Package com.atlassian.jira.security.xsrf

Interface XsrfInvocationChecker

All Known Implementing Classes:
DefaultXsrfInvocationChecker
@PublicApi public interface XsrfInvocationChecker
Checks that a web-request (either WebWork action or HttpServlet) has been invoked with the correct XSRF token.
Since:
v4.1.1

  • Field Summary

    Fields
    Modifier and Type
    Field
    Description
    static final String
    REQUIRE_SECURITY_TOKEN
    This is the same name that Confluences uses in their webwork2 world so we are using the same name for synergy reasons
    static final String
    X_ATLASSIAN_TOKEN
     

  • Method Summary

    Modifier and Type
    Method
    Description
    XsrfCheckResult
    checkActionInvocation(webwork.action.Action action, Map<String,?> parameters)
    Checks that the action about to be executed has been invoked with the correct XSRF parameters.
    XsrfCheckResult
    checkWebRequestInvocation(javax.servlet.http.HttpServletRequest httpServletRequest)
    Checks that the web request contains the correct XSRF parameters.

  • Field Details

    • REQUIRE_SECURITY_TOKEN

      static final String REQUIRE_SECURITY_TOKEN
      This is the same name that Confluences uses in their webwork2 world so we are using the same name for synergy reasons
      See Also:

    • X_ATLASSIAN_TOKEN

      static final String X_ATLASSIAN_TOKEN
      See Also:

  • Method Details

    • checkActionInvocation

      @Nonnull XsrfCheckResult checkActionInvocation(@Nonnull webwork.action.Action action, @Nonnull Map<String,?> parameters)
      Checks that the action about to be executed has been invoked with the correct XSRF parameters. This method will skip the check if the action class or action command's method is annotated with DoesNotRequireXsrfCheck or if the HTTP method in use is safe (aka non-mutative, i.e. GET, HEAD, OPTIONS, TRACE). It will however still perform the check if the action class or action command's method is annotated with RequiresXsrfCheck whether the HTTP method is safe or not.
      Parameters:
      action - the Action in play. Cannot be null.
      parameters - the parameters this has been called with. Cannot be null.
      Returns:
      XsrfCheckResult object. Not null.

    • checkWebRequestInvocation

      @Nonnull XsrfCheckResult checkWebRequestInvocation(@Nonnull javax.servlet.http.HttpServletRequest httpServletRequest)
      Checks that the web request contains the correct XSRF parameters.
      Parameters:
      httpServletRequest - the HttpServletRequest in play. Can't be null.
      Returns:
      XsrfCheckResult object. Not null.