at.porscheinformatik.tapestry.csrfprotection.internal

Class CsrfTokenManager

java.lang.Object

at.porscheinformatik.tapestry.csrfprotection.internal.CsrfTokenManager

public class CsrfTokenManager
extends Object

This class contains the logic to create a secure token for cross-site script request forgery protection. It is created for a HTTP session and provides the same token throughout the whole session (per-session paradigm).

Constructor Summary

Constructors

Constructor and Description
CsrfTokenManager(CsrfTokenRepository tokenRepository, String parameterName) Initializes the secure token that will stay the same for the whole life cycle of this instance.

Method Summary

Modifier and Type	Method and Description
void	checkToken(org.apache.tapestry5.services.Request request, javax.servlet.http.HttpServletRequest httpServletRequest) This method performs the check of the token.
CsrfToken	getSessionToken() Returns the token stored in this instance.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

CsrfTokenManager

public CsrfTokenManager(CsrfTokenRepository tokenRepository,
                        @Symbol(value="tapestry.csrf-token-parameter-name")
                        String parameterName)

Initializes the secure token that will stay the same for the whole life cycle of this instance.

Parameters:

tokenRepository - an implementation of CsrfTokenRepository

parameterName - symbol CsrfConstants.CSRF_TOKEN_PARAMETER_NAME

Method Detail

getSessionToken

public CsrfToken getSessionToken()

Returns the token stored in this instance.

Returns:

the stored token or a newly generated one

checkToken

public void checkToken(org.apache.tapestry5.services.Request request,
                       javax.servlet.http.HttpServletRequest httpServletRequest)
                throws CsrfException

This method performs the check of the token. It extracts the current client token from the request and the current server-side token by accessing the CsrfTokenProvider instance assigned in this session.

Parameters:

request - .

httpServletRequest - .

Throws:

CsrfException - when token not there or token does not match