Package org.owasp.csrfguard.token.storage.impl

Class InMemoryTokenHolder

java.lang.Object

org.owasp.csrfguard.token.storage.impl.InMemoryTokenHolder

All Implemented Interfaces:

TokenHolder

public class InMemoryTokenHolder
extends Object
implements TokenHolder

Constructor Summary

Constructors

Constructor	Description
InMemoryTokenHolder()

Method Summary

Modifier and Type	Method	Description
String	createMasterTokenIfAbsent(String sessionKey, Supplier<String> valueSupplier)	Creates and returns a new master token bound to the provided session key if there wasn't any or returns the existing value.
String	createPageTokenIfAbsent(String sessionKey, String resourceUri, Supplier<String> valueSupplier)	Creates and returns a new page token bound to the provided resource URI and mapped to the session key if there wasn't any or returns the existing value.
String	getPageToken(String sessionKey, String resourceUri)	Returns the page token based on the desired HTTP resource URI and logical session key
Map<String,String>	getPageTokens(String sessionKey)	Returns all page tokens associated to the provided logical session key
Token	getToken(String sessionKey)	Returns the master and page tokens associated to a logical session key
void	regenerateUsedPageToken(String sessionKey, String tokenFromRequest, Supplier<String> tokenValueSupplier)	Re-generates the value of a used page token
void	remove(String sessionKey)	Removes all tokens related to a specific logical session key
void	rotateAllPageTokens(String sessionKey, Supplier<String> tokenValueSupplier)	Re-generates all existing tokens associated to the provided logical session key
void	setMasterToken(String sessionKey, String value)	Sets or overwrites the master token bound to a specific session key.
void	setPageToken(String sessionKey, String resourceUri, String value)	Sets the value of a page token based on the desired HTTP resource URI and logical session key
void	setPageTokens(String sessionKey, Map<String,String> pageTokens)	Sets/overwrites the page tokens with the provided values

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

InMemoryTokenHolder

public InMemoryTokenHolder()

Method Detail

setMasterToken

public void setMasterToken(String sessionKey,
                           String value)

Description copied from interface: TokenHolder

Sets or overwrites the master token bound to a specific session key. It does not overwrite the session key associated page tokens.

Specified by:

setMasterToken in interface TokenHolder

Parameters:

sessionKey - identifies the current logical session uniquely

value - the value to be used as master token

createMasterTokenIfAbsent

public String createMasterTokenIfAbsent(String sessionKey,
                                        Supplier<String> valueSupplier)

Description copied from interface: TokenHolder

Creates and returns a new master token bound to the provided session key if there wasn't any or returns the existing value.

Specified by:

createMasterTokenIfAbsent in interface TokenHolder

Parameters:

sessionKey - identifies the current logical session uniquely

valueSupplier - produces a new master token value lazily/on demand

Returns:

the created master token

createPageTokenIfAbsent

public String createPageTokenIfAbsent(String sessionKey,
                                      String resourceUri,
                                      Supplier<String> valueSupplier)

Description copied from interface: TokenHolder

Creates and returns a new page token bound to the provided resource URI and mapped to the session key if there wasn't any or returns the existing value. If there are no tokens associated to the session key it also creates a new master token.

Specified by:

createPageTokenIfAbsent in interface TokenHolder

Parameters:

sessionKey - identifies the current logical session uniquely

resourceUri - the URI of the desired HTTP resource

valueSupplier - produces a new page token value lazily/on demand

Returns:

the existing or newly created page token

getToken

public Token getToken(String sessionKey)

Description copied from interface: TokenHolder

Returns the master and page tokens associated to a logical session key

Specified by:

getToken in interface TokenHolder

Parameters:

sessionKey - identifies the current logical session uniquely

Returns:

a token object containing the master and page tokens

getPageToken

public String getPageToken(String sessionKey,
                           String resourceUri)

Description copied from interface: TokenHolder

Returns the page token based on the desired HTTP resource URI and logical session key

Specified by:

getPageToken in interface TokenHolder

Parameters:

sessionKey - identifies the current logical session uniquely

resourceUri - the URI of the desired HTTP resource

Returns:

a page token bound to a resource URI and associated to a logical session key or NULL if there is no token with identified by the session key

setPageToken

public void setPageToken(String sessionKey,
                         String resourceUri,
                         String value)

Description copied from interface: TokenHolder

Sets the value of a page token based on the desired HTTP resource URI and logical session key

Specified by:

setPageToken in interface TokenHolder

Parameters:

sessionKey - identifies the current logical session uniquely

resourceUri - the URI of the desired HTTP resource

value - the value to be used as token for the page

setPageTokens

public void setPageTokens(String sessionKey,
                          Map<String,String> pageTokens)

Description copied from interface: TokenHolder

Sets/overwrites the page tokens with the provided values

Specified by:

setPageTokens in interface TokenHolder

Parameters:

sessionKey - identifies the current logical session uniquely

pageTokens - page tokens mapped to their resource URIs

getPageTokens

public Map<String,String> getPageTokens(String sessionKey)

Description copied from interface: TokenHolder

Returns all page tokens associated to the provided logical session key

Specified by:

getPageTokens in interface TokenHolder

Parameters:

sessionKey - identifies the current logical session uniquely

Returns:

page tokens mapped to their resource URIs

remove

public void remove(String sessionKey)

Description copied from interface: TokenHolder

Removes all tokens related to a specific logical session key

Specified by:

remove in interface TokenHolder

Parameters:

sessionKey - identifies the current logical session uniquely

rotateAllPageTokens

public void rotateAllPageTokens(String sessionKey,
                                Supplier<String> tokenValueSupplier)

Description copied from interface: TokenHolder

Re-generates all existing tokens associated to the provided logical session key

Specified by:

rotateAllPageTokens in interface TokenHolder

Parameters:

sessionKey - identifies the current logical session uniquely

tokenValueSupplier - produces a new page token value lazily/on demand

regenerateUsedPageToken

public void regenerateUsedPageToken(String sessionKey,
                                    String tokenFromRequest,
                                    Supplier<String> tokenValueSupplier)

Description copied from interface: TokenHolder

Re-generates the value of a used page token

Specified by:

regenerateUsedPageToken in interface TokenHolder

Parameters:

sessionKey - identifies the current logical session uniquely

tokenFromRequest - the token extracted from the request

tokenValueSupplier - produces a new page token value lazily/on demand