org.fenixedu.bennu.spring.security

Class CSRFTokenBean

java.lang.Object

org.fenixedu.bennu.spring.security.CSRFTokenBean

@Component(value="csrf")
public class CSRFTokenBean
extends Object

Utility class to provide easy access to CSRFToken in JSP contexts.

Author:

João Carvalho (joao.pedro.carvalho@tecnico.ulisboa.pt)

Constructor Summary

Constructors

Constructor and Description
CSRFTokenBean(CSRFTokenRepository tokenRepository)

Method Summary

Modifier and Type	Method and Description
String	field() Prints a HTML input field with the CSRF Token associated with the current request.
String	getHeaderName() Returns the name of the header that is expected to contain the CSRF token.
String	getParameterName() Returns the name of the form parameter that is expected to contain the CSRF token.
String	getToken() Returns the value of the token associated with the current request.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

CSRFTokenBean

@Autowired
public CSRFTokenBean(CSRFTokenRepository tokenRepository)

Method Detail

getToken

public String getToken()

Returns the value of the token associated with the current request.

Returns:

The token associated with this request

Throws:

IllegalStateException - If this method is invoked outside a Spring MVC context

field

public String field()

Prints a HTML input field with the CSRF Token associated with the current request. This allows simply adding

 ${csrf.field()}
 

to any form to handle CSRF protection.

Returns:

An input field with the CSRF Token.

getParameterName

public String getParameterName()

Returns the name of the form parameter that is expected to contain the CSRF token.

Returns:

The CSRF Token parameter name

getHeaderName

public String getHeaderName()

Returns the name of the header that is expected to contain the CSRF token. This is particularly useful when invoking Spring-based REST endpoints.

Returns:

The CSRF Token header name