ConfigurationProvider (OWASP CSRFGuard 4.0.0 API)

All Known Implementing Classes:

NullConfigurationProvider, PropertiesConfigurationProvider
```
public interface ConfigurationProvider
```
TODO document

Method Summary

All Methods Instance Methods Abstract Methods
Modifier and Type	Method and Description
`List<IAction>`	`getActions()` TODO document
`String`	`getDomainOrigin()` TODO document
`String`	`getJavascriptCacheControl()` TODO document
`String`	`getJavascriptDynamicNodeCreationEventName()` TODO
`Pattern`	`getJavascriptRefererPattern()` TODO document
`String`	`getJavascriptSourceFile()` TODO document
`String`	`getJavascriptTemplateCode()` TODO document
`String`	`getJavascriptUnprotectedExtensions()` TODO document example: "js,css,gif,png,ico,jpg"
`String`	`getJavascriptXrequestedWith()` TODO document
`ILogger`	`getLogger()` TODO document
`LogicalSessionExtractor`	`getLogicalSessionExtractor()` TODO document
`String`	`getNewTokenLandingPage()` TODO document
`Duration`	`getPageTokenSynchronizationTolerance()` TODO document
`SecureRandom`	`getPrng()` TODO document
`Set<String>`	`getProtectedMethods()` TODO document
`Set<String>`	`getProtectedPages()` TODO document
`TokenHolder`	`getTokenHolder()` TODO document
`int`	`getTokenLength()` TODO document
`String`	`getTokenName()` TODO document
`Set<String>`	`getUnprotectedMethods()` if there are methods here, then all other HTTP methods are protected and these (e.g.
`Set<String>`	`getUnprotectedPages()` TODO document
`boolean`	`isAjaxEnabled()` TODO document
`boolean`	`isCacheable()` TODO document
`boolean`	`isEnabled()` if the filter is enabled
`boolean`	`isForceSynchronousAjax()` TODO document
`boolean`	`isJavascriptDomainStrict()` TODO document
`boolean`	`isJavascriptInjectFormAttributes()` if the token should be injected in the action in forms note, if injectIntoForms is true, then this might not need to be true
`boolean`	`isJavascriptInjectGetForms()` if the token should be injected in GET forms (which will be on the URL) if the HTTP method GET is unprotected, then this should likely be false
`boolean`	`isJavascriptInjectIntoAttributes()` TODO document
`boolean`	`isJavascriptInjectIntoDynamicallyCreatedNodes()` TODO
`boolean`	`isJavascriptInjectIntoForms()` TODO document
`boolean`	`isJavascriptRefererMatchDomain()` if the referer to the javascript must match domain
`boolean`	`isJavascriptRefererMatchProtocol()` if the referer to the javascript must match match the protocol of the domain
`boolean`	`isPrintConfig()` TODO document
`boolean`	`isProtectEnabled()` The default behavior of CSRFGuard is to protect all pages.
`boolean`	`isRotateEnabled()` TODO document
`boolean`	`isTokenPerPageEnabled()` TODO document
`boolean`	`isTokenPerPagePrecreateEnabled()` TODO document
`boolean`	`isUseNewTokenLandingPage()` TODO document
`boolean`	`isValidateWhenNoSessionExists()` If csrf guard filter should check even if there is no session for the user Note: this changed around 2014/04, the default behavior used to be to not check if there is no session.

- Method Detail
  - isCacheable
```
boolean isCacheable()
```
    TODO document
    
    Returns:
    
    true when this configuration provider can be cached for a minute, i.e. it is all setup
  - isPrintConfig
```
boolean isPrintConfig()
```
    TODO document
    
    Returns:
  - getLogger
```
ILogger getLogger()
```
    TODO document
    
    Returns:
  - getTokenName
```
String getTokenName()
```
    TODO document
    
    Returns:
  - isValidateWhenNoSessionExists
```
boolean isValidateWhenNoSessionExists()
```
    If csrf guard filter should check even if there is no session for the user Note: this changed around 2014/04, the default behavior used to be to not check if there is no session. If you want the legacy behavior (if your app is not susceptible to CSRF if the user has no session), set this to false
    
    Returns:
    
    true when validation is performed even when no session exists
  - getTokenLength
```
int getTokenLength()
```
    TODO document
    
    Returns:
  - isRotateEnabled
```
boolean isRotateEnabled()
```
    TODO document
    
    Returns:
  - isTokenPerPageEnabled
```
boolean isTokenPerPageEnabled()
```
    TODO document
    
    Returns:
  - isTokenPerPagePrecreateEnabled
```
boolean isTokenPerPagePrecreateEnabled()
```
    TODO document
    
    Returns:
  - getPrng
```
SecureRandom getPrng()
```
    TODO document
    
    Returns:
  - getNewTokenLandingPage
```
String getNewTokenLandingPage()
```
    TODO document
    
    Returns:
  - isUseNewTokenLandingPage
```
boolean isUseNewTokenLandingPage()
```
    TODO document
    
    Returns:
  - isAjaxEnabled
```
boolean isAjaxEnabled()
```
    TODO document
    
    Returns:
  - isProtectEnabled
```
boolean isProtectEnabled()
```
    The default behavior of CSRFGuard is to protect all pages. Pages marked as unprotected will not be protected.
    If the Protect property is enabled, this behavior is reversed. Pages must be marked as protected to be protected. All other pages will not be protected. This is useful when the CsrfGuardFilter is aggressively mapped (ex: /*), but you only want to protect a few pages.
    
    Returns:
    
    false if all pages are protected, true if pages are required to be explicit protected
  - isForceSynchronousAjax
```
boolean isForceSynchronousAjax()
```
    TODO document
    
    Returns:
    
    whether or not the legacy Synchronous AJAX requests are enabled
  - getProtectedPages
```
Set<String> getProtectedPages()
```
    TODO document
    
    Returns:
  - getUnprotectedPages
```
Set<String> getUnprotectedPages()
```
    TODO document
    
    Returns:
  - getProtectedMethods
```
Set<String> getProtectedMethods()
```
    TODO document
    
    Returns:
  - getUnprotectedMethods
```
Set<String> getUnprotectedMethods()
```
    if there are methods here, then all other HTTP methods are protected and these (e.g. GET) are unprotected
    
    Returns:
    
    the unprotected methods
  - isEnabled
```
boolean isEnabled()
```
    if the filter is enabled
    
    Returns:
    
    is csrf guard filter is enabled
  - getActions
```
List<IAction> getActions()
```
    TODO document
    
    Returns:
  - getJavascriptSourceFile
```
String getJavascriptSourceFile()
```
    TODO document
    
    Returns:
  - isJavascriptDomainStrict
```
boolean isJavascriptDomainStrict()
```
    TODO document
    
    Returns:
  - getDomainOrigin
```
String getDomainOrigin()
```
    TODO document
    
    Returns:
  - getJavascriptCacheControl
```
String getJavascriptCacheControl()
```
    TODO document
    
    Returns:
  - getJavascriptRefererPattern
```
Pattern getJavascriptRefererPattern()
```
    TODO document
    
    Returns:
  - isJavascriptInjectGetForms
```
boolean isJavascriptInjectGetForms()
```
    if the token should be injected in GET forms (which will be on the URL) if the HTTP method GET is unprotected, then this should likely be false
    
    Returns:
    
    true if the token should be injected in GET forms via Javascript
  - isJavascriptInjectFormAttributes
```
boolean isJavascriptInjectFormAttributes()
```
    if the token should be injected in the action in forms note, if injectIntoForms is true, then this might not need to be true
    
    Returns:
    
    if inject
  - isJavascriptInjectIntoForms
```
boolean isJavascriptInjectIntoForms()
```
    TODO document
    
    Returns:
  - isJavascriptRefererMatchProtocol
```
boolean isJavascriptRefererMatchProtocol()
```
    if the referer to the javascript must match match the protocol of the domain
    
    Returns:
    
    true if the javascript must match the protocol of the domain
  - isJavascriptRefererMatchDomain
```
boolean isJavascriptRefererMatchDomain()
```
    if the referer to the javascript must match domain
    
    Returns:
    
    true if the javascript must match domain
  - isJavascriptInjectIntoAttributes
```
boolean isJavascriptInjectIntoAttributes()
```
    TODO document
    
    Returns:
  - isJavascriptInjectIntoDynamicallyCreatedNodes
```
boolean isJavascriptInjectIntoDynamicallyCreatedNodes()
```
    TODO
    
    Returns:
  - getJavascriptDynamicNodeCreationEventName
```
String getJavascriptDynamicNodeCreationEventName()
```
    TODO
    
    Returns:
  - getJavascriptXrequestedWith
```
String getJavascriptXrequestedWith()
```
    TODO document
    
    Returns:
  - getJavascriptTemplateCode
```
String getJavascriptTemplateCode()
```
    TODO document
    
    Returns:
  - getJavascriptUnprotectedExtensions
```
String getJavascriptUnprotectedExtensions()
```
    TODO document example: "js,css,gif,png,ico,jpg"
    
    Returns:
  - getTokenHolder
```
TokenHolder getTokenHolder()
```
    TODO document
    
    Returns:
  - getLogicalSessionExtractor
```
LogicalSessionExtractor getLogicalSessionExtractor()
```
    TODO document
    
    Returns:
  - getPageTokenSynchronizationTolerance
```
Duration getPageTokenSynchronizationTolerance()
```
    TODO document
    
    Returns:

Interface ConfigurationProvider

Method Summary

Method Detail

isCacheable

isPrintConfig

getLogger

getTokenName

isValidateWhenNoSessionExists

getTokenLength

isRotateEnabled

isTokenPerPageEnabled

isTokenPerPagePrecreateEnabled

getPrng

getNewTokenLandingPage

isUseNewTokenLandingPage

isAjaxEnabled

isProtectEnabled

isForceSynchronousAjax

getProtectedPages

getUnprotectedPages

getProtectedMethods

getUnprotectedMethods

isEnabled

getActions

getJavascriptSourceFile

isJavascriptDomainStrict

getDomainOrigin

getJavascriptCacheControl

getJavascriptRefererPattern

isJavascriptInjectGetForms

isJavascriptInjectFormAttributes

isJavascriptInjectIntoForms

isJavascriptRefererMatchProtocol

isJavascriptRefererMatchDomain

isJavascriptInjectIntoAttributes

isJavascriptInjectIntoDynamicallyCreatedNodes

getJavascriptDynamicNodeCreationEventName

getJavascriptXrequestedWith

getJavascriptTemplateCode

getJavascriptUnprotectedExtensions

getTokenHolder

getLogicalSessionExtractor

getPageTokenSynchronizationTolerance