CSRFHandler implements RequestResponseHandler { @Override public void handle(HttpServletRequest request, HttpServletResponse response, HandlerChain chain) throws Exception { if (request.getMethod().equals("GET")) { verifyTokenAbsence(request, response); } else { verifyToken(request, response); } chain.next(request, response); } CSRFHandler(String tokenRequestParameterName);  CSRFHandler(String tokenRequestParameterName, String tokenRequestHeaderName); static String getSavedToken(HttpServletRequest request, HttpServletResponse response); static String getSavedToken(HttpServletRequest request, HttpServletResponse response, boolean createTokenIfMissing); @Override void handle(HttpServletRequest request, HttpServletResponse response, HandlerChain chain); static final String CSRF_COOKIE_NAME; }
@Test public void testGetRequestWithNoCsrfTokenPresent() throws Exception { when(request.getMethod()).thenReturn("GET"); when(request.getCookies()).thenReturn(new Cookie[]{generateTokenCookie()}); handler.handle(request, response, chain); verify(chain).next(request, response); }
@Test public void testGetRequestWithCsrfPresent() throws Exception { Cookie token = generateTokenCookie(); when(request.getMethod()).thenReturn("GET"); when(request.getCookies()).thenReturn(new Cookie[]{token}); when(request.getParameter(TOKEN_PARAM)).thenReturn(token.getValue()); try { handler.handle(request, response, chain); fail("Expected " + CSRFHandler.TokenException.class.getName()); } catch (CSRFHandler.TokenException ex) { } verify(chain, never()).next(request, response); verify(response).addCookie(argThat(new CookieMatcher(token, false))); }
@Test public void testPostRequestWithNoCsrfTokenInRequest() throws Exception { Cookie token = generateTokenCookie(); when(request.getMethod()).thenReturn("POST"); when(request.getCookies()).thenReturn(new Cookie[]{token}); when(request.getParameter(TOKEN_PARAM)).thenReturn(null); try { handler.handle(request, response, chain); fail("Expected " + CSRFHandler.TokenException.class.getName()); } catch (CSRFHandler.TokenException ex) { } verify(chain, never()).next(request, response); }
@Test public void testPostRequestWithNoCsrfTokenInSession() throws Exception { Cookie token = generateTokenCookie(); when(request.getMethod()).thenReturn("POST"); when(request.getCookies()).thenReturn(null); when(request.getParameter(TOKEN_PARAM)).thenReturn(token.getValue()); try { handler.handle(request, response, chain); fail("Expected " + CSRFHandler.TokenException.class.getName()); } catch (CSRFHandler.TokenException ex) { } verify(chain, never()).next(request, response); }
@Test public void testPostRequestWithNoCsrfTokenInSessionOrRequest() throws Exception { when(request.getMethod()).thenReturn("POST"); when(request.getCookies()).thenReturn(null); when(request.getParameter(TOKEN_PARAM)).thenReturn(null); try { handler.handle(request, response, chain); fail("Expected " + CSRFHandler.TokenException.class.getName()); } catch (CSRFHandler.TokenException ex) { } verify(chain, never()).next(request, response); }
@Test public void testPostRequestWithNonMatchingCsrfTokens() throws Exception { Cookie token = generateTokenCookie(); when(request.getMethod()).thenReturn("POST"); when(request.getCookies()).thenReturn(new Cookie[]{token}); when(request.getParameter(TOKEN_PARAM)).thenReturn(token.getValue() + "a"); try { handler.handle(request, response, chain); fail("Expected " + CSRFHandler.TokenException.class.getName()); } catch (CSRFHandler.TokenException ex) { } verify(chain, never()).next(request, response); }
@Test public void testPostRequestWithMatchingCsrfTokensInParameter() throws Exception { Cookie token = generateTokenCookie(); when(request.getMethod()).thenReturn("POST"); when(request.getCookies()).thenReturn(new Cookie[]{token}); when(request.getHeader(TOKEN_HEADER)).thenReturn(token.getValue() + "a"); when(request.getParameter(TOKEN_PARAM)).thenReturn(token.getValue()); handler.handle(request, response, chain); verify(chain).next(request, response); }
@Test public void testPostRequestWithMatchingCsrfTokensInHeader() throws Exception { Cookie token = generateTokenCookie(); when(request.getMethod()).thenReturn("POST"); when(request.getCookies()).thenReturn(new Cookie[]{token}); when(request.getParameter(TOKEN_PARAM)).thenReturn(null); when(request.getHeader(TOKEN_HEADER)).thenReturn(token.getValue()); handler.handle(request, response, chain); verify(chain).next(request, response); }