Package org.wso2.carbon.ui.filters

Class CSRFPreventionFilter

java.lang.Object

org.wso2.carbon.ui.filters.CSRFPreventionFilter

All Implemented Interfaces:

javax.servlet.Filter

public class CSRFPreventionFilter
extends Object
implements javax.servlet.Filter

This Filter guards POST requests from CSRF Injection implementing Synchronizer Token Pattern. CSRFToken is added to every form as a hidden parameter injecting a javascript via a response wrapper and the token is stored in the session In each POST request token stored in the session is validated against the token comes as a request parameter.

Constructor Summary

Constructors

Constructor	Description
CSRFPreventionFilter()

Method Summary

Modifier and Type	Method	Description
void	destroy()
void	doFilter(javax.servlet.ServletRequest servletRequest, javax.servlet.ServletResponse servletResponse, javax.servlet.FilterChain filterChain)
void	init(javax.servlet.FilterConfig filterConfig)

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

CSRFPreventionFilter

public CSRFPreventionFilter()

Method Detail

init

public void init(javax.servlet.FilterConfig filterConfig)
          throws javax.servlet.ServletException

Specified by:

init in interface javax.servlet.Filter

Throws:

javax.servlet.ServletException

doFilter

public void doFilter(javax.servlet.ServletRequest servletRequest,
                     javax.servlet.ServletResponse servletResponse,
                     javax.servlet.FilterChain filterChain)
              throws IOException,
                     javax.servlet.ServletException

Specified by:

doFilter in interface javax.servlet.Filter

Throws:

IOException

javax.servlet.ServletException

destroy

public void destroy()

Specified by:

destroy in interface javax.servlet.Filter