Package com.atlassian.confluence.impl.xsrf.impl

Class DefaultXsrfTokenValidationManager

java.lang.Object

com.atlassian.confluence.impl.xsrf.impl.DefaultXsrfTokenValidationManager

All Implemented Interfaces:

XsrfTokenValidationManager

public class DefaultXsrfTokenValidationManager
extends Object
implements XsrfTokenValidationManager

Validates the XSRF tokens for protected struts actions Used in NeoSecurityFilter

Configuring XSRF protection happens at the method level, and can be done either by adding a XsrfProtectionExcluded or RequireSecurityToken annotation to the method, or by adding a <param name="RequireSecurityToken">[true|false]</param> parameter to the action configuration in struts.xml.

XsrfProtectionExcluded annotations override any other settings. Configuration in struts.xml will override RequireSecurityToken annotations. Behaviour when a method is not configured at all depends on the return values of SecurityLevelConfig.

Requests containing the HTTP header X-Atlassian-Token: no-check will bypass the check and always succeed.

Field Summary

Fields

Modifier and Type	Field	Description
static String	ATL_TOKEN
static String	HTTP_ADD_ON_ID_ATTRIBUTE_NAME
static String	JWT_TOKEN_PARAM
static String	NO_CHECK_HEADER_VALUE
static String	REQUIRE_SECURITY_TOKEN
static String	SRC_MAIL_RECIPIENT
static String	X_ATLASSIAN_TOKEN

Constructor Summary

Constructors

Constructor	Description
DefaultXsrfTokenValidationManager(com.atlassian.xwork.XsrfTokenGenerator tokenGenerator)

Method Summary

Modifier and Type	Method	Description
boolean	isRequestExempt(String actionName, javax.servlet.http.HttpServletRequest request)	Check if XSRF token protection checks should be exempt for the given action and request.
boolean	isRequestValid(Class<?> actionClass, Method actionMethod, Map<String,String> actionParams, javax.servlet.http.HttpServletRequest request)	Check if this request passes XSRF token checks.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

SRC_MAIL_RECIPIENT

public static final String SRC_MAIL_RECIPIENT

See Also:

Constant Field Values

JWT_TOKEN_PARAM

public static final String JWT_TOKEN_PARAM

See Also:

Constant Field Values

HTTP_ADD_ON_ID_ATTRIBUTE_NAME

public static final String HTTP_ADD_ON_ID_ATTRIBUTE_NAME

See Also:

Constant Field Values

X_ATLASSIAN_TOKEN

public static final String X_ATLASSIAN_TOKEN

See Also:

Constant Field Values

NO_CHECK_HEADER_VALUE

public static final String NO_CHECK_HEADER_VALUE

See Also:

Constant Field Values

REQUIRE_SECURITY_TOKEN

public static final String REQUIRE_SECURITY_TOKEN

See Also:

Constant Field Values

ATL_TOKEN

public static final String ATL_TOKEN

See Also:

Constant Field Values

Constructor Detail

DefaultXsrfTokenValidationManager

public DefaultXsrfTokenValidationManager(com.atlassian.xwork.XsrfTokenGenerator tokenGenerator)

Method Detail

isRequestExempt

public boolean isRequestExempt(String actionName,
                               javax.servlet.http.HttpServletRequest request)

Description copied from interface: XsrfTokenValidationManager

Check if XSRF token protection checks should be exempt for the given action and request.

Specified by:

isRequestExempt in interface XsrfTokenValidationManager

Parameters:

actionName - - the action name

request - - the current HttpServletRequest

Returns:

true if the request should be exempt from xsrf check, false otherwise.

isRequestValid

public boolean isRequestValid(Class<?> actionClass,
                              Method actionMethod,
                              Map<String,String> actionParams,
                              javax.servlet.http.HttpServletRequest request)

Description copied from interface: XsrfTokenValidationManager

Check if this request passes XSRF token checks.

Specified by:

isRequestValid in interface XsrfTokenValidationManager

Parameters:

actionClass - - the current action class

actionMethod - - the action method that is executed

actionParams - - the action parameters

request - - the current HttpServletRequest

Returns:

true if the request passes XSRF token validations, false otherwise.