Examples with CsrfFilter org.springframework.security.web.csrf.CsrfFilter used on opensource projects

Example 1 with CsrfFilter

use of org.springframework.security.web.csrf.CsrfFilter in project spring-security by spring-projects.

the class WebTestUtilsTests method findFilterNoSpringSecurityFilterChainInContext.

@Test
public void findFilterNoSpringSecurityFilterChainInContext() {
    loadConfig(NoSecurityConfig.class);
    CsrfFilter toFind = new CsrfFilter(new HttpSessionCsrfTokenRepository());
    FilterChainProxy springSecurityFilterChain = new FilterChainProxy(new DefaultSecurityFilterChain(AnyRequestMatcher.INSTANCE, toFind));
    this.request.getServletContext().setAttribute(BeanIds.SPRING_SECURITY_FILTER_CHAIN, springSecurityFilterChain);
    assertThat(WebTestUtils.findFilter(this.request, toFind.getClass())).isEqualTo(toFind);
}

Example 2 with CsrfFilter

use of org.springframework.security.web.csrf.CsrfFilter in project spring-security by spring-projects.

the class CsrfConfigurer method configure.

@SuppressWarnings("unchecked")
@Override
public void configure(H http) throws Exception {
    CsrfFilter filter = new CsrfFilter(this.csrfTokenRepository);
    RequestMatcher requireCsrfProtectionMatcher = getRequireCsrfProtectionMatcher();
    if (requireCsrfProtectionMatcher != null) {
        filter.setRequireCsrfProtectionMatcher(requireCsrfProtectionMatcher);
    }
    AccessDeniedHandler accessDeniedHandler = createAccessDeniedHandler(http);
    if (accessDeniedHandler != null) {
        filter.setAccessDeniedHandler(accessDeniedHandler);
    }
    LogoutConfigurer<H> logoutConfigurer = http.getConfigurer(LogoutConfigurer.class);
    if (logoutConfigurer != null) {
        logoutConfigurer.addLogoutHandler(new CsrfLogoutHandler(this.csrfTokenRepository));
    }
    SessionManagementConfigurer<H> sessionConfigurer = http.getConfigurer(SessionManagementConfigurer.class);
    if (sessionConfigurer != null) {
        sessionConfigurer.addSessionAuthenticationStrategy(new CsrfAuthenticationStrategy(this.csrfTokenRepository));
    }
    filter = postProcess(filter);
    http.addFilter(filter);
}

Example 3 with CsrfFilter

use of org.springframework.security.web.csrf.CsrfFilter in project spring-security by spring-projects.

the class WebTestUtilsTests method findFilterExplicitWithSecurityFilterInContext.

@Test
public void findFilterExplicitWithSecurityFilterInContext() {
    loadConfig(SecurityConfigWithDefaults.class);
    CsrfFilter toFind = new CsrfFilter(new HttpSessionCsrfTokenRepository());
    FilterChainProxy springSecurityFilterChain = new FilterChainProxy(new DefaultSecurityFilterChain(AnyRequestMatcher.INSTANCE, toFind));
    this.request.getServletContext().setAttribute(BeanIds.SPRING_SECURITY_FILTER_CHAIN, springSecurityFilterChain);
    assertThat(WebTestUtils.findFilter(this.request, toFind.getClass())).isSameAs(toFind);
}