Package rife.engine.elements

Class CsrfProtected

java.lang.Object
rife.engine.elements.CsrfProtected
All Implemented Interfaces:
Element
public class CsrfProtected extends Object implements Element
Verifies the CSRF token of the requests that change state, so that other sites can't perform them on behalf of your users.

You add this element before the routes that should be protected, just like any other element: 

public class MySite extends Site {
     public void setup() {
         before(new CsrfProtected());
         post("/transfer", c -> { ... });
     }
 }

The state-changing request methods POST, PUT, PATCH and DELETE will be verified, while the ones that only read aren't, since they establish the token instead. On a page whose token was established this way, the route:inputs: filtered tag will include the token in the forms that it generates, while the context:csrfToken template value provides the token on its own for the requests that JavaScript performs.

A request that doesn't provide a valid token will be refused, which means that the refused(rife.engine.Context, rife.engine.exceptions.CsrfTokenException) hook produces the response and that the processing stops before the protected route runs. By default this sends 403 Forbidden with a short message, but you can override the hook to tailor the response, for instance to render a template or to redirect to a page that reloads: 

before(new CsrfProtected() {
     protected void refused(Context c, CsrfTokenException e) {
         c.setStatus(Context.SC_FORBIDDEN);
         c.print(c.template("reload"));
     }
 });
Since:
1.10
See Also:

  • Field Details

    • DEFAULT_PROTECTED_METHODS

      public static final Set<RequestMethod> DEFAULT_PROTECTED_METHODS
      The state-changing request methods that are verified by default, which are POST, PUT, PATCH and DELETE.
      Since:
      1.10
      See Also:

  • Constructor Details

    • CsrfProtected

      public CsrfProtected()
      Creates a new instance that verifies the state-changing request methods.
      Since:
      1.10
      See Also:

    • CsrfProtected

      public CsrfProtected(Set<RequestMethod> protectedMethods)
      Creates a new instance that verifies the provided request methods.

      The methods that aren't provided will not be verified, since they only establish the token. If you want to protect GET as well, for instance: 

      new CsrfProtected(EnumSet.of(RequestMethod.GET, RequestMethod.POST))
      Parameters:
      protectedMethods - the request methods that are verified
      Since:
      1.10
      See Also:

  • Method Details

    • process

      public void process(Context c)
      Description copied from interface: Element
      Process the provided Context with this element.
      Specified by:
      process in interface Element
      Parameters:
      c - the provided request/response context

    • refused

      protected void refused(Context c, CsrfTokenException e)
      Provides the response for a request whose token couldn't be verified, called before the protected route runs.

      This sends 403 Forbidden with a short message by default. You can override this method to tailor the response and the element will stop the processing afterwards, so that the protected route is never reached. A hook that interrupts the processing itself, by calling redirect or respond, is equally fine.

      Parameters:
      c - the context of the refused request
      e - the exception that describes why the token was refused, either CsrfTokenMissingException or CsrfTokenInvalidException
      Since:
      1.10