org.apache.wiki.http.filter

Class CsrfProtectionFilter

java.lang.Object

org.apache.wiki.http.filter.CsrfProtectionFilter

All Implemented Interfaces:

javax.servlet.Filter

public class CsrfProtectionFilter
extends java.lang.Object
implements javax.servlet.Filter

CSRF protection Filter which uses the synchronizer token pattern – an anti-CSRF token is created and stored in the user session and in a hidden field on subsequent form submits. At every submit the server checks the token from the session matches the one submitted from the form.

Field Summary

Fields

Modifier and Type	Field and Description
static java.lang.String	ANTICSRF_PARAM

Constructor Summary

Constructors

Constructor and Description
CsrfProtectionFilter()

Method Summary

Modifier and Type	Method and Description
void	destroy()
void	doFilter(javax.servlet.ServletRequest request, javax.servlet.ServletResponse response, javax.servlet.FilterChain chain)
void	init(javax.servlet.FilterConfig filterConfig)
static boolean	isCsrfProtectedPost(javax.servlet.http.HttpServletRequest request)

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

ANTICSRF_PARAM

public static final java.lang.String ANTICSRF_PARAM

See Also:

Constant Field Values

Constructor Detail

CsrfProtectionFilter

public CsrfProtectionFilter()

Method Detail

init

public void init(javax.servlet.FilterConfig filterConfig)

Specified by:

init in interface javax.servlet.Filter

doFilter

public void doFilter(javax.servlet.ServletRequest request,
                     javax.servlet.ServletResponse response,
                     javax.servlet.FilterChain chain)
              throws java.io.IOException,
                     javax.servlet.ServletException

Specified by:

doFilter in interface javax.servlet.Filter

Throws:

java.io.IOException

javax.servlet.ServletException

isCsrfProtectedPost

public static boolean isCsrfProtectedPost(javax.servlet.http.HttpServletRequest request)

destroy

public void destroy()

Specified by:

destroy in interface javax.servlet.Filter