Package net.shibboleth.idp.ui.csrf.impl

# Class CSRFTokenFlowExecutionListener

java.lang.Object
net.shibboleth.shared.component.AbstractInitializableComponent
net.shibboleth.idp.ui.csrf.impl.CSRFTokenFlowExecutionListener

All Implemented Interfaces:
  `Component`, `DestructableComponent`, `InitializableComponent`, `FlowExecutionListener`

public class CSRFTokenFlowExecutionListener extends AbstractInitializableComponent implements FlowExecutionListener
A flow execution lifecycle listener that, if enabled:

1. Sets an anti-CSRF token into the flow-scope map when a flow session starts and a token per-flow is enabled.
2. Sets an anti-CSRF token into the view-scope map when rendering a suitable view-state. This token is either retrieved from the flow-scope, if available from step 1, or generated anew.
3. Checks the CSRF token in a HTTP request matches that stored in the view-scope map when a suitable view-state event occurs.

## Field Summary

Fields
Modifier and Type
Field
Description
`static final String`
`CSRF_TOKEN_VIEWSCOPE_NAME`
The name of the view scope parameter that holds the CSRF token.
`private CSRFTokenManager`
`csrfTokenManager`
The CSRF token manager for getting and validating tokens.
`private boolean`
`enabled`
Is this listener enabled?
`private BiPredicate<RequestContext,Event>`
`eventRequiresCSRFTokenValidationPredicate`
Should the request context and event be checked for a valid (matching) CSRF token?
`private final org.slf4j.Logger`
`log`
Class logger.
`private boolean`
`tokenPerFlow`
Should a new token should be created for each flow session and not for each view?
`private Predicate<RequestContext>`
`viewRequiresCSRFTokenPredicate`
Does the view being rendered require a CSRF token to be set.

## Constructor Summary

Constructors
Constructor
Description
`CSRFTokenFlowExecutionListener()`
Constructor.

## Method Summary

Modifier and Type
Method
Description
`void`
`doInitialize()`
`void`
`eventSignaled(RequestContext context, Event event)`
Checks the CSRF token in the HTTP request matches that stored in the request context viewScope.
`void`
`sessionStarting(RequestContext context, FlowSession session, MutableAttributeMap<?> input)`
`void`
`setCsrfTokenManager(CSRFTokenManager tokenManager)`
Sets the CSRF token manager.
`void`
`setEnabled(boolean enable)`
Set whether CSRF protection is globally enabled or disabled.
`void`
`setEventRequiresCSRFTokenValidationPredicate(BiPredicate<RequestContext,Event> condition)`
Set the request context and event condition to determine if a CSRF token should be validated.
`void`
`setTokenPerFlow(boolean flag)`
Sets whether a new token should be created for each flow session and not for each view.
`void`
`setViewRequiresCSRFTokenPredicate(Predicate<RequestContext> condition)`
Sets the request context condition to determine if a CSRF token should be added to the view-scope.
`void`
`viewRendering(RequestContext context, View view, StateDefinition viewState)`
Generates a CSRF token and adds it to the request context view scope, overwriting any existing token.

### Methods inherited from class net.shibboleth.shared.component.AbstractInitializableComponent

`checkComponentActive, checkSetterPreconditions, destroy, doDestroy, ifDestroyedThrowDestroyedComponentException, ifInitializedThrowUnmodifiabledComponentException, ifNotInitializedThrowUninitializedComponentException, initialize, isDestroyed, isInitialized`

### Methods inherited from class java.lang.Object

`clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait`

### Methods inherited from interface org.springframework.webflow.execution.FlowExecutionListener

`exceptionThrown, paused, requestProcessed, requestSubmitted, resuming, sessionCreating, sessionEnded, sessionEnding, sessionStarted, stateEntered, stateEntering, transitionExecuting, viewRendered`

## Field Details

### CSRF_TOKEN_VIEWSCOPE_NAME

@Nonnull public static final String CSRF_TOKEN_VIEWSCOPE_NAME
The name of the view scope parameter that holds the CSRF token.

See Also:
  - Constant Field Values

### log

@Nonnull private final org.slf4j.Logger log
Class logger.

### eventRequiresCSRFTokenValidationPredicate

@NonnullAfterInit private BiPredicate<RequestContext,Event> eventRequiresCSRFTokenValidationPredicate
Should the request context and event be checked for a valid (matching) CSRF token?

### viewRequiresCSRFTokenPredicate

@NonnullAfterInit private Predicate<RequestContext> viewRequiresCSRFTokenPredicate
Does the view being rendered require a CSRF token to be set.

### enabled

private boolean enabled
Is this listener enabled?

### tokenPerFlow

private boolean tokenPerFlow
Should a new token should be created for each flow session and not for each view?

### csrfTokenManager

@NonnullAfterInit private CSRFTokenManager csrfTokenManager
The CSRF token manager for getting and validating tokens.

## Constructor Details

### CSRFTokenFlowExecutionListener

public CSRFTokenFlowExecutionListener()
Constructor.

## Method Details

### setEnabled

public void setEnabled(boolean enable)
Set whether CSRF protection is globally enabled or disabled.

Parameters:
  `enable` - enabled/disable CSRF protection (default is false).

### setTokenPerFlow

public void setTokenPerFlow(boolean flag)
Sets whether a new token should be created for each flow session and not for each view.

Parameters:
  `flag` - enable or disable the token per flow pattern

### setViewRequiresCSRFTokenPredicate

public void setViewRequiresCSRFTokenPredicate(@Nonnull Predicate<RequestContext> condition)
Sets the request context condition to determine if a CSRF token should be added to the view-scope.

Parameters:
  `condition` - the condition to apply.

### setEventRequiresCSRFTokenValidationPredicate

public void setEventRequiresCSRFTokenValidationPredicate(@Nonnull BiPredicate<RequestContext,Event> condition)
Set the request context and event condition to determine if a CSRF token should be validated.

Parameters:
  `condition` - the condition to apply

### setCsrfTokenManager

public void setCsrfTokenManager(@Nonnull CSRFTokenManager tokenManager)
Sets the CSRF token manager.

Parameters:
  `tokenManager` - the CSRF token manager.

### sessionStarting

public void sessionStarting(RequestContext context, FlowSession session, MutableAttributeMap<?> input)

If per flow-session tokens are enabled, creates a CSRF token and adds it to the request context flow scope for extraction into the view scope later on.

Specified by:
  `sessionStarting` in interface `FlowExecutionListener`

### viewRendering

public void viewRendering(RequestContext context, View view, StateDefinition viewState)
Generates a CSRF token and adds it to the request context view scope, overwriting any existing token.

Specified by:
  `viewRendering` in interface `FlowExecutionListener`

### eventSignaled

public void eventSignaled(@Nullable RequestContext context, @Nullable Event event)
Checks the CSRF token in the HTTP request matches that stored in the request context viewScope.

Only applies if the listener is enabled, the current state is a view-state, and the request context and event match the `eventRequiresCSRFTokenValidationPredicate` condition.

Invalid tokens - those not found or not matching - are signalled by throwing a `InvalidCSRFTokenException`.

Specified by:
  `eventSignaled` in interface `FlowExecutionListener`

### doInitialize

public void doInitialize() throws ComponentInitializationException

Overrides:
  `doInitialize` in class `AbstractInitializableComponent`
Throws:
  `ComponentInitializationException`