Class CookieCsrfTokenRepository

java.lang.Object

com.codename1.backend.security.CookieCsrfTokenRepository

All Implemented Interfaces:

CsrfTokenRepository

public final class CookieCsrfTokenRepository
extends Object
implements CsrfTokenRepository

Keeps the token in a cookie, XSRF-TOKEN, for a page whose script reads the cookie and sends its value back in the X-XSRF-TOKEN header -- the convention Angular and axios follow. The token is also kept in the session so a sibling subdomain cannot inject a cookie and submit a matching value.

http.csrf(csrf -> csrf.csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse()));

A script can only read the cookie when it is not HttpOnly, which is what withHttpOnlyFalse() is for. Because the script has the token as the cookie holds it, a chain with this repository accepts the token unmasked in the header as well as masked. A cookie is trusted only when it matches the token issued to the current session. Tokens copied from other sessions are rejected.

Constructor Summary

Constructors

Constructor	Description
CookieCsrfTokenRepository()

Method Summary

Modifier and Type	Method	Description
CsrfToken	generateToken(HttpServer.Request request)	A new token, not yet stored.
CsrfToken	loadToken(HttpServer.Request request)	The stored token, or null when the client has none.
void	saveToken(CsrfToken token, HttpServer.Request request)	Stores token for the client; null forgets the stored one.
void	setCookieHttpOnly(boolean cookieHttpOnly)
void	setCookieName(String cookieName)
void	setCookiePath(String cookiePath)	The cookie's path; / unless set.
void	setHeaderName(String headerName)
void	setParameterName(String parameterName)
static CookieCsrfTokenRepository	withHttpOnlyFalse()	A repository whose cookie a script can read.

Methods inherited from class Object

clone, equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

CookieCsrfTokenRepository

public CookieCsrfTokenRepository()

Method Details

withHttpOnlyFalse

public static CookieCsrfTokenRepository withHttpOnlyFalse()

A repository whose cookie a script can read.

setCookieName

public void setCookieName(String cookieName)

setHeaderName

public void setHeaderName(String headerName)

setParameterName

public void setParameterName(String parameterName)

setCookiePath

public void setCookiePath(String cookiePath)

The cookie's path; / unless set.

setCookieHttpOnly

public void setCookieHttpOnly(boolean cookieHttpOnly)

generateToken

public CsrfToken generateToken(HttpServer.Request request)

Description copied from interface: CsrfTokenRepository

A new token, not yet stored.

Specified by:

generateToken in interface CsrfTokenRepository

saveToken

public void saveToken(CsrfToken token,
 HttpServer.Request request)

Description copied from interface: CsrfTokenRepository

Stores token for the client; null forgets the stored one.

Specified by:

saveToken in interface CsrfTokenRepository

loadToken

public CsrfToken loadToken(HttpServer.Request request)

Description copied from interface: CsrfTokenRepository

The stored token, or null when the client has none.

Specified by:

loadToken in interface CsrfTokenRepository