Skip to content

Resolve web context

The BOL web context carries the user's current policy, claim, and application across the BOL applications. This operation chooses the first available source so the context follows the user from one application to the next.

Field Value
Operation ID OP-04
Trigger Page handler selection
Inputs BolContext cookie, referring application, WebContextId form value, cid query value, session
Outputs A ContextHelper assigned to WebContext
Primary components BolContextModel.OnPageHandlerExecuting (through TryGetContext), WebContextService.NewContext, RequestHelper
Entry point src/BolMiddleware/Models/BolContextModel.cs

Steps

  1. Determine the session id. When the environment key bolmiddleware:UseSessionCookie is true, read it from the cookie named by bolmiddleware:SessionCookieName; otherwise use the request session id (BR-BOLMIDDLEWARE-020).
  2. If the BolContext cookie holds a context with content, use it (BR-BOLMIDDLEWARE-001, BR-BOLMIDDLEWARE-003).
  3. Otherwise re-read the cookie once and use it when it now has content.
  4. Otherwise, if the request has a referring application, call GetContext(sessionId, applicationName) on the BOL Context API through WebContextService.
  5. Otherwise, if a WebContextId form value or a cid query value is present, call GetContext(contextId).
  6. Otherwise read the context from the session.
  7. If none of the sources produced a context, call NewContext(sessionId, applicationName), add the middleware session cookie, and set the BolContext cookie.
  8. On API failure: the service logs and returns an empty result (BR-BOLMIDDLEWARE-021).

Process flow

The following diagram visualizes this operation's control flow.

flowchart TD
    Start([Handler selected]) --> S0[Determine session id]
    S0 --> D1{Cookie has content?}
    D1 -->|Yes| EndOk([Use context])
    D1 -->|No| D2{Referring application?}
    D2 -->|Yes| S2[GetContext by session and application]
    D2 -->|No| D3{cid or WebContextId?}
    D3 -->|Yes| S3[GetContext by id]
    D3 -->|No| D4{Session context?}
    D4 -->|Yes| S4[Read session context]
    D4 -->|No| S5[NewContext and set cookies]
    S2 --> EndOk
    S3 --> EndOk
    S4 --> EndOk
    S5 --> EndOk

Failure and edge-case behavior

  • A context id from the query string or form is accepted without an ownership check, so a user can load another context by guessing its id.
  • UseSessionCookie and SessionCookieName are read through IEnvironmentClient on every request; missing-key behavior is unknown**.
  • GetFrameworkLoggingInfo writes form, query, and context values to the log, which can include personal data.

Note: Statements marked with ** could not be confirmed; treat as unknown until verified.

Sources

  • src/BolMiddleware/Models/BolContextModel.cs
  • src/BolMiddleware/Services/Context/WebContextService.cs
  • src/BolMiddleware/Services/Context/WebContextExtensions.cs
  • src/BolMiddleware/Services/Request/RequestHelper.cs