Cleanup service URLs

[mmeeks]

To make our service URL (for eg. websocket, clipboard etc.) much cleaner we should:

• Store the request cookies, access_token, etc. etc. in WSD and instead of populating the loleaflet.html with all of this information we should:
• generate a strong / hex random token - Util::rng::getHardRandomHexString(32) or so
• store all the request details into a hash associated with this random token
• expire this token when the relevant ClientSession / DocumentBroker expires
• return the ServerId and this new token in the loleaflet.html
• use this token instead of re-building the docURL & docParamsPart into service access URLs.
• also pass the ServerId - as a sanity check for broken clustering setups - to catch those earlier
• check the ServerId matches as/when we connect - clearly if the token is not present internally it's the wrong server, but - worth being able to debug these mixups more easily too in the logs I think.

This should be more proxy friendly, yield much shorter URLs and be easier on the eye. We should default to this in CO 21.06 + but I don't believe we need it as an option in 6.4.

Thanks !

[mmeeks]

See also bug #3086 for some more pre-requisites.

[Ashod]

One tricky case is when a user/view idles and the document is unloaded. Without the full URL, the token will have expired and we won't be able to transparently reload the document. We will somehow need to reload the page so we service loleaflet.html all over. Indeed caching the token is not the issue here, since this scenario will still play out when the server is restarted. So this isn't a matter of caching the token as much as it is a matter of saying "please reload the page" (or doing it seamlessly).

[mmeeks]

Oh - that is an interesting case =) hmm; not clear how best to handle that really. Possibly it would be cleaner to pass the access token down the websocket as the 1st command, rather than having it in the URL; and handle that on the WSD side somehow cleanly (?) Urk =)