Examples with DefaultCsrfToken org.springframework.security.web.csrf.DefaultCsrfToken used on opensource projects

Example 11 with DefaultCsrfToken

use of org.springframework.security.web.csrf.DefaultCsrfToken in project spring-security by spring-projects.

the class CsrfChannelInterceptorTests method setup.

@BeforeEach
public void setup() {
    this.token = new DefaultCsrfToken("header", "param", "token");
    this.interceptor = new CsrfChannelInterceptor();
    this.messageHeaders = SimpMessageHeaderAccessor.create(SimpMessageType.CONNECT);
    this.messageHeaders.setNativeHeader(this.token.getHeaderName(), this.token.getToken());
    this.messageHeaders.setSessionAttributes(new HashMap<>());
    this.messageHeaders.getSessionAttributes().put(CsrfToken.class.getName(), this.token);
}

Example 12 with DefaultCsrfToken

use of org.springframework.security.web.csrf.DefaultCsrfToken in project spring-security-oauth by spring-projects.

the class WhitelabelApprovalEndpointTests method testApprovalPageWithCsrf.

@Test
public void testApprovalPageWithCsrf() throws Exception {
    request.setContextPath("/foo");
    request.setAttribute("_csrf", new DefaultCsrfToken("X-CSRF-TOKEN", "_csrf", "FOO"));
    parameters.put("client_id", "client");
    HashMap<String, Object> model = new HashMap<String, Object>();
    model.put("authorizationRequest", createFromParameters(parameters));
    ModelAndView result = endpoint.getAccessConfirmation(model, request);
    result.getView().render(result.getModel(), request, response);
    String content = response.getContentAsString();
    assertTrue("Wrong content: " + content, content.contains("_csrf"));
    assertTrue("Wrong content: " + content, content.contains("/foo/oauth/authorize"));
    assertTrue("Wrong content: " + content, !content.contains("${"));
}

Example 13 with DefaultCsrfToken

use of org.springframework.security.web.csrf.DefaultCsrfToken in project tutorials by eugenp.

the class JWTCsrfTokenRepository method generateToken.

@Override
public CsrfToken generateToken(HttpServletRequest request) {
    String id = UUID.randomUUID().toString().replace("-", "");
    Date now = new Date();
    // 30 seconds
    Date exp = new Date(System.currentTimeMillis() + (1000 * 30));
    String token = Jwts.builder().setId(id).setIssuedAt(now).setNotBefore(now).setExpiration(exp).signWith(SignatureAlgorithm.HS256, secret).compact();
    return new DefaultCsrfToken("X-CSRF-TOKEN", "_csrf", token);
}

Example 14 with DefaultCsrfToken

use of org.springframework.security.web.csrf.DefaultCsrfToken in project spring-security by spring-projects.

the class DefaultFiltersTests method defaultFiltersPermitAll.

@Test
public void defaultFiltersPermitAll() throws IOException, ServletException {
    this.spring.register(DefaultFiltersConfigPermitAll.class, UserDetailsServiceConfig.class);
    MockHttpServletResponse response = new MockHttpServletResponse();
    MockHttpServletRequest request = new MockHttpServletRequest("POST", "");
    request.setServletPath("/logout");
    CsrfToken csrfToken = new DefaultCsrfToken("X-CSRF-TOKEN", "_csrf", "BaseSpringSpec_CSRFTOKEN");
    new HttpSessionCsrfTokenRepository().saveToken(csrfToken, request, response);
    request.setParameter(csrfToken.getParameterName(), csrfToken.getToken());
    this.spring.getContext().getBean("springSecurityFilterChain", Filter.class).doFilter(request, response, new MockFilterChain());
    assertThat(response.getRedirectedUrl()).isEqualTo("/login?logout");
}

Example 15 with DefaultCsrfToken

use of org.springframework.security.web.csrf.DefaultCsrfToken in project spring-security by spring-projects.

the class WebMvcSecurityConfigurationTests method csrfToken.

@Test
public void csrfToken() throws Exception {
    CsrfToken csrfToken = new DefaultCsrfToken("headerName", "paramName", "token");
    MockHttpServletRequestBuilder request = get("/csrf").requestAttr(CsrfToken.class.getName(), csrfToken);
    this.mockMvc.perform(request).andExpect(assertResult(csrfToken));
}