CsrfProtectionFilter implements ContainerRequestFilter { @Override public void filter(final ContainerRequestContext request) { if (METHODS_TO_IGNORE.contains(request.getMethod())) { return; } if (request.getHeaders().containsKey(HEADER)) { return; } throw new NoCSRFHeaderException(); }  @Override void filter(final ContainerRequestContext request);  }
@Test public void assertIgnoresBasicMethods() { CsrfProtectionFilter filter = new CsrfProtectionFilter(); Sets.newHashSet("GET", "OPTIONS", "HEAD") .forEach((method) -> { doReturn(method).when(mockContext).getMethod(); filter.filter(mockContext); }); }
@Test(expected = NoCSRFHeaderException.class) public void assertFailsWithoutHeader() { CsrfProtectionFilter filter = new CsrfProtectionFilter(); doReturn("POST").when(mockContext).getMethod(); MultivaluedStringMap map = new MultivaluedStringMap(); doReturn(map).when(mockContext).getHeaders(); filter.filter(mockContext); }
@Test public void assertPassesWithHeader() { CsrfProtectionFilter filter = new CsrfProtectionFilter(); doReturn("POST").when(mockContext).getMethod(); MultivaluedStringMap map = new MultivaluedStringMap(); map.putSingle("X-Requested-With", "Test"); doReturn(map).when(mockContext).getHeaders(); filter.filter(mockContext); }