CsrfCookieHttpTransport class final

An HttpTransport that sends the CSRF token of the server's XSRF-TOKEN cookie back in the X-XSRF-TOKEN header, on the requests that change something (POST, PUT, PATCH, DELETE, ...) to the app's server.

A web app logged in by its server holds a session cookie, which the browser sends with every request to that server, also with requests a foreign page makes it send. Spring Security therefore wants a CSRF token with every unsafe request; with CookieCsrfTokenRepository it hands the token out in a cookie scripts may read, and a script proves it runs on the app's page by copying it into a header (what Angular does by itself). This decorator does the copying for the Feign clients and the web login, so no app code handles the token.

  • Only requests to server's origin get the header: the token never goes to the provider or any other API.
  • GET, HEAD, OPTIONS and TRACE get none, as Spring Security's CsrfFilter asks for none.
  • Without the cookie the request goes as it is (the server answers 403): the server must send the cookie before the first unsafe request (Spring's single-page-app recipe writes it on every response).
  • A header the request already has is kept.

On the web the package declares it as the httpTransport bean, around the browser's transport (for a server on another origin a ServerCredentialsHttpTransport, which sends the cookies with the server's requests only), unless the application declares its own HttpTransport. An application with its own wraps it itself:

@Bean()
HttpTransport httpTransport(BrowserPage page) {
  final server = Uri.parse('https://api.neon.books');
  return CsrfCookieHttpTransport(
    MyLoggingTransport(
      ServerCredentialsHttpTransport.forPage(page: page, server: server),
    ),
    page: page,
    server: server,
  );
}

Spring has no client side for it: this is the browser's half of CookieCsrfTokenRepository.withHttpOnlyFalse(), with its cookie and header names.

Implemented types

Constructors

CsrfCookieHttpTransport(HttpTransport delegate, {required BrowserPage page, required Uri server, String cookieName = defaultCookieName, String headerName = defaultHeaderName})
Sends the requests through delegate, adding the header to the unsafe ones to server's origin; page gives the cookie (and the page's address, against which relative URLs are resolved).

Properties

cookieName → String
The cookie with the token.
final
delegate → HttpTransport
The transport that sends the requests.
final
hashCode → int
The hash code for this object.
no setterinherited
headerName → String
The header the token is sent in.
final
page → BrowserPage
The page whose cookie holds the token.
final
runtimeType → Type
A representation of the runtime type of the object.
no setterinherited
server → Uri
The app's server; only requests to its origin get the token.
final

Methods

close() → void
Releases the transport's connections. Call it when the transport is no longer needed (the Feign starter does when the application stops); do not use the transport afterwards.
override
noSuchMethod(Invocation invocation) → dynamic
Invoked when a nonexistent method or property is accessed.
inherited
send(HttpRequest request) → Future<HttpResponse>
Sends request and reads the whole response into memory.
override
stream(HttpRequest request) → Future<StreamedHttpResponse>
Sends request and completes as soon as the status and headers have arrived. The body is then read from StreamedHttpResponse.body as it comes.
override
toString() → String
A string representation of this object.
inherited
withToken(HttpRequest request) → HttpRequest
request with the token header when it needs one, else request itself.

Operators

operator ==(Object other) → bool
The equality operator.
inherited

Constants

defaultCookieName → const String
XSRF-TOKEN, the cookie of Spring's CookieCsrfTokenRepository.
defaultHeaderName → const String
X-XSRF-TOKEN, the header Spring Security reads the token from.
safeMethods → const Set<HttpMethod>
The methods Spring Security's CsrfFilter lets through without a token.