org.jooby.handlers

Class CsrfHandler

java.lang.Object

org.jooby.handlers.CsrfHandler

All Implemented Interfaces:

Route.Filter

public class CsrfHandler
extends Object
implements Route.Filter

Cross Site Request Forgery handler

 {
   use("*", new CsrfHandler());
 }
 

This filter require a token on POST, PUT, PATCH and DELETE requests. A custom policy might be provided via: requireTokenOn(Predicate).

Default token generator, use a UUID.randomUUID(). A custom token generator might be provided via: tokenGen(Function).

Default token name is: csrf. If you want to use a different name, just pass the name to the CsrfHandler(String) constructor.

Token verification

The CsrfHandler handler will read an existing token from Session (or created a new one is necessary) and make available as a request local variable via: Request.set(String, Object).

If the incoming request require a token verification, it will extract the token from:

1. HTTP header
2. HTTP parameter

If the extracted token doesn't match the existing token (from Session) a 403 will be thrown.

Since:

0.8.1

Author:

edgar

Constructor Summary

Constructors

Constructor and Description
CsrfHandler() Creates a new CsrfHandler and use csrf as token name.
CsrfHandler(String name) Creates a new CsrfHandler handler and use the given name to save the token in the Session and or extract the token from incoming requests.

Method Summary

Modifier and Type	Method and Description
void	handle(Request req, Response rsp, Route.Chain chain) The handle method of the Filter is called by the server each time a request/response pair is passed through the chain due to a client request for a resource at the end of the chain.
CsrfHandler	requireTokenOn(Predicate<Request> requireToken) Decided whenever or not an incoming request require token verification.
CsrfHandler	tokenGen(Function<Request,String> generator) Set a custom token generator.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

CsrfHandler

public CsrfHandler(String name)

Creates a new CsrfHandler handler and use the given name to save the token in the Session and or extract the token from incoming requests.

Parameters:

name - Token's name.

CsrfHandler

public CsrfHandler()

Creates a new CsrfHandler and use csrf as token name.

Method Detail

tokenGen

public CsrfHandler tokenGen(Function<Request,String> generator)

Set a custom token generator. Default generator use: UUID.randomUUID().

Parameters:

generator - A custom token generator.

Returns:

This filter.

requireTokenOn

public CsrfHandler requireTokenOn(Predicate<Request> requireToken)

Decided whenever or not an incoming request require token verification. Default predicate requires verification on: POST, PUT, PATCH and DELETE requests.

Parameters:

requireToken - Predicate to use.

Returns:

This filter.

handle

public void handle(Request req,
                   Response rsp,
                   Route.Chain chain)
            throws Throwable

Description copied from interface: Route.Filter

The handle method of the Filter is called by the server each time a request/response pair is passed through the chain due to a client request for a resource at the end of the chain. The Route.Chain passed in to this method allows the Filter to pass on the request and response to the next entity in the chain.

A typical implementation of this method would follow the following pattern:

• Examine the request
• Optionally wrap the request object with a custom implementation to filter content or headers for input filtering
• Optionally wrap the response object with a custom implementation to filter content or headers for output filtering
• • Either invoke the next entity in the chain using the Route.Chain object (chain.next(req, rsp)),
  • or not pass on the request/response pair to the next entity in the filter chain to block the request processing
• Directly set headers on the response after invocation of the next entity in the filter chain.

Specified by:

handle in interface Route.Filter

Parameters:

req - A HTTP request.

rsp - A HTTP response.

chain - A route chain.

Throws:

Throwable - If something goes wrong.