Package com.zfabrik.util.microweb.actions

Class XSRFGate

java.lang.Object

com.zfabrik.util.microweb.actions.XSRFGate

All Implemented Interfaces:

IAction

public class XSRFGate
extends Object
implements IAction

In order to block Cross-Site Request Forgery attacks, we require that a request provides the current session id as a parameter by the name jsessionid. This blocks attackers that send GETs or POSTs to foreign domain from invoking an action.

Field Summary

Fields

Modifier and Type	Field	Description
static String[]	XSRF_COOKIES
static String	XSRF_PASSKEY

Constructor Summary

Constructors

Constructor	Description
XSRFGate(IAction wrapped)

Method Summary

Modifier and Type	Method	Description
static OutCome	check(javax.servlet.http.HttpServletRequest req, String passkey)
OutCome	handle(javax.servlet.ServletContext context, javax.servlet.http.HttpServletRequest req, javax.servlet.http.HttpServletResponse res)

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

XSRF_COOKIES

public static final String[] XSRF_COOKIES

XSRF_PASSKEY

public static final String XSRF_PASSKEY

See Also:

Constant Field Values

Constructor Details

XSRFGate

public XSRFGate(IAction wrapped)

Method Details

handle

public OutCome handle(javax.servlet.ServletContext context,
 javax.servlet.http.HttpServletRequest req,
 javax.servlet.http.HttpServletResponse res)
               throws javax.servlet.ServletException,
IOException

Specified by:

handle in interface IAction

Throws:

javax.servlet.ServletException

IOException

check

public static OutCome check(javax.servlet.http.HttpServletRequest req,
 String passkey)