/*
 * Copyright 2014 Red Hat, Inc.
 *
 * Red Hat licenses this file to you under the Apache License, version 2.0
 * (the "License"); you may not use this file except in compliance with the
 * License.  You may obtain a copy of the License at:
 *
 * http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.  See the
 * License for the specific language governing permissions and limitations
 * under the License.
 */

package io.vertx.reactivex.ext.web.handler;

import io.vertx.reactivex.RxHelper;
import io.vertx.reactivex.ObservableHelper;
import io.vertx.reactivex.FlowableHelper;
import io.vertx.reactivex.impl.AsyncResultMaybe;
import io.vertx.reactivex.impl.AsyncResultSingle;
import io.vertx.reactivex.impl.AsyncResultCompletable;
import io.vertx.reactivex.WriteStreamObserver;
import io.vertx.reactivex.WriteStreamSubscriber;
import java.util.Map;
import java.util.Set;
import java.util.List;
import java.util.Iterator;
import java.util.function.Function;
import java.util.stream.Collectors;
import io.vertx.core.Handler;
import io.vertx.core.AsyncResult;
import io.vertx.core.json.JsonObject;
import io.vertx.core.json.JsonArray;
import io.vertx.lang.rx.RxGen;
import io.vertx.lang.rx.TypeArg;
import io.vertx.lang.rx.MappingIterator;

This handler adds a CSRF token to requests which mutate state. In order change the state a (XSRF-TOKEN) cookie is set with a unique token, that is expected to be sent back in a (X-XSRF-TOKEN) header. The behavior is to check the request body header and cookie for validity. This Handler requires session support, thus should be added somewhere below Session and Body handlers.

NOTE: This class has been automatically generated from the original non RX-ified interface using Vert.x codegen.
/** * This handler adds a CSRF token to requests which mutate state. In order change the state a (XSRF-TOKEN) cookie is set * with a unique token, that is expected to be sent back in a (X-XSRF-TOKEN) header. * * The behavior is to check the request body header and cookie for validity. * * This Handler requires session support, thus should be added somewhere below Session and Body handlers. * * <p/> * NOTE: This class has been automatically generated from the {@link io.vertx.ext.web.handler.CSRFHandler original} non RX-ified interface using Vert.x codegen. */
@RxGen(io.vertx.ext.web.handler.CSRFHandler.class) public class CSRFHandler implements Handler<io.vertx.reactivex.ext.web.RoutingContext> { @Override public String toString() { return delegate.toString(); } @Override public boolean equals(Object o) { if (this == o) return true; if (o == null || getClass() != o.getClass()) return false; CSRFHandler that = (CSRFHandler) o; return delegate.equals(that.delegate); } @Override public int hashCode() { return delegate.hashCode(); } public static final TypeArg<CSRFHandler> __TYPE_ARG = new TypeArg<>( obj -> new CSRFHandler((io.vertx.ext.web.handler.CSRFHandler) obj), CSRFHandler::getDelegate ); private final io.vertx.ext.web.handler.CSRFHandler delegate; public CSRFHandler(io.vertx.ext.web.handler.CSRFHandler delegate) { this.delegate = delegate; } public CSRFHandler(Object delegate) { this.delegate = (io.vertx.ext.web.handler.CSRFHandler)delegate; } public io.vertx.ext.web.handler.CSRFHandler getDelegate() { return delegate; }
Something has happened, so handle it.
Params:
  • event – the event to handle
/** * Something has happened, so handle it. * @param event the event to handle */
public void handle(io.vertx.reactivex.ext.web.RoutingContext event) { delegate.handle(event.getDelegate()); }
Instantiate a new CSRFHandlerImpl with a secret

CSRFHandler.create("s3cr37")
Params:
  • vertx –
  • secret – server secret to sign the token.
Returns:
/** * Instantiate a new CSRFHandlerImpl with a secret * <p> * <pre> * CSRFHandler.create("s3cr37") * </pre> * @param vertx * @param secret server secret to sign the token. * @return */
public static io.vertx.reactivex.ext.web.handler.CSRFHandler create(io.vertx.reactivex.core.Vertx vertx, String secret) { io.vertx.reactivex.ext.web.handler.CSRFHandler ret = io.vertx.reactivex.ext.web.handler.CSRFHandler.newInstance((io.vertx.ext.web.handler.CSRFHandler)io.vertx.ext.web.handler.CSRFHandler.create(vertx.getDelegate(), secret)); return ret; }
Set the origin for this server. When this value is set, extra validation will occur. The request must match the origin server, port and protocol.
Params:
  • origin – the origin for this server e.g.: https://www.foo.com.
Returns:fluent
/** * Set the origin for this server. When this value is set, extra validation will occur. The request * must match the origin server, port and protocol. * @param origin the origin for this server e.g.: <code>https://www.foo.com</code>. * @return fluent */
public io.vertx.reactivex.ext.web.handler.CSRFHandler setOrigin(String origin) { delegate.setOrigin(origin); return this; }
Set the cookie name. By default XSRF-TOKEN is used as it is the expected name by AngularJS however other frameworks might use other names.
Params:
  • name – a new name for the cookie.
Returns:fluent
/** * Set the cookie name. By default XSRF-TOKEN is used as it is the expected name by AngularJS however other frameworks * might use other names. * @param name a new name for the cookie. * @return fluent */
public io.vertx.reactivex.ext.web.handler.CSRFHandler setCookieName(String name) { delegate.setCookieName(name); return this; }
Set the cookie path. By default / is used.
Params:
  • path – a new path for the cookie.
Returns:fluent
/** * Set the cookie path. By default / is used. * @param path a new path for the cookie. * @return fluent */
public io.vertx.reactivex.ext.web.handler.CSRFHandler setCookiePath(String path) { delegate.setCookiePath(path); return this; }
Set the cookie httpOnly attribute. When setting to false the CSRF handler will behave in Double Submit Cookie mode. When set to true then it will operate in Cookie-to-header mode. For more information https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html#double-submit-cookie
Params:
  • httpOnly – a new name for the header.
Returns:fluent
/** * Set the cookie <code>httpOnly</code> attribute. When setting to <code>false</code> the CSRF handler will behave in * Double Submit Cookie mode. When set to <code>true</code> then it will operate in Cookie-to-header mode. * * For more information <a href="https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html#double-submit-cookie">https://cheatsheetseries.owasp.org/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.html#double-submit-cookie</a> * @param httpOnly a new name for the header. * @return fluent */
public io.vertx.reactivex.ext.web.handler.CSRFHandler setCookieHttpOnly(boolean httpOnly) { delegate.setCookieHttpOnly(httpOnly); return this; }
Set the header name. By default X-XSRF-TOKEN is used as it is the expected name by AngularJS however other frameworks might use other names.
Params:
  • name – a new name for the header.
Returns:fluent
/** * Set the header name. By default X-XSRF-TOKEN is used as it is the expected name by AngularJS however other * frameworks might use other names. * @param name a new name for the header. * @return fluent */
public io.vertx.reactivex.ext.web.handler.CSRFHandler setHeaderName(String name) { delegate.setHeaderName(name); return this; }
Should the handler give warning messages if this handler is used in other than https protocols?
Params:
  • nag – true to nag
Returns:fluent
/** * Should the handler give warning messages if this handler is used in other than https protocols? * @param nag true to nag * @return fluent */
public io.vertx.reactivex.ext.web.handler.CSRFHandler setNagHttps(boolean nag) { delegate.setNagHttps(nag); return this; }
Set the timeout for tokens generated by the handler, by default it uses the default from the session handler.
Params:
  • timeout – token timeout
Returns:fluent
/** * Set the timeout for tokens generated by the handler, by default it uses the default from the session handler. * @param timeout token timeout * @return fluent */
public io.vertx.reactivex.ext.web.handler.CSRFHandler setTimeout(long timeout) { delegate.setTimeout(timeout); return this; } public static final String DEFAULT_COOKIE_NAME = io.vertx.ext.web.handler.CSRFHandler.DEFAULT_COOKIE_NAME; public static final String DEFAULT_COOKIE_PATH = io.vertx.ext.web.handler.CSRFHandler.DEFAULT_COOKIE_PATH; public static final String DEFAULT_HEADER_NAME = io.vertx.ext.web.handler.CSRFHandler.DEFAULT_HEADER_NAME; public static CSRFHandler newInstance(io.vertx.ext.web.handler.CSRFHandler arg) { return arg != null ? new CSRFHandler(arg) : null; } }