 4)
+      return;
+
+    if (this.status == 0) {
+      // Status is 0 rather than 200 for this.  I assume that's because we're
+      // loading from the chrome-extension: scheme, rather than a real
+      // web server.
+      if (this.responseText != "") {
+        client.session_id = JSON.parse(this.responseText);
+      } else {
+        // Assume an old Chrome OS is being used with this extension.
+        console.log('no session-id.json - old chrome os?');
+        client.session_id = { session_id: '' }
+      }
+      console.log('session_id: ' + this.responseText);
+      client.onSessionIdLoaded();
+    }
+  };
+
+  xhr.open('GET', client.getURL('session-id.json'));
+  xhr.send();
+};
+
+/**
  * Load the basic information from the enterprise daemon.
  *
  * This invokes cb:info and populates the user interface with the results.
  */
 client.loadInfo =
 function loadInfo() {
   var daemonError = false;
   var pkcs11Error = false;
   var tpmError = false;
 
@@ skipping 1020 matching lines @@
 
     param.xhrStatus = xhr.status;
     if (typeof oncomplete == "function")
       oncomplete(param);
   };
 
   xhr.open('POST', 'http://127.0.0.1:' + client.policyCallbackPort +
            '/dispatch');
   xhr.setRequestHeader('X-Entd-Request',
                        client.manifest.requestHeaderValue || 'magic');
+  xhr.setRequestHeader('X-Entd-Session-Id', client.session_id.session_id);
   xhr.setRequestHeader('Content-Type', 'application/json; charset=UTF-8');
   xhr.send(JSON.stringify({'function': name, 'argument': arg}));
 };
 
 /**
  * client.CallbackSuccess constructor.
  *
  * An instance of this class holds the return value of a successful policy
  * callback.  The data property of this object will contain the return
  * value of the callback.
@@ skipping 30 matching lines @@
  * @param {string} name The name of the callback that returned this data.
  * @param {Object} arg The argument object originally passed to the callback.
  * @param {Object} data The data returned by the callback.
  */
 client.CallbackError =
 function CallbackError(name, arg, data) {
   this.init_(name, arg, data);
 };
 
 client.CallbackError.prototype.init_ = client.CallbackSuccess.prototype.init_;