Provides basic CSRF protection for REST APIs. The filter assumes that the clients have adapted the transfer of the nonce through the 'X-CSRF-Token' header.

Positive scenario:
          Client                            Server
             |                                 |
             | GET Fetch Request              \| JSESSIONID
             |---------------------------------| X-CSRF-Token
             |                                /| pair generation
             |/Response to Fetch Request       |
             |---------------------------------|
JSESSIONID   |\                                |
X-CSRF-Token |                                 |
pair cached  | POST Request with valid nonce  \| JSESSIONID
             |---------------------------------| X-CSRF-Token
             |                                /| pair validation
             |/ Response to POST Request       |
             |---------------------------------|
             |\                                |

Negative scenario:
          Client                            Server
             |                                 |
             | POST Request without nonce     \| JSESSIONID
             |---------------------------------| X-CSRF-Token
             |                                /| pair validation
             |/Request is rejected             |
             |---------------------------------|
             |\                                |

          Client                            Server
             |                                 |
             | POST Request with invalid nonce\| JSESSIONID
             |---------------------------------| X-CSRF-Token
             |                                /| pair validation
             |/Request is rejected             |
             |---------------------------------|
             |\                                |

Modifier and Type	Class and Description
private class	RestCsrfPreventionFilter.FetchRequest
private static enum	RestCsrfPreventionFilter.MethodType
private static interface	RestCsrfPreventionFilter.NonceConsumer<T>
private static interface	RestCsrfPreventionFilter.NonceSupplier<T, R>
private static interface	RestCsrfPreventionFilter.RestCsrfPreventionStrategy
private class	RestCsrfPreventionFilter.StateChangingRequest

Modifier and Type	Field and Description
private static final Pattern	NON_MODIFYING_METHODS_PATTERN
private static final Predicate<String>	nonModifyingMethods
private Set<String>	pathsAcceptingParams
private String	pathsDelimiter

Constructor Summary

Access	Constructor and Description
public	RestCsrfPreventionFilter()

Method Summary

Modifier and Type	Method and Description
public void	doFilter(ServletRequest The request to process request, ServletResponse The response associated with the request response, FilterChain Provides access to the next filter in the chain for this filter to pass the request and response to for further processing chain) Implements jakarta.servlet.Filter.doFilter. The `doFilter` method of the Filter is called by the container each time a request/response pair is passed through the chain due to a client request for a resource at the end of the chain.
public Set<String>	getPathsAcceptingParams()
public void	init(FilterConfig The configuration information associated with the filter instance being initialised filterConfig) Overrides org.apache.catalina.filters.CsrfPreventionFilterBase.init. Overrides default jakarta.servlet.Filter.init. Iterates over the configuration parameters and either logs a warning, or throws an exception for any parameter that does not have a matching setter in this filter.
public void	setPathsAcceptingParams(String Comma separated list of URLs to be configured as paths accepting request parameters with nonce information. pathsList) A comma separated list of URLs that can accept nonces via request parameter 'X-CSRF-Token'.

Inherited from org.apache.catalina.filters.CsrfPreventionFilterBase:: generateNonce getDenyStatus getLogger getRequestedPath isConfigProblemFatal setDenyStatus setRandomClass

Field Detail

NON_MODIFYING_METHODS_PATTERN	back to summary
private static final Pattern NON_MODIFYING_METHODS_PATTERN

nonModifyingMethods	back to summary
private static final Predicate<String> nonModifyingMethods

pathsAcceptingParams	back to summary
private Set<String> pathsAcceptingParams

pathsDelimiter	back to summary
private String pathsDelimiter

Constructor Detail

RestCsrfPreventionFilter	back to summary
public RestCsrfPreventionFilter()

Method Detail

doFilter back to summary

doFilter	back to summary
public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException Implements jakarta.servlet.Filter.doFilter. Doc from jakarta.servlet.Filter.doFilter. The `doFilter` method of the Filter is called by the container each time a request/response pair is passed through the chain due to a client request for a resource at the end of the chain. The FilterChain passed in to this method allows the Filter to pass on the request and response to the next entity in the chain. A typical implementation of this method would follow the following pattern:- 1. Examine the request 2. Optionally wrap the request object with a custom implementation to filter content or headers for input filtering 3. Optionally wrap the response object with a custom implementation to filter content or headers for output filtering 4. a) Either invoke the next entity in the chain using the FilterChain object (`chain.doFilter()`), 4. b) or not pass on the request/response pair to the next entity in the filter chain to block the request processing 5. Directly set headers on the response after invocation of the next entity in the filter chain. Parameters request:ServletRequest The request to process response:ServletResponse The response associated with the request chain:FilterChain Provides access to the next filter in the chain for this filter to pass the request and response to for further processing Annotations @Override Exceptions IOException: if an I/O error occurs during this filter's processing of the request ServletException: if the processing fails for any other reason

public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException

Implements jakarta.servlet.Filter.doFilter.

Doc from jakarta.servlet.Filter.doFilter.

The doFilter method of the Filter is called by the container each time a request/response pair is passed through the chain due to a client request for a resource at the end of the chain. The FilterChain passed in to this method allows the Filter to pass on the request and response to the next entity in the chain.

A typical implementation of this method would follow the following pattern:-
1. Examine the request
2. Optionally wrap the request object with a custom implementation to filter content or headers for input filtering
3. Optionally wrap the response object with a custom implementation to filter content or headers for output filtering
4. a) Either invoke the next entity in the chain using the FilterChain object (chain.doFilter()),
4. b) or not pass on the request/response pair to the next entity in the filter chain to block the request processing
5. Directly set headers on the response after invocation of the next entity in the filter chain.

Parameters

request:ServletRequest: The request to process
response:ServletResponse: The response associated with the request
chain:FilterChain: Provides access to the next filter in the chain for this filter to pass the request and response to for further processing

Annotations

@Override

Exceptions

IOException:: if an I/O error occurs during this filter's processing of the request
ServletException:: if the processing fails for any other reason

getPathsAcceptingParams	back to summary
public Set<String> getPathsAcceptingParams()

init back to summary

init	back to summary
public void init(FilterConfig filterConfig) throws ServletException Overrides org.apache.catalina.filters.CsrfPreventionFilterBase.init. Overrides default jakarta.servlet.Filter.init. Doc from org.apache.catalina.filters.FilterBase.init. Iterates over the configuration parameters and either logs a warning, or throws an exception for any parameter that does not have a matching setter in this filter. Parameters filterConfig:FilterConfig The configuration information associated with the filter instance being initialised Annotations @Override Exceptions ServletException: if `isConfigProblemFatal()` returns `true` and a configured parameter does not have a matching setter

public void init(FilterConfig filterConfig) throws ServletException

Overrides org.apache.catalina.filters.CsrfPreventionFilterBase.init.

Overrides default jakarta.servlet.Filter.init.

Doc from org.apache.catalina.filters.FilterBase.init.

Iterates over the configuration parameters and either logs a warning, or throws an exception for any parameter that does not have a matching setter in this filter.

Parameters

filterConfig:FilterConfig: The configuration information associated with the filter instance being initialised

Annotations

@Override

Exceptions

ServletException:: if isConfigProblemFatal() returns true and a configured parameter does not have a matching setter

setPathsAcceptingParams	back to summary
public void setPathsAcceptingParams(String pathsList) A comma separated list of URLs that can accept nonces via request parameter 'X-CSRF-Token'. For use cases when a nonce information cannot be provided via header, one can provide it via request parameters. If there is a X-CSRF-Token header, it will be taken with preference over any parameter with the same name in the request. Request parameters cannot be used to fetch new nonce, only header. Parameters pathsList:String Comma separated list of URLs to be configured as paths accepting request parameters with nonce information.

setPathsAcceptingParams

back to summary

public void setPathsAcceptingParams(String pathsList)

A comma separated list of URLs that can accept nonces via request parameter 'X-CSRF-Token'. For use cases when a nonce information cannot be provided via header, one can provide it via request parameters. If there is a X-CSRF-Token header, it will be taken with preference over any parameter with the same name in the request. Request parameters cannot be used to fetch new nonce, only header.

Parameters

pathsList:String: Comma separated list of URLs to be configured as paths accepting request parameters with nonce information.

org.apache.catalina.filters back to summary

private Class RestCsrfPreventionFilter.FetchRequest

Class Inheritance

extends Object
implements RestCsrfPreventionStrategy

java.lang.Object
org.apache.catalina.filters.RestCsrfPreventionFilter.FetchRequest

All Implemented Interfaces

org.apache.catalina.filters.RestCsrfPreventionFilter.RestCsrfPreventionStrategy

Field Summary

Modifier and Type	Field and Description
private final Predicate<String>	fetchRequest

Constructor Summary

Access	Constructor and Description
private	FetchRequest()

Method Summary

Modifier and Type	Method and Description
public boolean	apply(HttpServletRequest request, HttpServletResponse response) Implements org.apache.catalina.filters.RestCsrfPreventionFilter.RestCsrfPreventionStrategy.apply.

Inherited from java.lang.Object:: clone equals finalize getClass hashCode notify notifyAll toString wait wait wait

Field Detail

fetchRequest	back to summary
private final Predicate<String> fetchRequest

Constructor Detail

FetchRequest	back to summary
private FetchRequest()

Method Detail

apply	back to summary
public boolean apply(HttpServletRequest request, HttpServletResponse response) Implements org.apache.catalina.filters.RestCsrfPreventionFilter.RestCsrfPreventionStrategy.apply. Annotations @Override

apply

back to summary

public boolean apply(HttpServletRequest request, HttpServletResponse response)

Implements org.apache.catalina.filters.RestCsrfPreventionFilter.RestCsrfPreventionStrategy.apply.

Annotations

@Override

org.apache.catalina.filters back to summary

private final Enum RestCsrfPreventionFilter.MethodType

Class Inheritance

extends Enum<RestCsrfPreventionFilter.MethodType>

java.lang.Object
java.lang.Enum
org.apache.catalina.filters.RestCsrfPreventionFilter.MethodType

Field Summary

Modifier and Type	Field and Description
public static final RestCsrfPreventionFilter.MethodType	MODIFYING_METHOD
public static final RestCsrfPreventionFilter.MethodType	NON_MODIFYING_METHOD

Constructor Summary

Access	Constructor and Description
private	MethodType()

Method Summary

Modifier and Type	Method and Description
public static RestCsrfPreventionFilter.MethodType	valueOf(String name)
public static RestCsrfPreventionFilter.MethodType[]	values()

Inherited from java.lang.Enum:: clone compareTo describeConstable equals finalize getDeclaringClass hashCode name ordinal toString valueOf

Field Detail

MODIFYING_METHOD	back to summary
public static final RestCsrfPreventionFilter.MethodType MODIFYING_METHOD

NON_MODIFYING_METHOD	back to summary
public static final RestCsrfPreventionFilter.MethodType NON_MODIFYING_METHOD

Constructor Detail

MethodType	back to summary
private MethodType()

Method Detail

valueOf	back to summary
public static RestCsrfPreventionFilter.MethodType valueOf(String name)

values	back to summary
public static RestCsrfPreventionFilter.MethodType[] values()

Modifier and Type	Method and Description
public void	setNonce(T consumer, String key, String value)

setNonce	back to summary
public void setNonce(T consumer, String key, String value)

Modifier and Type	Method and Description
public R	getNonce(T supplier, String key)

getNonce	back to summary
public R getNonce(T supplier, String key)

Modifier and Type	Field and Description
public static final RestCsrfPreventionFilter.NonceSupplier<HttpServletRequest, String>	nonceFromRequestHeader
public static final RestCsrfPreventionFilter.NonceSupplier<HttpServletRequest, String[]>	nonceFromRequestParams
public static final RestCsrfPreventionFilter.NonceSupplier<HttpSession, String>	nonceFromSession
public static final RestCsrfPreventionFilter.NonceConsumer<HttpServletResponse>	nonceToResponse
public static final RestCsrfPreventionFilter.NonceConsumer<HttpSession>	nonceToSession

Modifier and Type	Method and Description
public boolean	apply(HttpServletRequest request, HttpServletResponse response)

nonceFromRequestHeader	back to summary
public static final RestCsrfPreventionFilter.NonceSupplier<HttpServletRequest, String> nonceFromRequestHeader

nonceFromRequestParams	back to summary
public static final RestCsrfPreventionFilter.NonceSupplier<HttpServletRequest, String[]> nonceFromRequestParams

nonceFromSession	back to summary
public static final RestCsrfPreventionFilter.NonceSupplier<HttpSession, String> nonceFromSession

nonceToResponse	back to summary
public static final RestCsrfPreventionFilter.NonceConsumer<HttpServletResponse> nonceToResponse

nonceToSession	back to summary
public static final RestCsrfPreventionFilter.NonceConsumer<HttpSession> nonceToSession

apply	back to summary
public boolean apply(HttpServletRequest request, HttpServletResponse response) throws IOException

org.apache.catalina.filters back to summary

private Class RestCsrfPreventionFilter.StateChangingRequest

Class Inheritance

extends Object
implements RestCsrfPreventionStrategy

java.lang.Object
org.apache.catalina.filters.RestCsrfPreventionFilter.StateChangingRequest

All Implemented Interfaces

org.apache.catalina.filters.RestCsrfPreventionFilter.RestCsrfPreventionStrategy

Constructor Summary

Access	Constructor and Description
private	StateChangingRequest()

Method Summary

Modifier and Type	Method and Description
public boolean	apply(HttpServletRequest request, HttpServletResponse response) Implements org.apache.catalina.filters.RestCsrfPreventionFilter.RestCsrfPreventionStrategy.apply.
private String	extractNonceFromRequest(HttpServletRequest request)
private String	extractNonceFromRequestParams(HttpServletRequest request)
private boolean	isValidStateChangingRequest(String reqNonce, String sessionNonce)

Inherited from java.lang.Object:: clone equals finalize getClass hashCode notify notifyAll toString wait wait wait

Constructor Detail

StateChangingRequest	back to summary
private StateChangingRequest()

Method Detail

apply	back to summary
public boolean apply(HttpServletRequest request, HttpServletResponse response) throws IOException Implements org.apache.catalina.filters.RestCsrfPreventionFilter.RestCsrfPreventionStrategy.apply. Annotations @Override

apply

back to summary

public boolean apply(HttpServletRequest request, HttpServletResponse response) throws IOException

Implements org.apache.catalina.filters.RestCsrfPreventionFilter.RestCsrfPreventionStrategy.apply.

Annotations

@Override

extractNonceFromRequest	back to summary
private String extractNonceFromRequest(HttpServletRequest request)

extractNonceFromRequestParams	back to summary
private String extractNonceFromRequestParams(HttpServletRequest request)

isValidStateChangingRequest	back to summary
private boolean isValidStateChangingRequest(String reqNonce, String sessionNonce)

public Class RestCsrfPreventionFilter

Nested and Inner Type Summary

Field Summary

Constructor Summary

Method Summary

Field Detail

Constructor Detail

Method Detail

private Class RestCsrfPreventionFilter.FetchRequest

Field Summary

Constructor Summary

Method Summary

Field Detail

Constructor Detail

Method Detail

private final Enum RestCsrfPreventionFilter.MethodType

Field Summary

Constructor Summary

Method Summary

Field Detail

Constructor Detail

Method Detail

private Interface RestCsrfPreventionFilter.NonceConsumer<T>

Method Summary

Method Detail

private Interface RestCsrfPreventionFilter.NonceSupplier<T, R>

Method Summary

Method Detail

private Interface RestCsrfPreventionFilter.RestCsrfPreventionStrategy

Field Summary

Method Summary

Field Detail

Method Detail

private Class RestCsrfPreventionFilter.StateChangingRequest

Constructor Summary

Method Summary

Constructor Detail

Method Detail