shazron/CordovaLocalWebServer — pull request #2 by tony-- (2014-11-04 14:22:24+00:00)
Title: Security improvements: localhost only + auth token

## Description of changes
I needed to modify the processBlock of addGETHandlerForBasePath in order to inspect requests and rejects the ones that are not authorized. Unfortunately, this means I need to start with a copy of addGETHandlerForBasePath, because the processBlock is hard-coded. In order to encapsulate the customization of the web server and ease maintenance, I put the custom code in a category.

For the localhost-only feature, a new handler has been added and the startPage is set to localhost (instead of the IP). The new handler inspects the host header of the request and if it is not localhost, returns 403.

For the authToken feature, the plugin generates a guid (could just be a random number or any other random token), appends it to a key and passes it into the get handler. The auth token key/value pair is appended to the initial request as a querystring. When a request is received with a valid auth token on the querystring but without an auth token cookie, a cookie is set. Requests that do not have the auth token on the querystring or in a cookie are responded to with 403.

I updated the Security Caveat in the README based on my understanding of the new vulnerability picture. Note that one vulnerability previously present was non-localhost requests (that is, anyone on the same wifi network could access the local web server previously - the purpose of the localhost only restriction is to prevent that).

## Testing
I only performed manual testing using platform tools.
I verified that prior to the localhost-only feature, I could access the server from desktop Chrome on same wifi (as expected).
After implementing localhost-only, attempting to access the server from off the device results in 403 (as expected).
For the auth token feature, I only tested with my test app, no background app testing was done as it does not seem necessary.
I put the feature in place and successfully started a Hello Cordova app (as expected).
Then I disabled the auth token being set on the querystring and received 403 (as expected).
Then I disabled setting the cookie, which resulted in 403s for the resource requests made after the initial request (as expected).

**Setting up test project steps**
1. create test project
`./cordova-ios/bin/create --shared wkwvtest com.intel.wkwvtest wkwvtest`

2. add symlink (workaround for plugman shared project bug)
`ln -s ../cordova-ios/CordovaLib/ ./wkwvtest2/CordovaLib`

3. add CordovaLocalWebServer plugin
`plugman install --platform ios --project wkwvtest --plugin ./CordovaLocalWebServer`

4. adjust config.xml
` `
` `

5. add WebKit.framework to Build Phases/Link Binary with Libraries

**Suspected bugs encountered**
1. I'm using a shared project because I intend to make some changes to cordova-ios. As referenced above, in order to get plugman to add plugins, I needed to create a symlink to CordovaLib in my project directory. I haven't checked JIRA yet, so I'm not sure if this is an existing issue. I'll check and see later.
2. I couldn't get the link option to work with plugman on iOS. There is a recently closed JIRA issue about this, but it seems the fix was not tested on iOS. Again, I'll check and see later.

**Final note**
This is my first pull request. I would welcome any feedback about what I should do differently in future PRs. Thank you.