Skip to content

Commit ecdcc8b

Browse files
MohammadMQMohammadMQ
committed
Revert readme file changes
1 parent f877eee commit ecdcc8b

File tree

1 file changed

+127
-41
lines changed

1 file changed

+127
-41
lines changed

‎README.md‎

Lines changed: 127 additions & 41 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,8 @@
1+
>You can find the latest released version [here](https://github.com/queueit/KnownUser.V3.PHP/releases/latest) and
2+
>[packagist](https://packagist.org/packages/queueit/knownuserv3)
3+
14
# KnownUser.V3.PHP
2-
The Queue-it Security Framework is used to ensure that end users cannot bypass the queue by adding a server-side integration to your server.
5+
The Queue-it Security Framework is used to ensure that end users cannot bypass the queue by adding a server-side integration to your server. It supports php >= 5.3.3.
36

47
## Introduction
58
When a user is redirected back from the queue to your website, the queue engine can attache a query string parameter (`queueittoken`) containing some information about the user.
@@ -12,7 +15,7 @@ The most important fields of the `queueittoken` are:
1215

1316
The high level logic is as follows:
1417

15-
![The KnownUser validation flow](https://github.com/queueit/KnownUser.V3.PHP/blob/master/Documentation/KnownUser%20flow.PNG)
18+
![The KnownUser validation flow](https://github.com/queueit/KnownUser.V3.PHP/blob/master/Documentation/KnownUserFlow.png)
1619

1720
1. User requests a page on your server
1821
2. The validation method sees that the has no Queue-it session cookie and no `queueittoken` and sends him to the correct queue based on the configuration
@@ -36,8 +39,7 @@ The Action specifies which queue the users should be send to.
3639
In this way you can specify which queue(s) should protect which page(s) on the fly without changing the server-side integration.
3740

3841
This configuration can then be downloaded to your application server.
39-
Read more about how *[here](https://github.com/queueit/KnownUser.V3.PHP/tree/master/Documentation)*.
40-
The configuration should be downloaded and cached for 5-10 minutes.
42+
Read more about how *[here](https://github.com/queueit/KnownUser.V3.PHP/tree/master/Documentation)*.
4143

4244
### 2. Validate the `queueittoken` and store a session cookie
4345
To validate that the user has been through the queue, use the `KnownUser::validateRequestByIntegrationConfig()` method.
@@ -46,53 +48,62 @@ If the timestamp or hash is invalid, the user is send back to the queue.
4648

4749

4850
## Implementation
49-
The KnownUser validation must *only* be done on *page requests*.
50-
So, if you add the KnownUser validation logic to a central place, then be sure that the Triggers only fire on page requests and not on e.g. image or ajax requests.
51+
The KnownUser validation must be done on *all requests except requests for static resources like images, css files and ...*.
52+
So, if you add the KnownUser validation logic to a central place, then be sure that the Triggers only fire on page requests (including ajax requests) and not on e.g. image.
5153

5254
If we have the `integrationconfig.json` copied in the folder beside other knownuser files inside web application folder then
5355
the following method is all that is needed to validate that a user has been through the queue:
5456

5557

5658
```php
57-
5859
require_once( __DIR__ .'Models.php');
5960
require_once( __DIR__ .'KnownUser.php');
60-
header("Cache-Control: max-age=0, no-cache, no-store, must-revalidate");
61+
6162
$configText = file_get_contents('integrationconfig.json');
6263
$customerID = ""; //Your Queue-it customer ID
63-
$secretKey = ""; //Your 72 char secrete key as specified in Go Queue-it self-service platform
64+
$secretKey = ""; //Your 72 char secret key as specified in Go Queue-it self-service platform
6465

6566
$queueittoken = isset( $_GET["queueittoken"] )? $_GET["queueittoken"] :'';
6667

6768
try
6869
{
69-
//Verify if the user has been through the queue
70-
$result = QueueIT\KnownUserV3\SDK\KnownUser::validateRequestByIntegrationConfig(getFullRequestUri(),
71-
$queueittoken, $configText, $customerID, $secretKey);
72-
73-
74-
70+
$fullUrl = getFullRequestUri();
71+
$currentUrlWithoutQueueitToken = preg_replace("/([\\?&])("."queueittoken"."=[^&]*)/i", "", $fullUrl);
72+
73+
//Verify if the user has been through the queue
74+
$result = QueueIT\KnownUserV3\SDK\KnownUser::validateRequestByIntegrationConfig(
75+
$currentUrlWithoutQueueitToken, $queueittoken, $configText, $customerID, $secretKey);
76+
7577
if($result->doRedirect())
7678
{
77-
//Send the user to the queue - either becuase hash was missing or becuase is was invalid
78-
header('Location: '.$result->redirectUrl);
79+
//Adding no cache headers to prevent browsers to cache requests
80+
header("Expires:Fri, 01 Jan 1990 00:00:00 GMT");
81+
header("Cache-Control: no-store, no-cache, must-revalidate, max-age=0");
82+
header("Pragma: no-cache");
83+
//end
84+
85+
//Send the user to the queue - either because hash was missing or because it was invalid
86+
header('Location: '.$result->redirectUrl);
7987
die();
8088
}
8189
if(!empty($queueittoken))
82-
{
83-
//Request can continue - we remove queueittoken form querystring parameter to avoid sharing of user specific token
84-
header('Location: '.str_replace("?queueittoken=".$queueittoken,"", getFullRequestUri()));
85-
die();
90+
{
91+
//Request can continue - we remove queueittoken form querystring parameter to avoid sharing of user specific token
92+
header('Location: ' . $currentUrlWithoutQueueitToken);
93+
die();
8694
}
8795
}
8896
catch(\Exception $e)
8997
{
90-
//log the exception
98+
//log the exception
9199
}
92-
93100
```
94101

95-
Helper method to get the current url (you can have your own):
102+
Helper method to get the current url (you can have your own).
103+
The result of this helper method is used to match Triggers and as the Target url (where to return the users to).
104+
It is therefor important that the result is exactly the url of the users browsers.
105+
106+
So if your webserver is e.g. behind a load balancer that modifies the host name or port, reformat the helper method as needed:
96107
```php
97108
function getFullRequestUri()
98109
{
@@ -109,30 +120,30 @@ Helper method to get the current url (you can have your own):
109120
}
110121
```
111122

112-
## Installation
113-
Copy the files: KnownUser.php, Models.php, UserInQueueService.php, UserInQueueStateCookieRepository.php, QueueITHelpers.php and IntegrationConfigHelpers.php
114-
115123

116124
## Alternative Implementation
125+
126+
### Queue configuration
127+
117128
If your application server (maybe due to security reasons) is not allowed to do external GET requests, then you have three options:
118129

119130
1. Manually download the configuration file from Queue-it Go self-service portal, save it on your application server and load it from local disk
120131
2. Use an internal gateway server to download the configuration file and save to application server
121132
3. Specify the configuration in code without using the Trigger/Action paradigm. In this case it is important *only to queue-up page requests* and not requests for resources or AJAX calls.
122-
This can be done by adding custom filtering logic before caling the `KnownUser::validateRequestByLocalEventConfig()` method.
133+
This can be done by adding custom filtering logic before caling the `KnownUser::resolveQueueRequestByLocalConfig()` method.
123134

124135
The following is an example of how to specify the configuration in code:
125136

126137
```php
127138
require_once( __DIR__ .'Models.php');
128139
require_once( __DIR__ .'KnownUser.php');
129-
header("Cache-Control: max-age=0, no-cache, no-store, must-revalidate");
140+
130141
$customerID = ""; //Your Queue-it customer ID
131-
$secretKey = ""; //Your 72 char secrete key as specified in Go Queue-it self-service platform
142+
$secretKey = ""; //Your 72 char secret key as specified in Go Queue-it self-service platform
132143

133-
$eventConfig = new QueueIT\KnownUserV3\SDK\EventConfig();
144+
$eventConfig = new QueueIT\KnownUserV3\SDK\QueueEventConfig();
134145
$eventConfig->eventId = ""; // ID of the queue to use
135-
$eventConfig->queueDomain = "xxx.queue-it.net"; //Domian name of the queue - usually in the format [CustomerId].queue-it.net
146+
$eventConfig->queueDomain = "xxx.queue-it.net"; //Domain name of the queue - usually in the format [CustomerId].queue-it.net
136147
//$eventConfig->cookieDomain = ".my-shop.com"; //Optional - Domain name where the Queue-it session cookie should be saved
137148
$eventConfig->cookieValidityMinute = 15; //Optional - Validity of the Queue-it session cookie. Default is 10 minutes
138149
$eventConfig->extendCookieValidity = true; //Optional - Should the Queue-it session cookie validity time be extended each time the validation runs? Default is true.
@@ -143,27 +154,102 @@ $queueittoken = isset( $_GET["queueittoken"] )? $_GET["queueittoken"] :'';
143154

144155
try
145156
{
146-
//Verify if the user has been through the queue
147-
$result = QueueIT\KnownUserV3\SDK\KnownUser::validateRequestByLocalEventConfig(getFullRequestUri(),
148-
$queueittoken, $eventConfig, $customerID, $secretKey);
157+
$fullUrl = getFullRequestUri();
158+
$currentUrlWithoutQueueitToken = preg_replace("/([\\?&])("."queueittoken"."=[^&]*)/i", "", $fullUrl);
149159

160+
//Verify if the user has been through the queue
161+
$result = QueueIT\KnownUserV3\SDK\KnownUser::resolveQueueRequestByLocalConfig(
162+
$currentUrlWithoutQueueitToken, $queueittoken, $eventConfig, $customerID, $secretKey);
150163

151164
if($result->doRedirect())
152165
{
153-
//Send the user to the queue - either becuase hash was missing or becuase is was invalid
154-
header('Location: '.$result->redirectUrl);
166+
//Adding no cache headers to prevent browsers to cache requests
167+
header("Expires:Fri, 01 Jan 1990 00:00:00 GMT");
168+
header("Cache-Control: no-store, no-cache, must-revalidate, max-age=0");
169+
header("Pragma: no-cache");
170+
//end
171+
//Send the user to the queue - either because hash was missing or because it was invalid
172+
header('Location: '.$result->redirectUrl);
155173
die();
156174
}
157175
if(!empty($queueittoken))
158-
{
159-
//Request can continue - we remove queueittoken form querystring parameter to avoid sharing of user specific token
160-
header('Location: '.str_replace("?queueittoken=".$queueittoken,"", getFullRequestUri()));
161-
die();
176+
{
177+
//Request can continue - we remove queueittoken form querystring parameter to avoid sharing of user specific token
178+
header('Location: ' . $currentUrlWithoutQueueitToken);
179+
die();
162180
}
163181
}
164182
catch(\Exception $e)
165183
{
166184
//log the exception
167185
}
186+
```
187+
### Protecting ajax calls on static pages
188+
If you have some static html pages (might be behind cache servers) and you have some ajax calls from those pages needed to be protected by KnownUser library you need to follow these steps:
189+
1) You are using v.3.5.1 (or later) of the KnownUser library.
190+
2) Make sure KnownUser code will not run on static pages (by ignoring those URLs in your integration configuration).
191+
3) Add below JavaScript tags to static pages :
192+
```
193+
<script type="text/javascript" src="//static.queue-it.net/script/queueclient.min.js"></script>
194+
<script
195+
data-queueit-intercept-domain="{YOUR_CURRENT_DOMAIN}"
196+
data-queueit-intercept="true"
197+
data-queueit-c="{YOUR_CUSTOMER_ID}"
198+
type="text/javascript"
199+
src="//static.queue-it.net/script/queueconfigloader.min.js">
200+
</script>
201+
```
202+
4) Use the following method to protect all dynamic calls (including dynamic pages and ajax calls).
168203

204+
```php
205+
require_once( __DIR__ .'Models.php');
206+
require_once( __DIR__ .'KnownUser.php');
207+
208+
$configText = file_get_contents('integrationconfig.json');
209+
$customerID = ""; //Your Queue-it customer ID
210+
$secretKey = ""; //Your 72 char secret key as specified in Go Queue-it self-service platform
211+
212+
$queueittoken = isset( $_GET["queueittoken"] )? $_GET["queueittoken"] :'';
213+
214+
try
215+
{
216+
$fullUrl = getFullRequestUri();
217+
$currentUrlWithoutQueueitToken = preg_replace("/([\\?&])("."queueittoken"."=[^&]*)/i", "", $fullUrl);
218+
219+
//Verify if the user has been through the queue
220+
$result = QueueIT\KnownUserV3\SDK\KnownUser::validateRequestByIntegrationConfig(
221+
$currentUrlWithoutQueueitToken, $queueittoken, $configText, $customerID, $secretKey);
222+
223+
if($result->doRedirect())
224+
{
225+
//Adding no cache headers to prevent browsers to cache requests
226+
header("Expires:Fri, 01 Jan 1990 00:00:00 GMT");
227+
header("Cache-Control: no-store, no-cache, must-revalidate, max-age=0");
228+
header("Pragma: no-cache");
229+
//end
230+
231+
if(!$result->isAjaxResult)
232+
{
233+
//Send the user to the queue - either because hash was missing or because is was invalid
234+
header('Location: ' . $result->redirectUrl);
235+
}
236+
else
237+
{
238+
header('HTTP/1.0: 200');
239+
header($result->getAjaxQueueRedirectHeaderKey() . ': '. $result->getAjaxRedirectUrl());
240+
}
241+
242+
die();
243+
}
244+
if(!empty($queueittoken) && !empty($result->actionType))
245+
{
246+
//Request can continue - we remove queueittoken form querystring parameter to avoid sharing of user specific token
247+
header('Location: ' . $currentUrlWithoutQueueitToken);
248+
die();
249+
}
250+
}
251+
catch(\Exception $e)
252+
{
253+
//log the exception
254+
}
169255
```

0 commit comments

Comments
 (0)