Package org.springframework.security.web.csrf

Examples of org.springframework.security.web.csrf.CsrfToken

31
32
33
34
35
36
37
38
39
40
41
abstract class AbstractCsrfTag extends TagSupport {

    @Override
    public int doEndTag() throws JspException {

        CsrfToken token = (CsrfToken)this.pageContext.getRequest().getAttribute(CsrfToken.class.getName());
        if (token != null) {
            try {
                this.pageContext.getOut().write(this.handleToken(token));
            } catch (IOException e) {
                throw new JspException(e);
View Full Code Here
224
225
226
227
228
229
230
231
232
233
234
        return sb.toString();
    }

    private void renderHiddenInputs(StringBuilder sb, HttpServletRequest request) {
        CsrfToken token = (CsrfToken) request.getAttribute(CsrfToken.class.getName());

        if(token != null) {
            sb.append("    <input name=\""+ token.getParameterName() +"\" type=\"hidden\" value=\""+ token.getToken() +"\" />\n");
        }
    }
View Full Code Here
119
120
121
122
123
124
125
126
127
128
129
130
131
        assertThat(processor.processUrl(request, url)).isEqualTo(url);
    }

    @Test
    public void createGetExtraHiddenFieldsHasCsrfToken() {
        CsrfToken token = new DefaultCsrfToken("1", "a", "b");
        request.setAttribute(CsrfToken.class.getName(), token);
        Map<String,String> expected = new HashMap<String,String>();
        expected.put(token.getParameterName(),token.getToken());

        RequestDataValueProcessor processor = new CsrfRequestDataValueProcessor();
        assertThat(processor.getExtraHiddenFields(request)).isEqualTo(expected);
    }
View Full Code Here
59
60
61
62
63
64
65
66
67
68
69
70
71
72
        if(Boolean.TRUE.equals(request.getAttribute(DISABLE_CSRF_TOKEN_ATTR))) {
            request.removeAttribute(DISABLE_CSRF_TOKEN_ATTR);
            return Collections.emptyMap();
        }

        CsrfToken token = (CsrfToken) request.getAttribute(CsrfToken.class
                .getName());
        if (token == null) {
            return Collections.emptyMap();
        }
        Map<String, String> hiddenFields = new HashMap<String, String>(1);
        hiddenFields.put(token.getParameterName(), token.getToken());
        return hiddenFields;
    }
View Full Code Here
94
95
96
97
98
99
100
101
102
103
104
105
106
        request.setServletPath("/login");
        request.setMethod("POST");
        request.setParameter("username", "user");
        request.setParameter("password", "password");
        HttpSessionCsrfTokenRepository repository = new HttpSessionCsrfTokenRepository();
        CsrfToken token = repository.generateToken(request);
        repository.saveToken(token, request, response);
        request.setParameter(token.getParameterName(),token.getToken());
        when(ReflectionUtils.findMethod(HttpServletRequest.class, "changeSessionId")).thenReturn(method);

        loadConfig(SessionManagementDefaultSessionFixationServlet31Config.class);

        springSecurityFilterChain.doFilter(request,response,chain);
View Full Code Here
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
        public MockHttpServletRequest postProcessRequest(
                MockHttpServletRequest request) {

            CsrfTokenRepository repository = WebTestUtils
                    .getCsrfTokenRepository(request);
            CsrfToken token = repository.generateToken(request);
            repository.saveToken(token, request, new MockHttpServletResponse());
            String tokenValue = useInvalidToken ? "invalid" + token.getToken() : token.getToken();
            if(asHeader) {
                request.addHeader(token.getHeaderName(), tokenValue);
            } else {
                request.setParameter(token.getParameterName(), tokenValue);
            }
            return request;
        }
View Full Code Here
19
20
21
22
23
24
25
26
27
28
29
        this.tag = new CsrfMetaTagsTag();
    }

    @Test
    public void handleTokenRendersTags() {
        CsrfToken token = new DefaultCsrfToken("X-Csrf-Token", "_csrf", "abc123def456ghi789");

        String value = this.tag.handleToken(token);

        assertNotNull("The returned value should not be null.", value);
        assertEquals("The output is not correct.",
View Full Code Here
33
34
35
36
37
38
39
40
41
42
43
                value);
    }

    @Test
    public void handleTokenRendersTagsDifferentToken() {
        CsrfToken token = new DefaultCsrfToken("csrfHeader", "csrfParameter", "fooBarBazQux");

        String value = this.tag.handleToken(token);

        assertNotNull("The returned value should not be null.", value);
        assertEquals("The output is not correct.",
View Full Code Here
47
48
49
50
51
52
53
54
55
56
57
    }

    @Test
    public void hasCsrfRendersReturnedValue() throws JspException, UnsupportedEncodingException {

        CsrfToken token = new DefaultCsrfToken("X-Csrf-Token", "_csrf", "abc123def456ghi789");
        this.request.setAttribute(CsrfToken.class.getName(), token);

        this.tag.handleReturn = "fooBarBazQux";

        int returned = this.tag.doEndTag();
View Full Code Here
62
63
64
65
66
67
68
69
70
71
72
    }

    @Test
    public void hasCsrfRendersDifferentValue() throws JspException, UnsupportedEncodingException {

        CsrfToken token = new DefaultCsrfToken("X-Csrf-Token", "_csrf", "abc123def456ghi789");
        this.request.setAttribute(CsrfToken.class.getName(), token);

        this.tag.handleReturn = "<input type=\"hidden\" />";

        int returned = this.tag.doEndTag();
View Full Code Here
TOP

Related Classes of org.springframework.security.web.csrf.CsrfToken

  • com.allanditzel.springframework.security.web.csrf.CsrfTokenResponseHeaderBindingFilter
  • com.erudika.para.security.CachedCsrfTokenRepository
  • net.petrikainulainen.spring.social.signinmvc.security.ITFormLoginTest
  • net.petrikainulainen.spring.social.signinmvc.user.controller.ITRegistrationControllerTest
  • org.jamesdbloom.web.controller.LoginPageController
  • org.jamesdbloom.web.controller.LoginPageControllerTest
  • org.jamesdbloom.web.controller.RegistrationController
  • org.jamesdbloom.web.controller.UpdatePasswordController
  • org.springframework.security.config.annotation.web.configurers.SessionManagementConfigurerServlet31Tests
  • org.springframework.security.taglibs.csrf.AbstractCsrfTag
    • Copyright © 2018 www.massapicom. All rights reserved.
    All source code are property of their respective owners. Java is a trademark of Sun Microsystems, Inc and owned by ORACLE Inc. Contact coftware#gmail.com.