com.atlassian.jira.security.xsrf

Class OriginChecker

java.lang.Object

com.atlassian.jira.security.xsrf.OriginChecker

public class OriginChecker
extends Object

Assists with validating whether HTTP request meets XSRF origin policy

Method Summary

Modifier and Type	Method and Description
static boolean	isOriginABrowserExtension(String origin) Returns true if the provided origin is from a browser extension.
static boolean	isOriginAllowed(javax.servlet.http.HttpServletRequest request) Checks if request was made from a Jira domain or from a browser extension.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Method Detail

isOriginAllowed

public static boolean isOriginAllowed(javax.servlet.http.HttpServletRequest request)

Checks if request was made from a Jira domain or from a browser extension.

The method checks if

• Referer or Origin header points to the same domain from which Jira is served or
• Origin header matches one of known browser extension origins.

Parameters:

request - the request to check

Returns:

true if domain set in Referer or Origin is allowed, if both headers are missing false is returned

isOriginABrowserExtension

public static boolean isOriginABrowserExtension(String origin)

Returns true if the provided origin is from a browser extension.

Parameters:

origin - the origin to check.

Returns:

true if the provided origin is from a browser extension, otherwise returns false.