Package org.owasp.csrfguard.token.storage

Interface TokenHolder

  • All Known Implementing Classes:
    InMemoryTokenHolder
    public interface TokenHolder
    Interface used for storing and manipulating tokens across the solution. Methods of this class should only be used through the TokenService and its relevant subclass(es)

    • Method Detail

      • setMasterToken

        void setMasterToken​(String sessionKey,
                    String value)
        Sets or overwrites the master token bound to a specific session key. It does not overwrite the session key associated page tokens.
        Parameters:
        sessionKey - identifies the current logical session uniquely
        value - the value to be used as master token

      • createMasterTokenIfAbsent

        String createMasterTokenIfAbsent​(String sessionKey,
                                 Supplier<String> valueSupplier)
        Creates and returns a new master token bound to the provided session key if there wasn't any or returns the existing value.
        Parameters:
        sessionKey - identifies the current logical session uniquely
        valueSupplier - produces a new master token value lazily/on demand
        Returns:
        the created master token

      • createPageTokenIfAbsent

        String createPageTokenIfAbsent​(String sessionKey,
                               String resourceUri,
                               Supplier<String> valueSupplier)
        Creates and returns a new page token bound to the provided resource URI and mapped to the session key if there wasn't any or returns the existing value. If there are no tokens associated to the session key it also creates a new master token.
        Parameters:
        sessionKey - identifies the current logical session uniquely
        resourceUri - the URI of the desired HTTP resource
        valueSupplier - produces a new page token value lazily/on demand
        Returns:
        the existing or newly created page token

      • getToken

        Token getToken​(String sessionKey)
        Returns the master and page tokens associated to a logical session key
        Parameters:
        sessionKey - identifies the current logical session uniquely
        Returns:
        a token object containing the master and page tokens

      • getPageToken

        String getPageToken​(String sessionKey,
                    String resourceUri)
        Returns the page token based on the desired HTTP resource URI and logical session key
        Parameters:
        sessionKey - identifies the current logical session uniquely
        resourceUri - the URI of the desired HTTP resource
        Returns:
        a page token bound to a resource URI and associated to a logical session key or NULL if there is no token with identified by the session key

      • setPageToken

        void setPageToken​(String sessionKey,
                  String resourceUri,
                  String value)
        Sets the value of a page token based on the desired HTTP resource URI and logical session key
        Parameters:
        sessionKey - identifies the current logical session uniquely
        resourceUri - the URI of the desired HTTP resource
        value - the value to be used as token for the page

      • setPageTokens

        void setPageTokens​(String sessionKey,
                   Map<String,​String> pageTokens)
        Sets/overwrites the page tokens with the provided values
        Parameters:
        sessionKey - identifies the current logical session uniquely
        pageTokens - page tokens mapped to their resource URIs

      • getPageTokens

        Map<String,​String> getPageTokens​(String sessionKey)
        Returns all page tokens associated to the provided logical session key
        Parameters:
        sessionKey - identifies the current logical session uniquely
        Returns:
        page tokens mapped to their resource URIs

      • remove

        void remove​(String sessionKey)
        Removes all tokens related to a specific logical session key
        Parameters:
        sessionKey - identifies the current logical session uniquely

      • rotateAllPageTokens

        void rotateAllPageTokens​(String sessionKey,
                         Supplier<String> tokenValueSupplier)
        Re-generates all existing tokens associated to the provided logical session key
        Parameters:
        sessionKey - identifies the current logical session uniquely
        tokenValueSupplier - produces a new page token value lazily/on demand

      • regenerateUsedPageToken

        void regenerateUsedPageToken​(String sessionKey,
                             String tokenFromRequest,
                             Supplier<String> tokenValueSupplier)
        Re-generates the value of a used page token
        Parameters:
        sessionKey - identifies the current logical session uniquely
        tokenFromRequest - the token extracted from the request
        tokenValueSupplier - produces a new page token value lazily/on demand