Package org.codice.ddf.security.filter.csrf

Class CsrfFilter

java.lang.Object

org.codice.ddf.security.filter.csrf.CsrfFilter

All Implemented Interfaces:

org.codice.ddf.platform.filter.SecurityFilter

public class CsrfFilter
extends Object
implements org.codice.ddf.platform.filter.SecurityFilter

Contains multiple checks to prevent cross-site requests for protected context paths.

Field Summary

Fields

Modifier and Type	Field	Description
static final String	CSRF_HEADER
static final String	ORIGIN_HEADER
static final String	REFERER_HEADER

Constructor Summary

Constructors

Constructor	Description
CsrfFilter(ddf.security.audit.SecurityLogger securityLogger)

Method Summary

Modifier and Type	Method	Description
void	destroy()
void	doFilter(javax.servlet.ServletRequest request, javax.servlet.ServletResponse response, org.codice.ddf.platform.filter.SecurityFilterChain chain)	Checks that the origin or referer header of the request matches a system trusted authority when attempting to access certain contexts.
void	init()
void	setWhiteListContexts(List<String> whiteListContexts)

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

CSRF_HEADER

public static final String CSRF_HEADER

See Also:

• Constant Field Values

ORIGIN_HEADER

public static final String ORIGIN_HEADER

See Also:

• Constant Field Values

REFERER_HEADER

public static final String REFERER_HEADER

See Also:

• Constant Field Values

Constructor Details

CsrfFilter

public CsrfFilter(ddf.security.audit.SecurityLogger securityLogger)

Method Details

init

public void init()

Specified by:

init in interface org.codice.ddf.platform.filter.SecurityFilter

doFilter

public void doFilter(javax.servlet.ServletRequest request,
 javax.servlet.ServletResponse response,
 org.codice.ddf.platform.filter.SecurityFilterChain chain)
              throws IOException,
org.codice.ddf.platform.filter.AuthenticationException

Checks that the origin or referer header of the request matches a system trusted authority when attempting to access certain contexts. Also checks for the existence of an anti-CSRF header "X-Requested-With". A 403 is returned and the request is stopped if one or more of these conditions are met: - Neither the Origin nor Referer header is present on the request. - Neither the Origin nor Referer header match a trusted authority. - The "X-Requested-With" header is not present on the request.

Specified by:

doFilter in interface org.codice.ddf.platform.filter.SecurityFilter

Parameters:

request - incoming http request

response - response stream for returning the response

chain - chain of filters to be invoked following this filter

Throws:

IOException

org.codice.ddf.platform.filter.AuthenticationException

setWhiteListContexts

public void setWhiteListContexts(List<String> whiteListContexts)

destroy

public void destroy()

Specified by:

destroy in interface org.codice.ddf.platform.filter.SecurityFilter