Package org.apache.catalina.filters
Class CsrfPreventionFilterBase
java.lang.Object
org.apache.catalina.filters.FilterBase
org.apache.catalina.filters.CsrfPreventionFilterBase
- All Implemented Interfaces:
Filter
- Direct Known Subclasses:
CsrfPreventionFilter,RestCsrfPreventionFilter
-
Field Summary
Fields inherited from class org.apache.catalina.filters.FilterBase
sm -
Constructor Summary
Constructors -
Method Summary
Modifier and TypeMethodDescriptionprotected StringDeprecated.protected StringgenerateNonce(HttpServletRequest request) Generate a once time token (nonce) for authenticating subsequent requests.intprotected Logprotected StringgetRequestedPath(HttpServletRequest request) voidinit(FilterConfig filterConfig) Iterates over the configuration parameters and either logs a warning, or throws an exception for any parameter that does not have a matching setter in this filter.protected booleanDetermines if an exception when calling a setter or an unknown configuration attribute triggers the failure of the this filter which in turn will prevent the web application from starting.voidsetDenyStatus(int denyStatus) Set response status code that is used to reject denied request.voidsetRandomClass(String randomClass) Specify the class to use to generate the nonces.
-
Constructor Details
-
CsrfPreventionFilterBase
public CsrfPreventionFilterBase()
-
-
Method Details
-
getLogger
- Specified by:
getLoggerin classFilterBase
-
getDenyStatus
public int getDenyStatus()- Returns:
- response status code that is used to reject denied request.
-
setDenyStatus
public void setDenyStatus(int denyStatus) Set response status code that is used to reject denied request. If none set, the default value of 403 will be used.- Parameters:
denyStatus- HTTP status code
-
setRandomClass
Specify the class to use to generate the nonces. Must be in instance ofRandom.- Parameters:
randomClass- The name of the class to use
-
init
Description copied from class:FilterBaseIterates over the configuration parameters and either logs a warning, or throws an exception for any parameter that does not have a matching setter in this filter.- Specified by:
initin interfaceFilter- Overrides:
initin classFilterBase- Parameters:
filterConfig- The configuration information associated with the filter instance being initialised- Throws:
ServletException- ifFilterBase.isConfigProblemFatal()returnstrueand a configured parameter does not have a matching setter
-
isConfigProblemFatal
protected boolean isConfigProblemFatal()Description copied from class:FilterBaseDetermines if an exception when calling a setter or an unknown configuration attribute triggers the failure of the this filter which in turn will prevent the web application from starting.- Overrides:
isConfigProblemFatalin classFilterBase- Returns:
trueif a problem should trigger the failure of this filter, elsefalse
-
generateNonce
Generate a once time token (nonce) for authenticating subsequent requests. The nonce generation is a simplified version of ManagerBase.generateSessionId().- Parameters:
request- The request. Unused in this method but present for the the benefit of sub-classes.- Returns:
- the generated nonce
-
generateNonce
Deprecated.UsegenerateNonce(HttpServletRequest)instead. This method will be removed in Apache Tomcat 10.1.x onwards.Generate a once time token (nonce) for authenticating subsequent requests. The nonce generation is a simplified version of ManagerBase.generateSessionId().- Returns:
- the generated nonce
-
getRequestedPath
-
generateNonce(HttpServletRequest)instead.