title: what is the usage of the SessionStore in the isAuthorized method in pac4j 5.3.1
body: <p>I'm getting <strong>403 forbidden</strong> error for the external requests.
  And found the authorization is failing from the <strong>isAuthorized</strong> method inside the  <strong>CsrfAuthorizer.class</strong> which is derived from pac4j.</p>
  <p>And I compared the pack4j version 4.3.1, the isAuthorized method is pretty much different in the 4.3.1.
  Here is the two methods in the different versions.</p>
  <p>VERSION 4.3.1</p>
  <pre><code>     boolean checkRequest = this.checkAllRequests || ContextHelper.isPost(context) || ContextHelper.isPut(context) || ContextHelper.isPatch(context) || ContextHelper.isDelete(context);
       if (!checkRequest) {
           return true;
       } else {
           String parameterToken = (String)context.getRequestParameter(this.parameterName).orElse((Object)null);
           String headerToken = (String)context.getRequestHeader(this.headerName).orElse((Object)null);
           Optional&lt;String&gt; sessionToken = context.getSessionStore().get(context, &quot;pac4jCsrfToken&quot;);
           return sessionToken.isPresent() &amp;&amp; (((String)sessionToken.get()).equals(parameterToken) || ((String)sessionToken.get()).equals(headerToken));
       }
   }
   
  -------------------------------------------------------------------------------------------------------------------------------------------------------------------------
   
  VERSION 5.3.1
   
       public boolean isAuthorized(final WebContext context, final SessionStore sessionStore, final List&lt;UserProfile&gt; profiles) {
       final var checkRequest = checkAllRequests || isPost(context) || isPut(context) || isPatch(context) || isDelete(context);
       if (checkRequest) {
           final var parameterToken = context.getRequestParameter(parameterName).orElse(null);
           final var headerToken = context.getRequestHeader(headerName).orElse(null);
           LOGGER.debug(&quot;parameterToken: {}&quot;, parameterToken);
           LOGGER.debug(&quot;headerToken: {}&quot;, headerToken);
           final var sessionPreviousToken = sessionStore.get(context, Pac4jConstants.PREVIOUS_CSRF_TOKEN);
           final var sessionToken = sessionStore.get(context, Pac4jConstants.CSRF_TOKEN);
           final var sessionDate = sessionStore.get(context, Pac4jConstants.CSRF_TOKEN_EXPIRATION_DATE);
           if (sessionStore.getSessionId(context, false).isPresent()) {
               sessionStore.set(context, Pac4jConstants.PREVIOUS_CSRF_TOKEN, null);
           }
           // all checks are always performed, conditional operations are turned into logical ones,
           // string comparisons are replaced by hash equalities to be protected against time-based attacks
           final var hasSessionData = sessionToken.isPresent() &amp; sessionDate.isPresent();
           final var previousToken = (String) sessionPreviousToken.orElse(&quot;&quot;);
           LOGGER.debug(&quot;previous token: {}&quot;, previousToken);
           final var token = (String) sessionToken.orElse(&quot;&quot;);
           LOGGER.debug(&quot;token: {}&quot;, token);
           final var isGoodCurrentToken = hashEquals(token, parameterToken) | hashEquals(token, headerToken);
           final var isGoodPreviousToken = hashEquals(previousToken, parameterToken) | hashEquals(previousToken, headerToken);
           final var isGoodToken = isGoodCurrentToken | isGoodPreviousToken;
           final var expirationDate = (Long) sessionDate.orElse(0L);
           final var now = new Date().getTime();
           final var isDateExpired = expirationDate &lt; now;
           if (!hasSessionData | !isGoodToken | isDateExpired) {
               return false;
           }
  
       }
       return true;
   }
  --------------------------------------------------------------------------------
           final var isGoodCurrentToken = hashEquals(token, parameterToken) | hashEquals(token, headerToken);
           final var isGoodPreviousToken = hashEquals(previousToken, parameterToken) | hashEquals(previousToken, headerToken);
           final var isGoodToken = isGoodCurrentToken | isGoodPreviousToken;
           final var expirationDate = (Long) sessionDate.orElse(0L);
           final var now = new Date().getTime();
           final var isDateExpired = expirationDate &lt; now;
           if (!hasSessionData | !isGoodToken | isDateExpired) {
               return false;
           }
  
  All of above are false.
  So then it returns false always.
  
  Does anyone has a clear idea about the usage of this?
  
  
  
  </code></pre>