Examples with SessionCookie keywhiz.auth.cookie.SessionCookie used on opensource projects

Example 1 with SessionCookie

use of keywhiz.auth.cookie.SessionCookie in project keywhiz by square.

the class XsrfServletFilter method doFilter.

@Override
public void doFilter(ServletRequest servletRequest, ServletResponse response, FilterChain chain) throws IOException, ServletException {
    HttpServletRequest request = (HttpServletRequest) servletRequest;
    // Exclude certain paths.
    if (EXCLUDED_PATHS.contains(request.getRequestURI())) {
        chain.doFilter(servletRequest, response);
        return;
    }
    String xsrfHeader = request.getHeader(xsrfHeaderName);
    String sessionCookie = null;
    Cookie[] cookies = request.getCookies();
    if (cookies != null) {
        for (Cookie cookie : cookies) {
            if (cookie.getName().equals(sessionCookieName)) {
                sessionCookie = cookie.getValue();
            }
        }
    }
    if (isNullOrEmpty(xsrfHeader)) {
        logger.info("Request missing {} header", xsrfHeaderName);
        ((HttpServletResponse) response).sendError(HttpServletResponse.SC_UNAUTHORIZED);
        return;
    }
    if (isNullOrEmpty(sessionCookie)) {
        logger.info("Request missing {} cookie", sessionCookieName);
        ((HttpServletResponse) response).sendError(HttpServletResponse.SC_UNAUTHORIZED);
        return;
    }
    if (!XsrfProtection.isValid(xsrfHeader, sessionCookie)) {
        logger.warn("Invalid {} header in request: {}", xsrfHeaderName, xsrfHeader);
        ((HttpServletResponse) response).sendError(HttpServletResponse.SC_UNAUTHORIZED);
        return;
    }
    chain.doFilter(servletRequest, response);
}