Package org.wso2.carbon.ui.filters.csrf

Class CSRFProtector

java.lang.Object

org.wso2.carbon.ui.filters.csrf.CSRFProtector

public class CSRFProtector
extends Object

This class generates a CSRF token for a valid session and protects the request against that token. This also implements the logic to inject a javascript for the response, to enforce that the generated token is added as a hidden parameter in every form.

Constructor Summary

Constructors

Constructor	Description
CSRFProtector(CSRFFilterConfig config)

Method Summary

Modifier and Type	Method	Description
void	applyProtection(javax.servlet.http.HttpServletRequest request, CSRFResponseWrapper responseWrapper)	Validates POST requests for CSRF token
void	enforceProtection(javax.servlet.http.HttpServletRequest request, CSRFResponseWrapper responseWrapper)	Generates and injects CSRF Token in the response as a hidden parameter
CSRFFilterConfig	getConfig()
boolean	skipUrl(String uri)

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

CSRFProtector

public CSRFProtector(CSRFFilterConfig config)

Method Detail

skipUrl

public boolean skipUrl(String uri)

applyProtection

public void applyProtection(javax.servlet.http.HttpServletRequest request,
                            CSRFResponseWrapper responseWrapper)
                     throws CSRFException

Validates POST requests for CSRF token

Parameters:

request - HTTPServerRequest instance

responseWrapper - HTTPServerletResponseWrapper instance

Throws:

CSRFException - exception is thrown when there is a probable attack

enforceProtection

public void enforceProtection(javax.servlet.http.HttpServletRequest request,
                              CSRFResponseWrapper responseWrapper)
                       throws IOException

Generates and injects CSRF Token in the response as a hidden parameter

Parameters:

request - HTTPServerRequest instance

responseWrapper - HTTPServerletResponseWrapper instance

Throws:

IOException

getConfig

public CSRFFilterConfig getConfig()