at.porscheinformatik.tapestry.csrfprotection.internal

Class CsrfProtectionFilter

java.lang.Object

at.porscheinformatik.tapestry.csrfprotection.internal.CsrfProtectionFilter

All Implemented Interfaces:

org.apache.tapestry5.services.ComponentEventRequestFilter

public class CsrfProtectionFilter
extends Object
implements org.apache.tapestry5.services.ComponentEventRequestFilter

This filter checks each component event request or page render request for cross-site request forgery attacks. If a page is marked as protected a request is checked. If the auto mode for the cross-stie request forgery protection is used, all pages are checked except those which are marked as unprotected.

Constructor Summary

Constructors

Constructor and Description
CsrfProtectionFilter(CsrfTokenManager csrfTokenManager, ProtectedPagesService protectedPagesService, org.apache.tapestry5.http.services.Request request, javax.servlet.http.HttpServletRequest httpServletRequest) Creates a new filter and injects the required services and configuration parameters.

Method Summary

Modifier and Type	Method and Description
void	handle(org.apache.tapestry5.services.ComponentEventRequestParameters parameters, org.apache.tapestry5.services.ComponentEventRequestHandler handler) Handles a component event request and evaluates the cross-site request forgery protection.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

CsrfProtectionFilter

public CsrfProtectionFilter(CsrfTokenManager csrfTokenManager,
                            ProtectedPagesService protectedPagesService,
                            org.apache.tapestry5.http.services.Request request,
                            javax.servlet.http.HttpServletRequest httpServletRequest)

Creates a new filter and injects the required services and configuration parameters.

Parameters:

csrfTokenManager - .

protectedPagesService - .

request - .

httpServletRequest - .

Method Detail

handle

public void handle(org.apache.tapestry5.services.ComponentEventRequestParameters parameters,
                   org.apache.tapestry5.services.ComponentEventRequestHandler handler)
            throws IOException

Handles a component event request and evaluates the cross-site request forgery protection.

Specified by:

handle in interface org.apache.tapestry5.services.ComponentEventRequestFilter

Parameters:

parameters - .

handler - .

Throws:

IOException - when delegate throws