Package com.google.gwt.user.server.rpc.jakarta

Class XsrfProtectedServiceServlet

java.lang.Object
jakarta.servlet.GenericServlet
jakarta.servlet.http.HttpServlet
com.google.gwt.user.server.rpc.jakarta.AbstractRemoteServiceServlet
com.google.gwt.user.server.rpc.jakarta.RemoteServiceServlet
com.google.gwt.user.server.rpc.jakarta.AbstractXsrfProtectedServiceServlet
com.google.gwt.user.server.rpc.jakarta.XsrfProtectedServiceServlet
All Implemented Interfaces:
SerializationPolicyProvider, jakarta.servlet.Servlet, jakarta.servlet.ServletConfig, Serializable
public class XsrfProtectedServiceServlet extends AbstractXsrfProtectedServiceServlet
EXPERIMENTAL and subject to change. Do not use this in production code.

The servlet base class for RPC service implementations using default XSRF protection tied to authentication session cookie.

XSRF token validation is performed by generating MD5 hash of the session cookie and comparing supplied XsrfToken with the generated hash. Session cookie name is specified by the "gwt.xsrf.session_cookie_name" context parameter in web.xml.

XsrfTokenService can be used by clients to obtain XsrfTokens that will pass validation performed by this class.

See Also:

  • Field Details

    • sessionCookieName

      String sessionCookieName

  • Constructor Details

    • XsrfProtectedServiceServlet

      public XsrfProtectedServiceServlet()

    • XsrfProtectedServiceServlet

      public XsrfProtectedServiceServlet(String sessionCookieName)

    • XsrfProtectedServiceServlet

      public XsrfProtectedServiceServlet(Object delegate)

    • XsrfProtectedServiceServlet

      public XsrfProtectedServiceServlet(Object delegate, String sessionCookieName)

  • Method Details

    • init

      public void init() throws jakarta.servlet.ServletException
      Overrides:
      init in class jakarta.servlet.GenericServlet
      Throws:
      jakarta.servlet.ServletException

    • validateXsrfToken

      protected void validateXsrfToken(RpcToken token, Method method) throws RpcTokenException
      Validates XsrfToken included with
      invalid reference 
      RPCRequest
      against XSRF cookie.
      Specified by:
      validateXsrfToken in class AbstractXsrfProtectedServiceServlet
      Parameters:
      token - RpcToken included with an RPC request.
      method - method being invoked via this RPC call.
      Throws:
      RpcTokenException - if token verification failed.