Top Fields Constructors Methods
org.apache.catalina.filters

public abstract Class CsrfPreventionFilterBase

extends FilterBase
Class Inheritance
Known Direct Subclasses
org.apache.catalina.filters.RestCsrfPreventionFilter, org.apache.catalina.filters.CsrfPreventionFilter
Imports
java.security.SecureRandom, java.util.Random, jakarta.servlet.FilterConfig, .ServletException, jakarta.servlet.http.HttpServletRequest, .HttpServletResponse, org.apache.juli.logging.Log, .LogFactory

Field Summary

Modifier and TypeField and Description
private int
denyStatus

private final Log
log

private String
randomClass

private Random
randomSource

Inherited from org.apache.catalina.filters.FilterBase:
sm

Constructor Summary

AccessConstructor and Description
public
CsrfPreventionFilterBase()

Method Summary

Modifier and TypeMethod and Description
protected String

Returns:

the generated nonce
generateNonce(HttpServletRequest
The request. Unused in this method but present for the the benefit of sub-classes.
request)

Generate a once time token (nonce) for authenticating subsequent requests.

public int

Returns:

response status code that is used to reject denied request.
getDenyStatus()

protected Log
getLogger()

Implements abstract org.apache.catalina.filters.FilterBase.getLogger.

protected String
getRequestedPath(HttpServletRequest request)

public void
init(FilterConfig
The configuration information associated with the filter instance being initialised
filterConfig)

Overrides org.apache.catalina.filters.FilterBase.init.

Overrides default jakarta.servlet.Filter.init.

Iterates over the configuration parameters and either logs a warning, or throws an exception for any parameter that does not have a matching setter in this filter.

protected boolean
isConfigProblemFatal()

Overrides org.apache.catalina.filters.FilterBase.isConfigProblemFatal.

Determines if an exception when calling a setter or an unknown configuration attribute triggers the failure of the this filter which in turn will prevent the web application from starting.

public void
setDenyStatus(int
HTTP status code
denyStatus)

Set response status code that is used to reject denied request.

public void
setRandomClass(String
The name of the class to use
randomClass)

Specify the class to use to generate the nonces.

Field Detail

denyStatusback to summary
private int denyStatus
logback to summary
private final Log log
randomClassback to summary
private String randomClass
randomSourceback to summary
private Random randomSource

Constructor Detail

CsrfPreventionFilterBaseback to summary
public CsrfPreventionFilterBase()

Method Detail

generateNonceback to summary
protected String generateNonce(HttpServletRequest request)

Generate a once time token (nonce) for authenticating subsequent requests. The nonce generation is a simplified version of ManagerBase.generateSessionId().

Parameters
request:HttpServletRequest

The request. Unused in this method but present for the the benefit of sub-classes.

Returns:String

the generated nonce

getDenyStatusback to summary
public int getDenyStatus()
Returns:int

response status code that is used to reject denied request.

getLoggerback to summary
protected Log getLogger()

Implements abstract org.apache.catalina.filters.FilterBase.getLogger.

Annotations
@Override
getRequestedPathback to summary
protected String getRequestedPath(HttpServletRequest request)
initback to summary
public void init(FilterConfig filterConfig) throws ServletException

Overrides org.apache.catalina.filters.FilterBase.init.

Overrides default jakarta.servlet.Filter.init.

Doc from org.apache.catalina.filters.FilterBase.init.

Iterates over the configuration parameters and either logs a warning, or throws an exception for any parameter that does not have a matching setter in this filter.

Parameters
filterConfig:FilterConfig

The configuration information associated with the filter instance being initialised

Annotations
@Override
Exceptions
ServletException:
if isConfigProblemFatal() returns true and a configured parameter does not have a matching setter
isConfigProblemFatalback to summary
protected boolean isConfigProblemFatal()

Overrides org.apache.catalina.filters.FilterBase.isConfigProblemFatal.

Doc from org.apache.catalina.filters.FilterBase.isConfigProblemFatal.

Determines if an exception when calling a setter or an unknown configuration attribute triggers the failure of the this filter which in turn will prevent the web application from starting.

Returns:boolean

true if a problem should trigger the failure of this filter, else false

Annotations
@Override
setDenyStatusback to summary
public void setDenyStatus(int denyStatus)

Set response status code that is used to reject denied request. If none set, the default value of 403 will be used.

Parameters
denyStatus:int

HTTP status code

setRandomClassback to summary
public void setRandomClass(String randomClass)

Specify the class to use to generate the nonces. Must be in instance of Random.

Parameters
randomClass:String

The name of the class to use