CsrfProtectionMatcher implements RequestMatcher { @Override public boolean matches(HttpServletRequest request) { String servletPath = request.getServletPath(); return servletPath.startsWith("/internal") && !servletPath.equalsIgnoreCase("/internal/jsError") && !isTrustedApiRequest(request) && !allowedMethods.matcher(request.getMethod().toUpperCase()).matches(); }  @Override boolean matches(HttpServletRequest request);  }
@Test public void testMatches() throws Exception { assertTrue(subject.matches(getMockHttpServletRequest("PUT", "/internal"))); assertTrue(subject.matches(getMockHttpServletRequest("ANY_OTHER", "/internal"))); assertTrue(subject.matches(getMockHttpServletRequest("ANY_OTHER", "/internal", X_IDP_ENTITY_ID, X_UNSPECIFIED_NAME_ID))); assertFalse(subject.matches(getMockHttpServletRequest("PUT", "/internal", X_IDP_ENTITY_ID, X_UNSPECIFIED_NAME_ID, X_DISPLAY_NAME))); assertFalse(subject.matches(getMockHttpServletRequest("ANY_OTHER", "/internal", X_IDP_ENTITY_ID, X_UNSPECIFIED_NAME_ID, X_DISPLAY_NAME))); assertFalse(subject.matches(getMockHttpServletRequest("GET", "/internal"))); assertFalse(subject.matches(getMockHttpServletRequest("POST", "/internal/jsError"))); assertFalse(subject.matches(getMockHttpServletRequest("HEAD", "/internal"))); assertFalse(subject.matches(getMockHttpServletRequest("TRACE", "/internal"))); assertFalse(subject.matches(getMockHttpServletRequest("OPTIONS", "/internal"))); assertFalse(subject.matches(getMockHttpServletRequest("ANY_OTHER", "/not-internal"))); }