Package org.apache.catalina.filters
Class CsrfPreventionFilterBase
- java.lang.Object
-
- org.apache.catalina.filters.FilterBase
-
- org.apache.catalina.filters.CsrfPreventionFilterBase
-
- All Implemented Interfaces:
Filter
- Direct Known Subclasses:
CsrfPreventionFilter,RestCsrfPreventionFilter
public abstract class CsrfPreventionFilterBase extends FilterBase
-
-
Field Summary
-
Fields inherited from class org.apache.catalina.filters.FilterBase
sm
-
-
Constructor Summary
Constructors Constructor Description CsrfPreventionFilterBase()
-
Method Summary
All Methods Instance Methods Concrete Methods Modifier and Type Method Description protected StringgenerateNonce()Generate a once time token (nonce) for authenticating subsequent requests.intgetDenyStatus()protected LoggetLogger()protected StringgetRequestedPath(HttpServletRequest request)voidinit(FilterConfig filterConfig)Iterates over the configuration parameters and either logs a warning, or throws an exception for any parameter that does not have a matching setter in this filter.protected booleanisConfigProblemFatal()Determines if an exception when calling a setter or an unknown configuration attribute triggers the failure of the this filter which in turn will prevent the web application from starting.voidsetDenyStatus(int denyStatus)Set response status code that is used to reject denied request.voidsetRandomClass(String randomClass)Specify the class to use to generate the nonces.
-
-
-
Method Detail
-
getLogger
protected Log getLogger()
- Specified by:
getLoggerin classFilterBase
-
getDenyStatus
public int getDenyStatus()
- Returns:
- response status code that is used to reject denied request.
-
setDenyStatus
public void setDenyStatus(int denyStatus)
Set response status code that is used to reject denied request. If none set, the default value of 403 will be used.- Parameters:
denyStatus- HTTP status code
-
setRandomClass
public void setRandomClass(String randomClass)
Specify the class to use to generate the nonces. Must be in instance ofRandom.- Parameters:
randomClass- The name of the class to use
-
init
public void init(FilterConfig filterConfig) throws ServletException
Description copied from class:FilterBaseIterates over the configuration parameters and either logs a warning, or throws an exception for any parameter that does not have a matching setter in this filter.- Specified by:
initin interfaceFilter- Overrides:
initin classFilterBase- Parameters:
filterConfig- The configuration information associated with the filter instance being initialised- Throws:
ServletException- ifFilterBase.isConfigProblemFatal()returnstrueand a configured parameter does not have a matching setter
-
isConfigProblemFatal
protected boolean isConfigProblemFatal()
Description copied from class:FilterBaseDetermines if an exception when calling a setter or an unknown configuration attribute triggers the failure of the this filter which in turn will prevent the web application from starting.- Overrides:
isConfigProblemFatalin classFilterBase- Returns:
trueif a problem should trigger the failure of this filter, elsefalse
-
generateNonce
protected String generateNonce()
Generate a once time token (nonce) for authenticating subsequent requests. The nonce generation is a simplified version of ManagerBase.generateSessionId().- Returns:
- the generated nonce
-
getRequestedPath
protected String getRequestedPath(HttpServletRequest request)
-
-