Spring Boot CORS Not Working?

For the life of me I could not get the CORS Configuration for Spring Boot to write the needed headers to the response. I wrote my own filter that could read the CORS Config and used it in WebMVC Configuration to solve it.

Find Recursively With LS

This should probably be turned into a script.

Rsync Without Git

Just add an explicit exclude for .git:

rsync -a --exclude='.git/' --include='*.c' --include='*.sh' --include='*/' --exclude='*' ~/c/ ~/Dropbox/Public/c

Another option is to create ~/.cvsignore containing the following line along with any other directories you'd like to exclude:

.git/

Running Bash As Another User

[root@cicd-02 ~]# sudo -u jenkins /bin/bash
bash-4.2$ whoami
jenkins

Find In Files Recursively

Its helpful to be able to search for a string recursively in a directory. Here is the basic way:

grep -rnw '/path/to/somewhere/' -e "pattern"

-r or -R is recursive, -n is line number and -w stands match the whole word. -l (lower-case L) can be added to just give the file name of matching files.

Along with these, --exclude or --include parameter could be used for efficient searching. Something like below:

grep --include=\*.{c,h} -rnw '/path/to/somewhere/' -e "pattern"

This will only search through the files which have .c or .h extensions. Similarly a sample use of --exclude:

grep --exclude=*.o -rnw '/path/to/somewhere/' -e "pattern"

Above will exclude searching all the files ending with .o extension. Just like exclude file it's possible to exclude/include directories through --exclude-dir and --include-dir parameter; for example, the following shows how to integrate --exclude-dir:

grep --exclude-dir={dir1,dir2,*.dst} -rnw '/path/to/somewhere/' -e "pattern"

Replace Recursively

find /home/www -type f -print0 | xargs -0 sed -i 's/subdomainA.example.com/subdomainB.example.com/g'

Truncating Git History

Look, sometimes you want to be a revisionist, and the only way to get rid of a pesky diff that is taking a lot of commit time is to truncate the commit log. So in the rare occasion you need to do it here is how.

Create a Truncate Script

Use the Commit Sha to Truncate To

source ~/data/bin/git-truncate a71f4386f9d5e3b707067e66fd5f76a1cc06c11c

Force the Push to Origin

git push origin master --force

Basic Screen Commands

Screen is an extremely useful tool. When you dont want to make a service and just need something running in the background. Here are the basic screen commands.

What IP addresses does GitHub use that I should whitelist?

Current IP Addresses

Github currently serves applications via the following IP address range. Note: This is in CIDR notation.

• 192.30.252.0/22

In order to access all of our services, please ensure that TCP ports 22, 80, 443, and 9418 are allowed via the IP range above.

These IPs may change (or be added to) in the future, and we will keep this page up to date.

Mockito All Bundles with Hamcrest = DERP.

This is just a rehash and rant related to the following excellent post at:

https://tedvinke.wordpress.com/2013/12/17/mixing-junit-hamcrest-and-mockito-explaining-nosuchmethoderror/

This could be due to the fact that JUnit itself brings along its own version of Hamcrest as a transitive dependency. Now if you would be using JUnit 4.11 it would depending on Hamcrest 1.3 already – see here. Getting above error would be weird – since the describeMismatch method is present in org.hamcrest.Matcher interface. --Ted Vinke

This is extremely discouraging that BOTH Junit and Mockito would embed hidden transitive dependencies that are almost impossible to find without looking into the contents of the jars in the classpath.


SHAME ON YOU

Filtering without Lambda or Java 8

I wanted a way to filter generally without using Lambda or Java 8.

File path from Class Relative

determine current filesystem location of executed class from the code of this class, in runtime, given that it's executed using java command?

http://stackoverflow.com/questions/11747833/getting-filesystem-path-of-class-being-executed

Creating CORS Web Service for AngularJS

CORS is the ability to allow cross domains scripting. This can be important if you say want to host your website on S3 and have those pages access web services in EC2. I spent TONS of time trying to find how to configure AngularJS to use CORS and what I generally saw was people saying...

"You need to configure the server side for access control, not the client."

Well that's not entirely true.

The example I am using is based on the Spring, Jersey, run-as-ajar example you can find on GitHub. So lets start with the server side then:

And here is the client side...

Jenkins Home

[ec2-user ~]$ sudo su -s /bin/bash jenkins bash-4.2$

log4j Configuration

Here is the basic log4j configuration I use with all the basics. Hope this helps.

Binary Tree Search Solution

I hate face2face interview problems. I am horrible at them. I need the mental space of the IDE to work out the problem and think about it, something I dont do well in interviews.

Ah the classic interview question. Recurse Binary Trees. I don't know why they just love to give this one but I have some time off so I thought I would solve it. This is for a github project where I will point interviewers at so maybe they will just believe I can do this stuff.

The key to this is to check the other node in the recursion of the find or it will go down the right or left leg and get lost. There are some good Data Structures articles on BTS that I used to come to this solution. Here you go:

• http://cslibrary.stanford.edu/110/BinaryTrees.html
• http://opendatastructures.org/ods-java/6_1_BinaryTree_Basic_Binary.html

AWS SSL Cert with Load Balancer Issues

I have been having all kinds of problems figuring out how to use SSL with AWS Load balancers in a way that keeps users from being redirected in weird ways that look like the site has problems or dropping them out of SSL. The only way I have found that lets you do SSL without being a complete expert is to install the cert on a load balancer and then proxy to port 80. This can have some unexpected outcomes *(see bottom section)

Really would appreciate help configuring either my load balancer, domain records, or the apache2 server to make this behave more professionally.

Overview

http://docs.aws.amazon.com/ElasticLoadBalancing/latest/DeveloperGuide/US_UpdatingLoadBalancerSSL.html

1. Generate CSR
2. Get a Comodo cert
3. Cert must be PEM encoded
4. Create Load Balancer
5. Install CERT
6. Modify Host Records

Generate a CSR

https://support.comodo.com/index.php?/Knowledgebase/Article/View/1/19/csr-generation-using-openssl-apache-wmod_ssl-nginx-os-x

Two Files will be Created:

• mysite_com.csr
• mysite_com.key

Get Comodo Cert

• AddTrustExternalCARoot.crt
• COMODORSAAddTrustCA.crt
• COMODORSADomainValidationSecureServerCA.crt
• mysite_com.crt

Cert and Key Must be RSA PEM encoded

Failed to upload SSL certificate: java.lang.ClassCastException: org.bouncycastle.asn1.pkcs.PrivateKeyInfo cannot be cast to org.bouncycastle.openssl.PEMKeyPair

$ openssl rsa -in mysite_com.key -text > mysite_com_pem.key

http://stackoverflow.com/questions/991758/how-to-get-an-openssl-pem-file-from-key-and-crt-files

Install CERT

http://docs.aws.amazon.com/ElasticLoadBalancing/latest/DeveloperGuide/US_UpdatingLoadBalancerSSL.html

Private Key:* Use a text editor and copy the contents of mysite_com_pem.key

Public Key Certificate:* Use a text editor and copy the contents of mysite_com.crt

Successfully created load balancer

Load balancer mysitecom-lb was successfully created.Note: It may take a few minutes for your instances to become active in the new load balancer.

Modify Host Records

@ https://www.mysite.com Record Type: URL Redirect
www mysite-lb-1551430537.us-east-1.elb.amazonaws.com. Record Type: CName

Problems with this approach

1. https://www.mysite.com is properly certified and encrypted (not a problem)
2. There is no cert for the named domain https://mysite.com, in fact DNS doesnt know how to resolve to ssl version of the naked domain at all.
3. The non naked version of http://mysite.com does redirect to https://www.mysite.com, while it is good that it redirects to an encrypted version it would be better if it redirected to the SSL based naked domain of https://mysite.com
4. http://www.mysite.com/ does not redirect, it should redirect to https://www.mysite.com/ 

UPDATE: HOWTO Mailchimp's OAuth2

I have been working to integrate the Mailchimp OAuth implementation into an application that uses mailchimp mailing lists to drive call campaigns. My users login into my site using mailchimp, so you can see its going to be a very strong integration.

I have found a few problems with the implementation. This is about my 10th OAuth implementation so I am pretty familiar with all the little implementation differences. Here are a few crits, meant to be constructive. 

Here are some details. I am using the Mailchimp python API on bitbucket and the Bananas_OAuth implementation.

Mailchimp Python API - https://bitbucket.org/mailchimp/mailchimp-api-python
Banana Py Oauth - https://github.com/claytantor/Banana-Py/blob/master/banana_py/__init__.py

1. Its seems as though the calls from https://login.mailchimp.com/oauth2/metadata don't return enough information to reliably create a user in the authenticating system and that the API does not have a method to get data on the OAuth user that the access token was generated for. This creates a problem when attempting to create a user for the first time. When user authenticates the following information should be in the response: email address, unique unchangeable id, and mail chimp username. Right now I have to use the "account_name" which can be changed. Can you see where this might be an issue? I also have to generate a fake email and force the user to verify the email when I could just use the one you verified already. This can be dealt with using the account-details method in the helper api.
2. The OAuth implementation does not implement scope.
3. The OAuth implementation does not use best practices for refresh tokens.
4. The OAuth implementation is difficult to implement a flow for, I have implemented about 10 of these and I couldnt figure it out from your docs. If Bananas wast there I would have ended up spending an insane of of time.
5. Making the API docs say that the calls use the API key is confusing I had to read deep to see that you could use an access token to make calls.
6. Why doesn't it have a OAuth implementation in the API, c'mom just add Bananas_OAuth and do a little more architectural work to unify the concepts.

UPDATE: Cole from Mailchimp API got back to me in a day and gave me a solution for #1, I added this to the Gist as well. Looks like it works.

I have a Gist that shows some of the backflips I am having to do, its too bad too because with some very small changes the OAuth2 implementation and API would be pretty darn good. Check out what I am doing:

https://gist.github.com/claytantor/1d1169e0cc6d77d2c3ff

I am also giving you a reference to an OAuth implementation that is solid and easy to implement:

https://developer.github.com/v3/oauth/

Now you tell me.

Play 2.0 Support is Now Part of the Scala Plugin

The key change we’d like to highlight is that the Scala and Play 2.0 plugins have merged together, so with IntelliJ IDEA 14 you don’t need to install them separately because Play 2.0 support is now a part of the Scala plugin. You still need to run IntelliJ IDEA Ultimate to enable Play 2.0 support though.

Why Google's Oauth2 implementation is poor

When comparing oauth2 providers I find that Google, while being the most compliant has the absolute worst working examples of their code. Everytime I see example code from google I get the mental image picture of a 24 year old developer who claims "its works!" while not even considering how someone who has never used the technology they are proposing may interpret their completely uncommented code base.



Really? So I attempted to get this framework working in my app for hours. It requires that you use the google model objects and the xsrfutil libs to work (I guess I never got it to).

https://developers.google.com/accounts/docs/OAuth2WebServer

and

https://code.google.com/p/google-api-python-client/source/browse/samples/django_sample/plus/views.py

This FLOW framework obscures the oauth2 process from the developer, so you are completely dependent on the code base being simple to understand to get the implementation working. Secondly creating the oauth2 app client credentials are buried deep in google's "API Dashboard". It was the longest amount of time I have ever spent on an oauth2 implementation. I have done many of these and this one is very difficult to work with.

Compare this to oauth2 providers that actually give you the curl approaches directly, and allow you to compare it to their API. Their oauth2 implementation is not hidden, and you can easily figure out what needs to be done.

Paypal
https://developer.paypal.com/docs/api/#authorizations
Pretty good outh2 implementation, well documented, easy to use API. Poor user object returned on successful auth in some cases.

Github
https://developer.github.com/v3/oauth/
Its good. Period.

Coinbase
https://www.coinbase.com/docs/api/authentication
Good implementation and documentation. The python examples were a little off but a python dev can figure it our. Their support responds to problems. Worthy.

Here are my recommendations to oauth providers:

• Make the entire three legged process easy to natively implement via curl commands.
• Build auth apis that are simple extensions of that flow 
• Make sure that the client api can access enough user information to create a user record on the target app without asking for more information. 
• Make it easy for developer to create client app secrets and manage multiple environments.

Apache 2 SSL Cert and Config

Intro

I am installing a SSL cert for Apache2 and I thought I would document it. I have done it so many times now and kinda feel like its about time to have a place to go to to get the details quickly. I am using a domain level cert because its cheap and will provide encryption without having to verify my "business" (there isnt one yet). The cert I am using for this is Comodo's positivessl cert from Namecheap.com that costs 9.99

Apache2 + mod_ssl

Configuration

Sources

• The Geek Stuff - Installing SSL on Apache2
• Comodo CSR Generation
• Comodo Install Cert Apache2 mod_ssl
• Stack Overflow -Installing SSL on an EC2 Server