Examples with CSRF_COOKIE_NAVN no.nav.sbl.rest.RestUtils.CSRF_COOKIE_NAVN used on opensource projects

Example 1 with CSRF_COOKIE_NAVN

use of no.nav.sbl.rest.RestUtils.CSRF_COOKIE_NAVN in project common-java-modules by navikt.

the class CsrfDoubleSubmitCookieFilter method doFilter.

@Override
public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException, ServletException {
    HttpServletRequest request = (HttpServletRequest) servletRequest;
    HttpServletResponse response = (HttpServletResponse) servletResponse;
    String path = request.getRequestURI().substring(request.getContextPath().length());
    if (stream(ignoredUrls).noneMatch(path::startsWith)) {
        if (ALLOWED_METHODS.contains(request.getMethod())) {
            if (request.getCookies() == null || stream(request.getCookies()).noneMatch(cookie -> cookie.getName().equals(CSRF_COOKIE_NAVN))) {
                response.addCookie(createCsrfProtectionCookie(request));
            }
        } else if (!cookieMatcherHeader(request)) {
            LOG.warn("Feil i CSRF-sjekk. " + "Bruker du dette filteret må du i frontend sørge for å sende med NAV_CSRF_PROTECTION-cookien som en header med navn NAV_CSRF_PROTECTION og verdien til cookien. " + "Er headeren satt? " + isNotBlank(request.getHeader(CSRF_COOKIE_NAVN)));
            response.sendError(SC_UNAUTHORIZED, "Mangler NAV_CSRF_PROTECTION-cookie!! Du må inkludere cookie-verdien i en header med navn NAV_CSRF_PROTECTION");
            return;
        }
    }
    filterChain.doFilter(request, response);
}