Module io.inverno.mod.security.http

Package io.inverno.mod.security.http.csrf

Class CSRFDoubleSubmitCookieInterceptor<A extends ExchangeContext,B extends Exchange<A>>

java.lang.Object

io.inverno.mod.security.http.csrf.CSRFDoubleSubmitCookieInterceptor<A,B>

Type Parameters:

A - the context type

B - the exchange type

All Implemented Interfaces:

ExchangeInterceptor<A,B>

public class CSRFDoubleSubmitCookieInterceptor<A extends ExchangeContext,B extends Exchange<A>>
extends Object
implements ExchangeInterceptor<A,B>

A security interceptor that protects against Cross-site request forgery attack using the double submit cookie technique.

This implementation uses the stateless double submit cookie technique as recommended by Cross-Site Request Forgery Prevention Cheat Sheet.

For any POST, PUT, PATCH and DELETE, it successively tries to compare the value of a previously generated token specified in an cookie to the value supplied as a header, as a query parameter or as a form parameter (assuming the request is a application/x-www-form-urlencoded request). If the two token values are equals, the request is authorized otherwise a FORBIDDEN(403) error is returned.

Since:

1.5

Author:

Jeremy Kuhn

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
static class	CSRFDoubleSubmitCookieInterceptor.Builder	A CSRF double submit cookie interceptor builder.

Field Summary

Fields

Modifier and Type	Field	Description
protected final String	cookieName	The cookie name.
static final String	DEFAULT_COOKIE_NAME	The default cookie name: XSRF-TOKEN.
static final String	DEFAULT_HEADER_NAME	The default header name: X-CSRF-TOKEN.
static final String	DEFAULT_PARAMETER_NAME	The default parameter name: _csrf_token.
protected final String	domain	The domain of the CSRF token cookie.
protected final String	headerName	The header name.
protected final boolean	httpOnly	Flag indicating whether the token cookie should be HTTP only.
protected final Integer	maxAge	The max age of the CSRF token cookie.
protected final String	parameterName	The parameter name.
protected final String	path	The path of the CSRF token cookie.
protected final boolean	secure	Flag indicating whether the token cookie should be secured.

Constructor Summary

Constructors

Modifier	Constructor	Description
protected	CSRFDoubleSubmitCookieInterceptor(String cookieName, String headerName, String parameterName, Integer maxAge, String domain, String path, Boolean secure, Boolean httpOnly)	Creates a CSRF double submit cookie interceptor.

Method Summary

Modifier and Type	Method	Description
static CSRFDoubleSubmitCookieInterceptor.Builder	builder()	Creates a CSRF double submit cookie interceptor builder.
protected String	generateToken()	Generates the CSRF token.
String	getCookieName()	Returns the CSRF token cookie name.
String	getHeaderName()	Returns the CSRF token header name.
String	getParameterName()	Returns the CSRF token parameter name.
Mono<? extends B>	intercept(B exchange)	Intercepts the exchange before the exchange handler is invoked.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface io.inverno.mod.http.server.ExchangeInterceptor

andThen, compose

Field Details

DEFAULT_COOKIE_NAME

public static final String DEFAULT_COOKIE_NAME

The default cookie name: XSRF-TOKEN.

See Also:

• Constant Field Values

DEFAULT_HEADER_NAME

public static final String DEFAULT_HEADER_NAME

The default header name: X-CSRF-TOKEN.

See Also:

• Constant Field Values

DEFAULT_PARAMETER_NAME

public static final String DEFAULT_PARAMETER_NAME

The default parameter name: _csrf_token.

See Also:

• Constant Field Values

cookieName

protected final String cookieName

The cookie name.

headerName

protected final String headerName

The header name.

parameterName

protected final String parameterName

The parameter name.

maxAge

protected final Integer maxAge

The max age of the CSRF token cookie.

domain

protected final String domain

The domain of the CSRF token cookie.

path

protected final String path

The path of the CSRF token cookie.

secure

protected final boolean secure

Flag indicating whether the token cookie should be secured.

httpOnly

protected final boolean httpOnly

Flag indicating whether the token cookie should be HTTP only.

Constructor Details

CSRFDoubleSubmitCookieInterceptor

protected CSRFDoubleSubmitCookieInterceptor(String cookieName,
 String headerName,
 String parameterName,
 Integer maxAge,
 String domain,
 String path,
 Boolean secure,
 Boolean httpOnly)

Creates a CSRF double submit cookie interceptor.

Parameters:

cookieName - the cookie name

headerName - the header name

parameterName - the parameter name

maxAge - the cookie max age

domain - the cookie domain

path - the cookie path

secure - the cookie secure flag

httpOnly - the cookie HTTP only flag

Method Details

getCookieName

public String getCookieName()

Returns the CSRF token cookie name.

Returns:

the cookie name

getHeaderName

public String getHeaderName()

Returns the CSRF token header name.

Returns:

the header name

getParameterName

public String getParameterName()

Returns the CSRF token parameter name.

Returns:

the parameter name

builder

public static CSRFDoubleSubmitCookieInterceptor.Builder builder()

Creates a CSRF double submit cookie interceptor builder.

Returns:

a CSRF double submit cookie interceptor builder

intercept

public Mono<? extends B> intercept(B exchange)

Description copied from interface: ExchangeInterceptor

Intercepts the exchange before the exchange handler is invoked.

Specified by:

intercept in interface ExchangeInterceptor<A extends ExchangeContext,B extends Exchange<A>>

Parameters:

exchange - the server exchange to handle

Returns:

a Mono emitting the exchange or an instrumented exchange to continue the exchange handling chain or an empty Mono to stop the exchange handling chain

generateToken

protected String generateToken()

Generates the CSRF token.

It shall be collision free and hardly forgeable.

Returns:

a CSRF token