HttpServletResponse#encodeRedirectURL(String) and HttpServletResponse#encodeURL(String) are used
to encode all URLs returned to the client
CSRF protection is enabled by generating random nonce values which are
stored in the client's HTTP session. Each URL encoded using
HttpServletResponse#encodeURL(String) has a URL parameter added
which, when sent to the server in a future request, will be checked
against this stored set of nonces for validity.
Some URLs should be accessible even without a valid nonce parameter value.
These URLs are known as "entry points" because clients should be able to
"enter" the application without first establishing any valid tokens. These
are configured with the entryPoints filter
init-param.
Some URLs should not have nonce parameters added to them at all
| Modifier and Type | Class and Description |
|---|---|
| protected static class | |
| protected static class | CsrfPreventionFilter.
The type held by this cache. T>Despite its name, this is a FIFO cache not an LRU cache. |
| protected static class | CsrfPreventionFilter.
A no-nonce Predicate that evaluates a MIME type instead of a URL. |
| protected static interface | |
| protected static class | CsrfPreventionFilter.
A no-nonce Predicate that matches a regular expression. |
| protected static class | CsrfPreventionFilter.
A no-nonce Predicate that matches a prefix. |
| protected static class | CsrfPreventionFilter.
A no-nonce Predicate that matches a suffix. |
| Modifier and Type | Field and Description |
|---|---|
| private ServletContext | context
The servlet context in which this Filter is operating. |
| private static final String | DEFAULT_NO_NONCE_URL_PATTERNS
The default set of URL patterns for which nonces will not be appended. |
| private boolean | enforce
Flag which determines whether this Filter is in "enforcement" mode (the default) or in "reporting" mode. |
| private final Set | |
| private final Log | |
| private int | |
| private String | |
| private String | noNoncePatterns
A set of comma-separated URL patterns which will have no nonce parameters added to them. |
| private Collection |
| Access | Constructor and Description |
|---|---|
| public |
| Modifier and Type | Method and Description |
|---|---|
| protected CsrfPreventionFilter. | Returns: A newly createdNonceCacheThe request that triggered the need to create the nonce cache. Unused by the default
implementation. request, HttpSession The session associated with the request. session)Create a new |
| protected static Predicate | Returns: A Predicate which can match the specified pattern, ornull if the pattern is null or blank.the Servlet context context, String The pattern to match e.g. pattern)*.foo or
/bar/*.Creates a predicate that can match the specified type of pattern. |
| protected static Collection | Returns: A collection of predicates representing the URL patterns.the Servlet context context, String A comma-separated string of URL matching patterns. patterns)Creates a collection of matchers from a comma-separated string of patterns. |
| public void | doFilter(ServletRequest
The request to process request, ServletResponse The response associated with the request response, FilterChain Provides access to the next filter in the chain for this filter to pass the request and response
to for further processing chain)Implements jakarta. The |
| protected boolean | Returns: true if the CSRF prevention should be enforced,
false if the CSRF prevention should only be
logged in DEBUG mode.The request. req, String The path of the request being evaluated. requestedPath)Check to see if the request and path should be enforced or only observed and reported. |
| protected CsrfPreventionFilter. | Returns: TheNonceCache currently associated with the request and/or sessionThe request that triggered the need to obtain the nonce cache. Unused by the default
implementation. request, HttpSession The session associated with the request. session)Obtain the |
| public void | init(FilterConfig
The configuration information associated with the filter instance being initialised filterConfig)Overrides org. Overrides default jakarta. Iterates over the configuration parameters and either logs a warning, or throws an exception for any parameter that does not have a matching setter in this filter. |
| public boolean | Returns: true if CSRF protection will be enforced or
false if all requests will be allowed and
failures will be logged as DEBUG messages.Gets the flag to enforce CSRF protection or just log failures as DEBUG messages. |
| public void | setEnforce(boolean
true to enforce CSRF protection or
false to log DEBUG messages and allow
all requests.Sets the flag to enforce CSRF protection or just log failures as DEBUG messages. |
| public void | setEntryPoints(String
Comma separated list of URLs to be configured as entry points. entryPoints)Entry points are URLs that will not be tested for the presence of a valid nonce. |
| public void | setNonceCacheSize(int
The number of nonces to cache nonceCacheSize)Sets the number of previously issued nonces that will be cached on a LRU basis to support parallel requests, limited use of the refresh and back in the browser and similar behaviors that may result in the submission of a previous nonce rather than the current one. |
| public void | setNonceRequestParameterName(String
The request parameter name to use for CSRF nonces. parameterName)Sets the request parameter name to use for CSRF nonces. |
| public void | setNoNonceURLPatterns(String
A comma-separated list of URL patterns that will not
have nonces added to them. Patterns may begin or end with a
patterns)* character to denote a suffix-match or
prefix-match. Any matched URL will not have a CSRF nonce
added to it when passed through
HttpServletResponse#encodeURL(String).Sets the list of URL patterns to suppress nonce-addition for. |
| protected boolean | |
| protected boolean | Returns: true if a nonce should be created, otherwise falseThe request that triggered the need to potentially create the nonce. request)Determines whether a nonce should be created. |
| context | back to summary |
|---|---|
| private ServletContext context The servlet context in which this Filter is operating. | |
| DEFAULT_NO_NONCE_URL_PATTERNS | back to summary |
|---|---|
| private static final String DEFAULT_NO_NONCE_URL_PATTERNS The default set of URL patterns for which nonces will not be appended. | |
| enforce | back to summary |
|---|---|
| private boolean enforce Flag which determines whether this Filter is in "enforcement" mode (the default) or in "reporting" mode. | |
| entryPoints | back to summary |
|---|---|
| private final Set<String> entryPoints | |
| log | back to summary |
|---|---|
| private final Log log Hides org. | |
| nonceCacheSize | back to summary |
|---|---|
| private int nonceCacheSize | |
| nonceRequestParameterName | back to summary |
|---|---|
| private String nonceRequestParameterName | |
| noNoncePatterns | back to summary |
|---|---|
| private String noNoncePatterns A set of comma-separated URL patterns which will have no nonce parameters added to them. | |
| noNoncePredicates | back to summary |
|---|---|
| private Collection<Predicate<String>> noNoncePredicates | |
| CsrfPreventionFilter | back to summary |
|---|---|
| public CsrfPreventionFilter() | |
| createNonceCache | back to summary |
|---|---|
| protected CsrfPreventionFilter. Create a new
| |
| createNoNoncePredicate | back to summary |
|---|---|
| protected static Predicate Creates a predicate that can match the specified type of pattern.
| |
| createNoNoncePredicates | back to summary |
|---|---|
| protected static Collection Creates a collection of matchers from a comma-separated string of patterns.
| |
| doFilter | back to summary |
|---|---|
| public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException Implements jakarta. Doc from jakarta. The
A typical implementation of this method would follow the following pattern:-
| |
| enforce | back to summary |
|---|---|
| protected boolean enforce(HttpServletRequest req, String requestedPath) Check to see if the request and path should be enforced or only
observed and reported.
Note that the
| |
| getNonceCache | back to summary |
|---|---|
| protected CsrfPreventionFilter. Obtain the
| |
| init | back to summary |
|---|---|
| public void init(FilterConfig filterConfig) throws ServletException Overrides org. Overrides default jakarta. Doc from org. Iterates over the configuration parameters and either logs a warning, or throws an exception for any parameter that does not have a matching setter in this filter.
| |
| isEnforce | back to summary |
|---|---|
| public boolean isEnforce() Gets the flag to enforce CSRF protection or just log failures as DEBUG messages.
| |
| setEnforce | back to summary |
|---|---|
| public void setEnforce(boolean enforce) Sets the flag to enforce CSRF protection or just log failures as DEBUG messages.
| |
| setEntryPoints | back to summary |
|---|---|
| public void setEntryPoints(String entryPoints) Entry points are URLs that will not be tested for the presence of a valid nonce. They are used to provide a way to navigate back to a protected application after navigating away from it. Entry points will be limited to HTTP GET requests and should not trigger any security sensitive actions.
| |
| setNonceCacheSize | back to summary |
|---|---|
| public void setNonceCacheSize(int nonceCacheSize) Sets the number of previously issued nonces that will be cached on a LRU basis to support parallel requests, limited use of the refresh and back in the browser and similar behaviors that may result in the submission of a previous nonce rather than the current one. If not set, the default value of 5 will be used.
| |
| setNonceRequestParameterName | back to summary |
|---|---|
| public void setNonceRequestParameterName(String parameterName) Sets the request parameter name to use for CSRF nonces.
| |
| setNoNonceURLPatterns | back to summary |
|---|---|
| public void setNoNonceURLPatterns(String patterns) Sets the list of URL patterns to suppress nonce-addition for. Some URLs do not need nonces added to them such as static resources. By not adding nonces to those URLs, HTTP caches can be more effective because the CSRF prevention filter won't generate what look like unique URLs for those commonly-reused resources.
| |
| skipNonceCheck | back to summary |
|---|---|
| protected boolean skipNonceCheck(HttpServletRequest request) | |
| skipNonceGeneration | back to summary |
|---|---|
| protected boolean skipNonceGeneration(HttpServletRequest request) Determines whether a nonce should be created. This method is provided primarily for the benefit of sub-classes that wish to customise this behaviour.
| |
| Modifier and Type | Field and Description |
|---|---|
| private final String | |
| private final String | |
| private final Collection |
| Access | Constructor and Description |
|---|---|
| public | CsrfResponseWrapper(HttpServletResponse response, String nonceRequestParameterName, String nonce, Collection<Predicate<String>> noNoncePatterns)
|
| Modifier and Type | Method and Description |
|---|---|
| private String | |
| public String | encodeRedirectURL(String
the url to be encoded. url)Overrides jakarta. Implements jakarta. The default behavior of this method is to return encodeRedirectURL(String url) on the wrapped response object. |
| public String | encodeURL(String
the url to be encoded. url)Overrides jakarta. Implements jakarta. The default behavior of this method is to call encodeURL(String url) on the wrapped response object. |
| private boolean |
| nonce | back to summary |
|---|---|
| private final String nonce | |
| nonceRequestParameterName | back to summary |
|---|---|
| private final String nonceRequestParameterName | |
| noNoncePatterns | back to summary |
|---|---|
| private final Collection<Predicate<String>> noNoncePatterns | |
| CsrfResponseWrapper | back to summary |
|---|---|
| public CsrfResponseWrapper(HttpServletResponse response, String nonceRequestParameterName, String nonce, Collection<Predicate<String>> noNoncePatterns) | |
| addNonce | back to summary |
|---|---|
| private String addNonce(String url) | |
| encodeRedirectURL | back to summary |
|---|---|
| public String encodeRedirectURL(String url) Overrides jakarta. Implements jakarta. Doc from jakarta. The default behavior of this method is to return encodeRedirectURL(String url) on the wrapped response object.
| |
| encodeURL | back to summary |
|---|---|
| public String encodeURL(String url) Overrides jakarta. Implements jakarta. Doc from jakarta. The default behavior of this method is to call encodeURL(String url) on the wrapped response object.
| |
| shouldAddNonce | back to summary |
|---|---|
| private boolean shouldAddNonce(String url) | |
| Modifier and Type | Field and Description |
|---|---|
| private final Map | |
| private static final long |
| Access | Constructor and Description |
|---|---|
| public |
| Modifier and Type | Method and Description |
|---|---|
| public void | |
| public boolean |
| cache | back to summary |
|---|---|
| private final Map<T, T> cache | |
| serialVersionUID | back to summary |
|---|---|
| private static final long serialVersionUID | |
| LruCache | back to summary |
|---|---|
| public LruCache(final int cacheSize) | |
| add | back to summary |
|---|---|
| public void add(T key) Implements org.
| |
| contains | back to summary |
|---|---|
| public boolean contains(T key) Implements org.
| |
| Modifier and Type | Field and Description |
|---|---|
| private final ServletContext | |
| private final Predicate |
| Access | Constructor and Description |
|---|---|
| public |
| Modifier and Type | Method and Description |
|---|---|
| public Predicate | |
| public boolean | test(String
the input argument t)Implements java. Evaluates this predicate on the given argument. |
| context | back to summary |
|---|---|
| private final ServletContext context | |
| predicate | back to summary |
|---|---|
| private final Predicate<String> predicate | |
| MimePredicate | back to summary |
|---|---|
| public MimePredicate(ServletContext context, Predicate<String> predicate) | |
| getPredicate | back to summary |
|---|---|
| public Predicate | |
| test | back to summary |
|---|---|
| public boolean test(String t) Implements java. Doc from java. Evaluates this predicate on the given argument. | |
| Modifier and Type | Method and Description |
|---|---|
| public void | |
| public boolean |
| add | back to summary |
|---|---|
| public void add(T nonce) | |
| contains | back to summary |
|---|---|
| public boolean contains(T nonce) | |
| Access | Constructor and Description |
|---|---|
| public |
| Modifier and Type | Method and Description |
|---|---|
| public boolean | test(String
the input argument t)Implements java. Evaluates this predicate on the given argument. |
| pattern | back to summary |
|---|---|
| private final Pattern pattern | |
| PatternPredicate | back to summary |
|---|---|
| public PatternPredicate(String regex) | |
| test | back to summary |
|---|---|
| public boolean test(String t) Implements java. Doc from java. Evaluates this predicate on the given argument. | |
| Access | Constructor and Description |
|---|---|
| public |
| Modifier and Type | Method and Description |
|---|---|
| public boolean | test(String
the input argument t)Implements java. Evaluates this predicate on the given argument. |
| prefix | back to summary |
|---|---|
| private final String prefix | |
| PrefixPredicate | back to summary |
|---|---|
| public PrefixPredicate(String prefix) | |
| test | back to summary |
|---|---|
| public boolean test(String t) Implements java. Doc from java. Evaluates this predicate on the given argument. | |
| Access | Constructor and Description |
|---|---|
| public |
| Modifier and Type | Method and Description |
|---|---|
| public boolean | test(String
the input argument t)Implements java. Evaluates this predicate on the given argument. |
| suffix | back to summary |
|---|---|
| private final String suffix | |
| SuffixPredicate | back to summary |
|---|---|
| public SuffixPredicate(String suffix) | |
| test | back to summary |
|---|---|
| public boolean test(String t) Implements java. Doc from java. Evaluates this predicate on the given argument. | |