org.apache.nifi.web.security.csrf

Class StandardCookieCsrfTokenRepository

java.lang.Object

org.apache.nifi.web.security.csrf.StandardCookieCsrfTokenRepository

All Implemented Interfaces:

org.springframework.security.web.csrf.CsrfTokenRepository

public class StandardCookieCsrfTokenRepository
extends Object
implements org.springframework.security.web.csrf.CsrfTokenRepository

Standard implementation of CSRF Token Repository using stateless Spring Security double-submit cookie strategy

Nested Class Summary

Nested Classes

Modifier and Type	Class and Description
private static class	StandardCookieCsrfTokenRepository.CsrfApplicationCookieService

Field Summary

Fields

Modifier and Type	Field and Description
private static ApplicationCookieService	applicationCookieService
private static String	REQUEST_PARAMETER

Constructor Summary

Constructors

Constructor and Description
StandardCookieCsrfTokenRepository()

Method Summary

Modifier and Type	Method and Description
private String	generateRandomToken()
org.springframework.security.web.csrf.CsrfToken	generateToken(javax.servlet.http.HttpServletRequest httpServletRequest) Generate CSRF Token or return current Token when present in HTTP Servlet Request Cookie header
private org.springframework.security.web.csrf.CsrfToken	getCsrfToken(String token)
org.springframework.security.web.csrf.CsrfToken	loadToken(javax.servlet.http.HttpServletRequest httpServletRequest) Load CSRF Token from HTTP Servlet Request Cookie header
void	saveToken(org.springframework.security.web.csrf.CsrfToken csrfToken, javax.servlet.http.HttpServletRequest httpServletRequest, javax.servlet.http.HttpServletResponse httpServletResponse) Save CSRF Token in HTTP Servlet Response using defaults that allow JavaScript read for session cookies

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface org.springframework.security.web.csrf.CsrfTokenRepository

loadDeferredToken

Field Detail

REQUEST_PARAMETER

private static final String REQUEST_PARAMETER

See Also:

Constant Field Values

applicationCookieService

private static final ApplicationCookieService applicationCookieService

Constructor Detail

StandardCookieCsrfTokenRepository

public StandardCookieCsrfTokenRepository()

Method Detail

generateToken

public org.springframework.security.web.csrf.CsrfToken generateToken(javax.servlet.http.HttpServletRequest httpServletRequest)

Generate CSRF Token or return current Token when present in HTTP Servlet Request Cookie header

Specified by:

generateToken in interface org.springframework.security.web.csrf.CsrfTokenRepository

Parameters:

httpServletRequest - HTTP Servlet Request

Returns:

CSRF Token

saveToken

public void saveToken(org.springframework.security.web.csrf.CsrfToken csrfToken,
                      javax.servlet.http.HttpServletRequest httpServletRequest,
                      javax.servlet.http.HttpServletResponse httpServletResponse)

Save CSRF Token in HTTP Servlet Response using defaults that allow JavaScript read for session cookies

Specified by:

saveToken in interface org.springframework.security.web.csrf.CsrfTokenRepository

Parameters:

csrfToken - CSRF Token to be saved or null indicated the token should be removed

httpServletRequest - HTTP Servlet Request

httpServletResponse - HTTP Servlet Response

loadToken

public org.springframework.security.web.csrf.CsrfToken loadToken(javax.servlet.http.HttpServletRequest httpServletRequest)

Load CSRF Token from HTTP Servlet Request Cookie header

Specified by:

loadToken in interface org.springframework.security.web.csrf.CsrfTokenRepository

Parameters:

httpServletRequest - HTTP Servlet Request

Returns:

CSRF Token or null when Cookie header not found

getCsrfToken

private org.springframework.security.web.csrf.CsrfToken getCsrfToken(String token)

generateRandomToken

private String generateRandomToken()