Z-Archive » Maybank Projects » Maybank Amex » Maybank Amex - PerCorp

• Added struts token validation to avoid resubmission.
• Added secondary token validation to avoid page reloading due to refresh button.
• Added additional token delegation in order to parse through session attribute due to application design restriction.
• Added no caching and force reload for most browsers.

Note:
Due to design restriction for this application, tokens are forced to be parse through session attributes during delegation whereby it is needed to manually remove the action flag that denotes the action has been completed. Below will be the added methods:

public void saveActionCompleted (HttpServletRequest p_oRequest)
{
        HttpSession m_oSession = p_oRequest.getSession (true);
        m_oSession.setAttribute (ACTION_COMPLETED, ACTION_COMPLETED);
    }

public void tokenRedirection (HttpServletRequest p_oRequest)
{
        p_oRequest.removeAttribute ("ACTION_COMPLETED");
        p_oRequest.setAttribute ("REDIRECTION_TOKEN", p_oRequest.getSession (false).getAttribute ("PRIMARY_TOKEN"));
    }

check token algorithm has been amended to fit for the design:

public boolean checkToken (HttpServletRequest p_oRequest, ActionMapping p_oMapping, boolean p_bPopUp) throws AmxGenericException {
String m_sActionClassCompleted;
String m_sRequestAttribute;
boolean m_bValidToken = false;
HttpSession m_oSession = p_oRequest.getSession (true);

try
{
            m_sActionClassCompleted = (String) m_oSession.getAttribute (ACTION_COMPLETED);
            m_sRequestAttribute = (String) p_oRequest.getAttribute (ACTION_COMPLETED);
            logger.debug ("m_sActionClassCompleted : " + m_sActionClassCompleted);
            logger.debug ("m_sRequestAttribute : " + m_sRequestAttribute);
            logger.debug ("isRedirection : " + p_oRequest.getAttribute ("REDIRECTION_TOKEN"));
        }
        catch (Exception e)
{
            logger.debug ("checkToken err : " + e);
            m_sActionClassCompleted = null;
            m_sRequestAttribute = null;
            return false;
        }

if (!DataValidator.isEmptyString (m_sActionClassCompleted)
                && m_sActionClassCompleted.equals (ACTION_COMPLETED)
                && DataValidator.isEmptyString (m_sRequestAttribute))
{
            m_bValidToken = this.isTokenValid (p_oRequest, p_oMapping, p_bPopUp);

if(m_bValidToken)
{
                this.saveToken (p_oRequest);
                m_oSession.removeAttribute (ACTION_COMPLETED);
                p_oRequest.setAttribute (ACTION_COMPLETED, ACTION_COMPLETED);
            }
        }
        return m_bValidToken;
    }

• Pending feedback due to unavailability of test accounts.
• Debug by UAT testing.

email:

Hi Daniell,

As spoken earlier, can you help to prepare a file listing of all the affected program files for the following changes:

1. Session validation on ALL pages (ie customers will get an invalid session page if the 'Back' or 'Forward' button is clicked).
2. Clicking on logout button will invalidate the current session.
3. All URLs fixed and should be redirecting to the respective pages.
4. Streamline Application Resource properties file.
5. Standardize CSS layout in "Manage Your Account" pages.

Once I have the listing, I will prepare the files for UAT migration and get the users to test on it.