org.owasp.csrfguard.config

Class PropertiesConfigurationProvider

java.lang.Object

org.owasp.csrfguard.config.PropertiesConfigurationProvider

All Implemented Interfaces:

ConfigurationProvider

public class PropertiesConfigurationProvider
extends Object
implements ConfigurationProvider

ConfigurationProvider based on a Properties object.

Constructor Summary

Constructors

Constructor and Description
PropertiesConfigurationProvider(Properties properties)

Method Summary

Modifier and Type	Method and Description
List<IAction>	getActions() TODO document
String	getDomainOrigin() TODO document
String	getJavascriptCacheControl() TODO document
String	getJavascriptDynamicNodeCreationEventName() TODO
Pattern	getJavascriptRefererPattern() TODO document
String	getJavascriptSourceFile() TODO document
String	getJavascriptTemplateCode() TODO document
String	getJavascriptUnprotectedExtensions() TODO document example: "js,css,gif,png,ico,jpg"
String	getJavascriptXrequestedWith() TODO document
ILogger	getLogger() TODO document
LogicalSessionExtractor	getLogicalSessionExtractor() TODO document
String	getNewTokenLandingPage() TODO document
Duration	getPageTokenSynchronizationTolerance() TODO document
SecureRandom	getPrng() TODO document
Set<String>	getProtectedMethods() TODO document
Set<String>	getProtectedPages() TODO document
TokenHolder	getTokenHolder() TODO document
int	getTokenLength() TODO document
String	getTokenName() TODO document
Set<String>	getUnprotectedMethods() if there are methods here, then all other HTTP methods are protected and these (e.g.
Set<String>	getUnprotectedPages() TODO document
boolean	isAjaxEnabled() TODO document
boolean	isCacheable() TODO document
boolean	isEnabled() if the filter is enabled
boolean	isForceSynchronousAjax() TODO document
boolean	isJavascriptDomainStrict() TODO document
boolean	isJavascriptInjectFormAttributes() if the token should be injected in the action in forms note, if injectIntoForms is true, then this might not need to be true
boolean	isJavascriptInjectGetForms() if the token should be injected in GET forms (which will be on the URL) if the HTTP method GET is unprotected, then this should likely be false
boolean	isJavascriptInjectIntoAttributes() TODO document
boolean	isJavascriptInjectIntoDynamicallyCreatedNodes() TODO
boolean	isJavascriptInjectIntoForms() TODO document
boolean	isJavascriptRefererMatchDomain() if the referer to the javascript must match domain
boolean	isJavascriptRefererMatchProtocol() if the referer to the javascript must match match the protocol of the domain
boolean	isPrintConfig() TODO document
boolean	isProtectEnabled() The default behavior of CSRFGuard is to protect all pages.
boolean	isRotateEnabled() TODO document
boolean	isTokenPerPageEnabled() TODO document
boolean	isTokenPerPagePrecreateEnabled() TODO document
boolean	isUseNewTokenLandingPage() TODO document
boolean	isValidateWhenNoSessionExists() If csrf guard filter should check even if there is no session for the user Note: this changed around 2014/04, the default behavior used to be to not check if there is no session.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

PropertiesConfigurationProvider

public PropertiesConfigurationProvider(Properties properties)

Method Detail

getLogger

public ILogger getLogger()

Description copied from interface: ConfigurationProvider

TODO document

Specified by:

getLogger in interface ConfigurationProvider

Returns:

getTokenName

public String getTokenName()

Description copied from interface: ConfigurationProvider

TODO document

Specified by:

getTokenName in interface ConfigurationProvider

Returns:

getTokenLength

public int getTokenLength()

Description copied from interface: ConfigurationProvider

TODO document

Specified by:

getTokenLength in interface ConfigurationProvider

Returns:

isRotateEnabled

public boolean isRotateEnabled()

Description copied from interface: ConfigurationProvider

TODO document

Specified by:

isRotateEnabled in interface ConfigurationProvider

Returns:

isValidateWhenNoSessionExists

public boolean isValidateWhenNoSessionExists()

Description copied from interface: ConfigurationProvider

If csrf guard filter should check even if there is no session for the user Note: this changed around 2014/04, the default behavior used to be to not check if there is no session. If you want the legacy behavior (if your app is not susceptible to CSRF if the user has no session), set this to false

Specified by:

isValidateWhenNoSessionExists in interface ConfigurationProvider

Returns:

true when validation is performed even when no session exists

isTokenPerPageEnabled

public boolean isTokenPerPageEnabled()

Description copied from interface: ConfigurationProvider

TODO document

Specified by:

isTokenPerPageEnabled in interface ConfigurationProvider

Returns:

isTokenPerPagePrecreateEnabled

public boolean isTokenPerPagePrecreateEnabled()

Description copied from interface: ConfigurationProvider

TODO document

Specified by:

isTokenPerPagePrecreateEnabled in interface ConfigurationProvider

Returns:

getPrng

public SecureRandom getPrng()

Description copied from interface: ConfigurationProvider

TODO document

Specified by:

getPrng in interface ConfigurationProvider

Returns:

getNewTokenLandingPage

public String getNewTokenLandingPage()

Description copied from interface: ConfigurationProvider

TODO document

Specified by:

getNewTokenLandingPage in interface ConfigurationProvider

Returns:

isUseNewTokenLandingPage

public boolean isUseNewTokenLandingPage()

Description copied from interface: ConfigurationProvider

TODO document

Specified by:

isUseNewTokenLandingPage in interface ConfigurationProvider

Returns:

isAjaxEnabled

public boolean isAjaxEnabled()

Description copied from interface: ConfigurationProvider

TODO document

Specified by:

isAjaxEnabled in interface ConfigurationProvider

Returns:

isProtectEnabled

public boolean isProtectEnabled()

Description copied from interface: ConfigurationProvider

The default behavior of CSRFGuard is to protect all pages. Pages marked as unprotected will not be protected.
If the Protect property is enabled, this behavior is reversed. Pages must be marked as protected to be protected. All other pages will not be protected. This is useful when the CsrfGuardFilter is aggressively mapped (ex: /*), but you only want to protect a few pages.

Specified by:

isProtectEnabled in interface ConfigurationProvider

Returns:

false if all pages are protected, true if pages are required to be explicit protected

isForceSynchronousAjax

public boolean isForceSynchronousAjax()

Description copied from interface: ConfigurationProvider

TODO document

Specified by:

isForceSynchronousAjax in interface ConfigurationProvider

Returns:

whether or not the legacy Synchronous AJAX requests are enabled

getProtectedPages

public Set<String> getProtectedPages()

Description copied from interface: ConfigurationProvider

TODO document

Specified by:

getProtectedPages in interface ConfigurationProvider

Returns:

getUnprotectedPages

public Set<String> getUnprotectedPages()

Description copied from interface: ConfigurationProvider

TODO document

Specified by:

getUnprotectedPages in interface ConfigurationProvider

Returns:

getProtectedMethods

public Set<String> getProtectedMethods()

Description copied from interface: ConfigurationProvider

TODO document

Specified by:

getProtectedMethods in interface ConfigurationProvider

Returns:

getUnprotectedMethods

public Set<String> getUnprotectedMethods()

Description copied from interface: ConfigurationProvider

if there are methods here, then all other HTTP methods are protected and these (e.g. GET) are unprotected

Specified by:

getUnprotectedMethods in interface ConfigurationProvider

Returns:

the unprotected methods

getActions

public List<IAction> getActions()

Description copied from interface: ConfigurationProvider

TODO document

Specified by:

getActions in interface ConfigurationProvider

Returns:

isPrintConfig

public boolean isPrintConfig()

Description copied from interface: ConfigurationProvider

TODO document

Specified by:

isPrintConfig in interface ConfigurationProvider

Returns:

getJavascriptSourceFile

public String getJavascriptSourceFile()

Description copied from interface: ConfigurationProvider

TODO document

Specified by:

getJavascriptSourceFile in interface ConfigurationProvider

Returns:

isJavascriptDomainStrict

public boolean isJavascriptDomainStrict()

Description copied from interface: ConfigurationProvider

TODO document

Specified by:

isJavascriptDomainStrict in interface ConfigurationProvider

Returns:

getJavascriptCacheControl

public String getJavascriptCacheControl()

Description copied from interface: ConfigurationProvider

TODO document

Specified by:

getJavascriptCacheControl in interface ConfigurationProvider

Returns:

getJavascriptRefererPattern

public Pattern getJavascriptRefererPattern()

Description copied from interface: ConfigurationProvider

TODO document

Specified by:

getJavascriptRefererPattern in interface ConfigurationProvider

Returns:

isJavascriptRefererMatchProtocol

public boolean isJavascriptRefererMatchProtocol()

Description copied from interface: ConfigurationProvider

if the referer to the javascript must match match the protocol of the domain

Specified by:

isJavascriptRefererMatchProtocol in interface ConfigurationProvider

Returns:

true if the javascript must match the protocol of the domain

isJavascriptRefererMatchDomain

public boolean isJavascriptRefererMatchDomain()

Description copied from interface: ConfigurationProvider

if the referer to the javascript must match domain

Specified by:

isJavascriptRefererMatchDomain in interface ConfigurationProvider

Returns:

true if the javascript must match domain

isJavascriptInjectIntoForms

public boolean isJavascriptInjectIntoForms()

Description copied from interface: ConfigurationProvider

TODO document

Specified by:

isJavascriptInjectIntoForms in interface ConfigurationProvider

Returns:

isJavascriptInjectIntoAttributes

public boolean isJavascriptInjectIntoAttributes()

Description copied from interface: ConfigurationProvider

TODO document

Specified by:

isJavascriptInjectIntoAttributes in interface ConfigurationProvider

Returns:

isJavascriptInjectIntoDynamicallyCreatedNodes

public boolean isJavascriptInjectIntoDynamicallyCreatedNodes()

Description copied from interface: ConfigurationProvider

TODO

Specified by:

isJavascriptInjectIntoDynamicallyCreatedNodes in interface ConfigurationProvider

Returns:

getJavascriptDynamicNodeCreationEventName

public String getJavascriptDynamicNodeCreationEventName()

Description copied from interface: ConfigurationProvider

TODO

Specified by:

getJavascriptDynamicNodeCreationEventName in interface ConfigurationProvider

Returns:

getJavascriptXrequestedWith

public String getJavascriptXrequestedWith()

Description copied from interface: ConfigurationProvider

TODO document

Specified by:

getJavascriptXrequestedWith in interface ConfigurationProvider

Returns:

getJavascriptTemplateCode

public String getJavascriptTemplateCode()

Description copied from interface: ConfigurationProvider

TODO document

Specified by:

getJavascriptTemplateCode in interface ConfigurationProvider

Returns:

isCacheable

public boolean isCacheable()

Description copied from interface: ConfigurationProvider

TODO document

Specified by:

isCacheable in interface ConfigurationProvider

Returns:

true when this configuration provider can be cached for a minute, i.e. it is all setup

isEnabled

public boolean isEnabled()

Description copied from interface: ConfigurationProvider

if the filter is enabled

Specified by:

isEnabled in interface ConfigurationProvider

Returns:

is csrf guard filter is enabled

isJavascriptInjectGetForms

public boolean isJavascriptInjectGetForms()

Description copied from interface: ConfigurationProvider

if the token should be injected in GET forms (which will be on the URL) if the HTTP method GET is unprotected, then this should likely be false

Specified by:

isJavascriptInjectGetForms in interface ConfigurationProvider

Returns:

true if the token should be injected in GET forms via Javascript

isJavascriptInjectFormAttributes

public boolean isJavascriptInjectFormAttributes()

Description copied from interface: ConfigurationProvider

if the token should be injected in the action in forms note, if injectIntoForms is true, then this might not need to be true

Specified by:

isJavascriptInjectFormAttributes in interface ConfigurationProvider

Returns:

if inject

getDomainOrigin

public String getDomainOrigin()

Description copied from interface: ConfigurationProvider

TODO document

Specified by:

getDomainOrigin in interface ConfigurationProvider

Returns:

getJavascriptUnprotectedExtensions

public String getJavascriptUnprotectedExtensions()

Description copied from interface: ConfigurationProvider

TODO document example: "js,css,gif,png,ico,jpg"

Specified by:

getJavascriptUnprotectedExtensions in interface ConfigurationProvider

Returns:

getTokenHolder

public TokenHolder getTokenHolder()

Description copied from interface: ConfigurationProvider

TODO document

Specified by:

getTokenHolder in interface ConfigurationProvider

Returns:

getLogicalSessionExtractor

public LogicalSessionExtractor getLogicalSessionExtractor()

Description copied from interface: ConfigurationProvider

TODO document

Specified by:

getLogicalSessionExtractor in interface ConfigurationProvider

Returns:

getPageTokenSynchronizationTolerance

public Duration getPageTokenSynchronizationTolerance()

Description copied from interface: ConfigurationProvider

TODO document

Specified by:

getPageTokenSynchronizationTolerance in interface ConfigurationProvider

Returns: