Package com.google.gwt.user.server.rpc

Class XsrfProtectedServiceServlet

java.lang.Object

javax.servlet.GenericServlet

javax.servlet.http.HttpServlet

com.google.gwt.user.server.rpc.AbstractRemoteServiceServlet

com.google.gwt.user.server.rpc.RemoteServiceServlet

com.google.gwt.user.server.rpc.AbstractXsrfProtectedServiceServlet

com.google.gwt.user.server.rpc.XsrfProtectedServiceServlet

All Implemented Interfaces:

SerializationPolicyProvider, Serializable, javax.servlet.Servlet, javax.servlet.ServletConfig

public class XsrfProtectedServiceServlet
extends AbstractXsrfProtectedServiceServlet

EXPERIMENTAL and subject to change. Do not use this in production code.

The servlet base class for RPC service implementations using default XSRF protection tied to authentication session cookie.

XSRF token validation is performed by generating MD5 hash of the session cookie and comparing supplied XsrfToken with the generated hash. Session cookie name is specified by the "gwt.xsrf.session_cookie_name" context parameter in web.xml.

XsrfTokenService can be used by clients to obtain XsrfTokens that will pass validation performed by this class.

See Also:

• XsrfTokenServiceServlet
• AbstractXsrfProtectedServiceServlet
• Serialized Form

Field Summary

Fields

Modifier and Type	Field	Description
(package private) String	sessionCookieName

Fields inherited from class com.google.gwt.user.server.rpc.AbstractRemoteServiceServlet

perThreadRequest, perThreadResponse

Constructor Summary

Constructors

Constructor	Description
XsrfProtectedServiceServlet()
XsrfProtectedServiceServlet(Object delegate)
XsrfProtectedServiceServlet(Object delegate, String sessionCookieName)
XsrfProtectedServiceServlet(String sessionCookieName)

Method Summary

Modifier and Type	Method	Description
void	init()
protected void	validateXsrfToken(RpcToken token, Method method)	Validates XsrfToken included with RPCRequest against XSRF cookie.

Methods inherited from class com.google.gwt.user.server.rpc.AbstractXsrfProtectedServiceServlet

onAfterRequestDeserialized, shouldValidateXsrfToken

Methods inherited from class com.google.gwt.user.server.rpc.RemoteServiceServlet

checkPermutationStrongName, doGetSerializationPolicy, getCodeServerPolicyUrl, getRequestModuleBasePath, getSerializationPolicy, init, loadPolicyFromCodeServer, loadSerializationPolicy, onAfterResponseSerialized, onBeforeRequestDeserialized, processCall, processCall, processPost, shouldCompressResponse

Methods inherited from class com.google.gwt.user.server.rpc.AbstractRemoteServiceServlet

doPost, doUnexpectedFailure, getPermutationStrongName, getThreadLocalRequest, getThreadLocalResponse, readContent

Methods inherited from class javax.servlet.http.HttpServlet

doDelete, doGet, doHead, doOptions, doPut, doTrace, getLastModified, service, service

Methods inherited from class javax.servlet.GenericServlet

destroy, getInitParameter, getInitParameterNames, getServletConfig, getServletContext, getServletInfo, getServletName, log, log

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

sessionCookieName

String sessionCookieName

Constructor Details

XsrfProtectedServiceServlet

public XsrfProtectedServiceServlet()

XsrfProtectedServiceServlet

public XsrfProtectedServiceServlet(String sessionCookieName)

XsrfProtectedServiceServlet

public XsrfProtectedServiceServlet(Object delegate)

XsrfProtectedServiceServlet

public XsrfProtectedServiceServlet(Object delegate,
 String sessionCookieName)

Method Details

init

public void init()
          throws javax.servlet.ServletException

Overrides:

init in class javax.servlet.GenericServlet

Throws:

javax.servlet.ServletException

validateXsrfToken

protected void validateXsrfToken(RpcToken token,
 Method method)
                          throws RpcTokenException

Validates XsrfToken included with RPCRequest against XSRF cookie.

Specified by:

validateXsrfToken in class AbstractXsrfProtectedServiceServlet

Parameters:

token - RpcToken included with an RPC request.

method - method being invoked via this RPC call.

Throws:

RpcTokenException - if token verification failed.