AmbariCsrfProtectionFilter implements ContainerRequestFilter { @Override public ContainerRequest filter(ContainerRequest containerRequest) { if (!IGNORED_METHODS.contains(containerRequest.getMethod()) && !containerRequest.getRequestHeaders().containsKey(CSRF_HEADER)) { throw new WebApplicationException(Response.status(Response.Status.BAD_REQUEST).entity( JSON_SERIALIZER.serializeError(new ResultStatus(ResultStatus.STATUS.BAD_REQUEST, ERROR_MESSAGE)) ).type(MediaType.TEXT_PLAIN_TYPE).build()); } return containerRequest; }  @Override ContainerRequest filter(ContainerRequest containerRequest);  }
@Test public void testGetMethod() { AmbariCsrfProtectionFilter filter = new AmbariCsrfProtectionFilter(); ContainerRequest containerRequest = createMock(ContainerRequest.class); expect(containerRequest.getMethod()).andReturn("GET"); replay(containerRequest); assertEquals(containerRequest, filter.filter(containerRequest)); }
@Test(expected = WebApplicationException.class) public void testPostNoXRequestedBy() { AmbariCsrfProtectionFilter filter = new AmbariCsrfProtectionFilter(); ContainerRequest containerRequest = createMock(ContainerRequest.class); InBoundHeaders headers = new InBoundHeaders(); expect(containerRequest.getMethod()).andReturn("POST"); expect(containerRequest.getRequestHeaders()).andReturn(headers); replay(containerRequest); filter.filter(containerRequest); }
@Test public void testPostXRequestedBy() { AmbariCsrfProtectionFilter filter = new AmbariCsrfProtectionFilter(); ContainerRequest containerRequest = createMock(ContainerRequest.class); InBoundHeaders headers = new InBoundHeaders(); headers.add("X-Requested-By","anything"); expect(containerRequest.getMethod()).andReturn("GET"); expect(containerRequest.getRequestHeaders()).andReturn(headers); replay(containerRequest); assertEquals(containerRequest, filter.filter(containerRequest)); }