org.springframework.security.web.csrf.MissingCsrfTokenException Java Examples

The following examples show how to use org.springframework.security.web.csrf.MissingCsrfTokenException. You can vote up the ones you like or vote down the ones you don't like, and go to the original project or source file by following the links above each example. You may check out the related API usage on the sidebar.

Example #1

Source File: WebSecurityBeanConfig.java From webauthn4j-spring-security with Apache License 2.0

7 votes

@Bean
public AccessDeniedHandler accessDeniedHandler() {
    LinkedHashMap<Class<? extends AccessDeniedException>, AccessDeniedHandler> errorHandlers = new LinkedHashMap<>();

    // invalid csrf authenticator error handler
    AccessDeniedHandlerImpl invalidCsrfTokenErrorHandler = new AccessDeniedHandlerImpl();
    invalidCsrfTokenErrorHandler.setErrorPage("/api/status/403");
    errorHandlers.put(InvalidCsrfTokenException.class, invalidCsrfTokenErrorHandler);

    // missing csrf authenticator error handler
    AccessDeniedHandlerImpl missingCsrfTokenErrorHandler = new AccessDeniedHandlerImpl();
    missingCsrfTokenErrorHandler.setErrorPage("/api/status/403");
    errorHandlers.put(MissingCsrfTokenException.class, missingCsrfTokenErrorHandler);

    // default error handler
    AccessDeniedHandlerImpl defaultErrorHandler = new AccessDeniedHandlerImpl();
    defaultErrorHandler.setErrorPage("/api/status/403");

    return new DelegatingAccessDeniedHandler(errorHandlers, defaultErrorHandler);
}

Example #2

Source File: WebSecurityBeanConfig.java From webauthn4j-spring-security with Apache License 2.0

6 votes

@Bean
public AccessDeniedHandler accessDeniedHandler() {
    LinkedHashMap<Class<? extends AccessDeniedException>, AccessDeniedHandler> errorHandlers = new LinkedHashMap<>();

    // invalid csrf authenticator error handler
    AccessDeniedHandlerImpl invalidCsrfTokenErrorHandler = new AccessDeniedHandlerImpl();
    invalidCsrfTokenErrorHandler.setErrorPage("/api/status/403");
    errorHandlers.put(InvalidCsrfTokenException.class, invalidCsrfTokenErrorHandler);

    // missing csrf authenticator error handler
    AccessDeniedHandlerImpl missingCsrfTokenErrorHandler = new AccessDeniedHandlerImpl();
    missingCsrfTokenErrorHandler.setErrorPage("/api/status/403");
    errorHandlers.put(MissingCsrfTokenException.class, missingCsrfTokenErrorHandler);

    // default error handler
    AccessDeniedHandlerImpl defaultErrorHandler = new AccessDeniedHandlerImpl();
    defaultErrorHandler.setErrorPage("/api/status/403");

    return new DelegatingAccessDeniedHandler(errorHandlers, defaultErrorHandler);
}

Example #3

Source File: CsrfAccessDeniedHandler.java From multiapps-controller with Apache License 2.0

5 votes

@Override
public void handle(HttpServletRequest request, HttpServletResponse response, AccessDeniedException authException)
    throws IOException, ServletException {
    if (authException instanceof InvalidCsrfTokenException || authException instanceof MissingCsrfTokenException) {
        response.setHeader(Constants.CSRF_TOKEN, CSRF_TOKEN_REQUIRED_HEADER_VALUE);
    }
    doHandle(request, response, authException);
}

Example #4

Source File: DefaultAccessDeniedHandler.java From spring-boot-doma2-sample with Apache License 2.0

5 votes

@Override
public void handle(HttpServletRequest request, HttpServletResponse response,
        AccessDeniedException accessDeniedException) throws IOException, ServletException {

    if (response.isCommitted()) {
        return;
    }

    if (accessDeniedException instanceof MissingCsrfTokenException
            || accessDeniedException instanceof InvalidCsrfTokenException) {
        authenticationEntryPoint.commence(request, response, null);
    } else {
        redirectStrategy.sendRedirect(request, response, FORBIDDEN_URL);
    }
}