com.atlassian.plugins.rest.common.security.jersey

Class XsrfResourceFilter

java.lang.Object

com.atlassian.plugins.rest.common.security.jersey.XsrfResourceFilter

All Implemented Interfaces:

com.sun.jersey.spi.container.ContainerRequestFilter, com.sun.jersey.spi.container.ResourceFilter

public class XsrfResourceFilter
extends Object
implements com.sun.jersey.spi.container.ResourceFilter, com.sun.jersey.spi.container.ContainerRequestFilter

Rejects requests that do not satisfy XSRF checks. A request is rejected if it requires XSRF protection, but does not include the no-check header or a valid XSRF protection token. Also protects browsers against XSRF attacks where the origin of a request would not otherwise be permitted by the same origin policy or CORS.

Since:

2.4

Field Summary

Fields

Modifier and Type	Field and Description
static String	NO_CHECK
static String	TOKEN_HEADER

Constructor Summary

Constructors

Constructor and Description
XsrfResourceFilter()

Method Summary

Modifier and Type	Method and Description
com.sun.jersey.spi.container.ContainerRequest	filter(com.sun.jersey.spi.container.ContainerRequest request)
com.sun.jersey.spi.container.ContainerRequestFilter	getRequestFilter()
com.sun.jersey.spi.container.ContainerResponseFilter	getResponseFilter()
protected boolean	passesAdditionalBrowserChecks(com.sun.jersey.spi.container.ContainerRequest request) Due to bugs in some browsers, it is possible for non-simple cross-domain HTTP requests to be issued *without* the normal CORS preflight request being triggered.
void	setFailureStatus(javax.ws.rs.core.Response.Status failureStatus)
void	setHttpContext(com.atlassian.sal.api.web.context.HttpContext httpContext)
void	setPluginModuleTracker(com.atlassian.plugin.tracker.PluginModuleTracker<CorsDefaults,CorsDefaultsModuleDescriptor> pluginModuleTracker)
void	setXsrfRequestValidator(com.atlassian.sal.api.xsrf.XsrfRequestValidator xsrfRequestValidator)

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

TOKEN_HEADER

public static final String TOKEN_HEADER

See Also:

Constant Field Values

NO_CHECK

public static final String NO_CHECK

See Also:

Constant Field Values

Constructor Detail

XsrfResourceFilter

public XsrfResourceFilter()

Method Detail

setHttpContext

public void setHttpContext(com.atlassian.sal.api.web.context.HttpContext httpContext)

setXsrfRequestValidator

public void setXsrfRequestValidator(com.atlassian.sal.api.xsrf.XsrfRequestValidator xsrfRequestValidator)

setPluginModuleTracker

public void setPluginModuleTracker(com.atlassian.plugin.tracker.PluginModuleTracker<CorsDefaults,CorsDefaultsModuleDescriptor> pluginModuleTracker)

setFailureStatus

public void setFailureStatus(javax.ws.rs.core.Response.Status failureStatus)

filter

public com.sun.jersey.spi.container.ContainerRequest filter(com.sun.jersey.spi.container.ContainerRequest request)

Specified by:

filter in interface com.sun.jersey.spi.container.ContainerRequestFilter

passesAdditionalBrowserChecks

protected boolean passesAdditionalBrowserChecks(com.sun.jersey.spi.container.ContainerRequest request)

Due to bugs in some browsers, it is possible for non-simple cross-domain HTTP requests to be issued *without* the normal CORS preflight request being triggered. This meant that both our CORS restrictions and our XSRF protections could be bypassed.

getRequestFilter

public com.sun.jersey.spi.container.ContainerRequestFilter getRequestFilter()

Specified by:

getRequestFilter in interface com.sun.jersey.spi.container.ResourceFilter

getResponseFilter

public com.sun.jersey.spi.container.ContainerResponseFilter getResponseFilter()

Specified by:

getResponseFilter in interface com.sun.jersey.spi.container.ResourceFilter