Package com.atlassian.crowd.xwork

Interface XsrfTokenGenerator

All Known Implementing Classes:
SimpleXsrfTokenGenerator
public interface XsrfTokenGenerator
Interface for generating anti-XSRF tokens for web forms. The default implementation SimpleXsrfTokenGenerator should be good enough for anyone, but this interface is provided just in case anyone wants to implement their own token generation strategy.

  • Method Summary

    Modifier and Type
    Method
    Description
    String
    generateToken(javax.servlet.http.HttpServletRequest request)
    Generate a new form token for the current request.
    String
    getToken(javax.servlet.http.HttpServletRequest request, boolean create)
    Retrieves the token from the request.
    String
    getXsrfTokenName()
    Convenience method which will return the name to be used for a supplied XsrfToken in a request.
    boolean
    validateToken(javax.servlet.http.HttpServletRequest request, String token)
    Validate a form token received as part of a web request

  • Method Details

    • getToken

      String getToken(javax.servlet.http.HttpServletRequest request, boolean create)
      Retrieves the token from the request. Returns null if there is no request and create is false. If create is true, a new token is generated and returned.
      Parameters:
      request - the request the token is retrieved from
      create - if true, a token will be created if it doesn't already exist
      Returns:
      a valid XSRF form token, null if there is none in the request and create of false.
      Since:
      1.12

    • generateToken

      String generateToken(javax.servlet.http.HttpServletRequest request)
      Generate a new form token for the current request.
      Parameters:
      request - the request the token is being generated for
      Returns:
      a valid XSRF form token

    • getXsrfTokenName

      String getXsrfTokenName()
      Convenience method which will return the name to be used for a supplied XsrfToken in a request.
      Returns:
      the name in the request for the Xsrf token.

    • validateToken

      boolean validateToken(javax.servlet.http.HttpServletRequest request, String token)
      Validate a form token received as part of a web request
      Parameters:
      request - the request the token was received in
      token - the token
      Returns:
      true iff the token is valid