CsrfFilter implements Filter { @Override public FilterResult doFilter(HttpRequest request, Configuration configuration) { if (request.isGetRequest()) { return FilterResult.success(); } for (UriPatten uriPatten : configuration.getCsrfIgnoreUris()) { if (uriPatten.matches(request.getUriWithoutContextPath())) { return FilterResult.success(); } } Object formPostCsrfToken = request.getFormParams().get(HttpRequest.COOKIE_CSRFTOKEN); if (formPostCsrfToken == null || !(formPostCsrfToken instanceof String) || ((String) formPostCsrfToken).isEmpty()) { String error = createCsrfErrorMessage("Couldn't find the CSRF token in form params."); LOGGER.warn("{} - {form param token: {}, request: {}}", error, formPostCsrfToken, request); return FilterResult.error(STATUS_FORBIDDEN, error); } String cookieCsrfToken = request.getCookieValue(HttpRequest.COOKIE_CSRFTOKEN); if (cookieCsrfToken == null || cookieCsrfToken.isEmpty()) { String error = createCsrfErrorMessage("Couldn't find the CSRF token in cookie."); LOGGER.warn("{} - {cookie token: {}, form param token: {}, request: {}}", error, cookieCsrfToken, formPostCsrfToken, request); return FilterResult.error(STATUS_FORBIDDEN, error); } if ((!formPostCsrfToken.equals(cookieCsrfToken))) { String error = createCsrfErrorMessage("CSRF token values in form params and cookie do not match."); LOGGER.warn("{} - {cookie token: {}, form param token: {}, request: {}}", error, cookieCsrfToken, formPostCsrfToken, request); return FilterResult.error(STATUS_FORBIDDEN, error); } return FilterResult.success(); }  @Override FilterResult doFilter(HttpRequest request, Configuration configuration);  }
@Test(dataProvider = "requestData") public void testFiltering(HttpRequest request, boolean assertion) { Configuration configuration = createConfiguration(); CsrfFilter csrfFilter = new CsrfFilter(); FilterResult result = csrfFilter.doFilter(request, configuration); Assert.assertEquals(result.isContinue(), assertion); }