public interface ConfigurationProvider
| Modifier and Type | Method and Description |
|---|---|
List<IAction> |
getActions() |
Set<String> |
getBannedUserAgentProperties() |
String |
getDomainOrigin()
TODO Currently not configurable through the properties!
|
String |
getJavascriptCacheControl() |
String |
getJavascriptDynamicNodeCreationEventName() |
Pattern |
getJavascriptRefererPattern() |
String |
getJavascriptTaggedCacheControl() |
String |
getJavascriptTemplateCode() |
String |
getJavascriptUnprotectedExtensions()
example: "js,css,gif,png,ico,jpg"
|
String |
getJavascriptXrequestedWith()
TODO document
|
LogicalSessionExtractor |
getLogicalSessionExtractor() |
String |
getNewTokenLandingPage() |
Duration |
getPageTokenSynchronizationTolerance() |
SecureRandom |
getPrng() |
Set<String> |
getProtectedMethods() |
Set<String> |
getProtectedPages() |
TokenHolder |
getTokenHolder() |
int |
getTokenLength()
This parameter controls how long a generated token should be.
|
String |
getTokenName() |
Set<String> |
getUnprotectedMethods()
if there are methods here, then all other HTTP methods are protected and these (e.g.
|
Set<String> |
getUnprotectedPages() |
void |
initializeJavaScriptConfiguration()
JavaScript configuration parameters can be set/overwritten via the servlet configuration.
|
boolean |
isAjaxEnabled() |
boolean |
isCacheable() |
boolean |
isEnabled()
if the filter is enabled
|
boolean |
isForceSynchronousAjax() |
boolean |
isJavascriptDomainStrict() |
boolean |
isJavascriptInjectFormAttributes()
if the token should be injected in the action in forms
note, if injectIntoForms is true, then this might not need to be true
|
boolean |
isJavascriptInjectGetForms()
if the token should be injected in GET forms (which will be on the URL)
if the HTTP method GET is unprotected, then this should likely be false
|
boolean |
isJavascriptInjectIntoAttributes() |
boolean |
isJavascriptInjectIntoDynamicallyCreatedNodes() |
boolean |
isJavascriptInjectIntoForms() |
boolean |
isJavascriptRefererMatchDomain()
if the referer to the javascript must match domain
|
boolean |
isJavascriptRefererMatchProtocol()
if the referer to the javascript must match the protocol of the domain
|
boolean |
isPrintConfig() |
boolean |
isProtectEnabled()
The default behavior of CSRFGuard is to protect all pages.
|
boolean |
isRotateEnabled() |
boolean |
isTokenPerPageEnabled() |
boolean |
isTokenPerPagePrecreateEnabled() |
boolean |
isUseNewTokenLandingPage() |
boolean |
isValidateWhenNoSessionExists()
If csrf guard filter should check even if there is no session for the user
Note: this changed around 2014/04, the default behavior used to be to
not check if there is no session.
|
boolean isCacheable()
boolean isPrintConfig()
String getTokenName()
boolean isValidateWhenNoSessionExists()
int getTokenLength()
boolean isRotateEnabled()
boolean isTokenPerPageEnabled()
boolean isTokenPerPagePrecreateEnabled()
SecureRandom getPrng()
String getNewTokenLandingPage()
boolean isUseNewTokenLandingPage()
getNewTokenLandingPage()boolean isAjaxEnabled()
boolean isProtectEnabled()
boolean isForceSynchronousAjax()
Set<String> getProtectedPages()
Set<String> getUnprotectedPages()
Set<String> getProtectedMethods()
Set<String> getUnprotectedMethods()
Set<String> getBannedUserAgentProperties()
boolean isEnabled()
List<IAction> getActions()
boolean isJavascriptDomainStrict()
String getDomainOrigin()
String getJavascriptCacheControl()
String getJavascriptTaggedCacheControl()
Pattern getJavascriptRefererPattern()
void initializeJavaScriptConfiguration()
boolean isJavascriptInjectGetForms()
boolean isJavascriptInjectFormAttributes()
boolean isJavascriptInjectIntoForms()
boolean isJavascriptRefererMatchProtocol()
boolean isJavascriptRefererMatchDomain()
boolean isJavascriptInjectIntoAttributes()
boolean isJavascriptInjectIntoDynamicallyCreatedNodes()
String getJavascriptDynamicNodeCreationEventName()
String getJavascriptXrequestedWith()
String getJavascriptTemplateCode()
String getJavascriptUnprotectedExtensions()
TokenHolder getTokenHolder()
LogicalSessionExtractor getLogicalSessionExtractor()
Duration getPageTokenSynchronizationTolerance()
Copyright © 2025 OWASP. All rights reserved.