Package de.elo.ix.client.plugin

Class SessionManagement

java.lang.Object

de.elo.ix.client.plugin.SessionManagement

public class SessionManagement
extends Object

This class is internally used by Indexserver and plugins to mange HTTP session attributes. EIX-1817: CSRF protection for REST calls

Field Summary

Fields

Modifier and Type	Field	Description
static final String	HTTP_SESSION_HEADER_APPROVED	Header name for approved token.

Method Summary

Modifier and Type	Method	Description
static void	apply(IXConnection conn, Optional<String> csrfTokenOpt, jakarta.servlet.http.HttpServletRequest request, jakarta.servlet.http.HttpServletResponse response)	Add ticket, IXConnection and CSRF token into HTTP session.
static boolean	isApproved(jakarta.servlet.http.HttpServletRequest request)	Check CSRF token.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

HTTP_SESSION_HEADER_APPROVED

public static final String HTTP_SESSION_HEADER_APPROVED

Header name for approved token.

See Also:

• isApproved(HttpServletRequest)
• Constant Field Values

Method Details

apply

public static void apply(IXConnection conn,
 Optional<String> csrfTokenOpt,
 jakarta.servlet.http.HttpServletRequest request,
 jakarta.servlet.http.HttpServletResponse response)

Add ticket, IXConnection and CSRF token into HTTP session.

Parameters:

conn - IXConnection

csrfTokenOpt - Token to refuse CSRF attacks aganist rest-plugin.

request - HTTP request

response - HTTP response

isApproved

public static boolean isApproved(jakarta.servlet.http.HttpServletRequest request)

Check CSRF token. This function is called by the REST framework for methods annotated with de.elo.ix.rest.api.Approved to check for a CSRF attack. The client application receives a CSRF token as HTTP cookie in the login response. In each subsequent request to the rest-plugin, the token must be submitted as HTTP header. The cookie name and header name for the CSRF token is HTTP_SESSION_HEADER_APPROVED.

Parameters:

request - HTTP request

Returns:

true, if CSRF token is correct.