Class DefaultCSRFTokenSigner

  • All Implemented Interfaces:

    public class DefaultCSRFTokenSigner
    extends Object
    implements CSRFTokenSigner
    Cryptographic utilities for generating and validating CSRF tokens.

    This trait should not be used as a general purpose encryption utility.

    • Constructor Detail

      • DefaultCSRFTokenSigner

        public DefaultCSRFTokenSigner​(play.api.libs.crypto.CSRFTokenSigner csrfTokenSigner)
    • Method Detail

      • signToken

        public String signToken​(String token)
        Description copied from interface: CSRFTokenSigner
        Sign a token. This produces a new token, that has this token signed with a nonce.

        This primarily exists to defeat the BREACH vulnerability, as it allows the token to effectively be random per request, without actually changing the value.

        Specified by:
        signToken in interface CSRFTokenSigner
        token - The token to sign
        The signed token
      • generateSignedToken

        public String generateSignedToken()
        Description copied from interface: CSRFTokenSigner
        Generates a signed token by calling generateToken / signToken.
        Specified by:
        generateSignedToken in interface CSRFTokenSigner
        a newly generated token that has been signed.
      • compareSignedTokens

        public boolean compareSignedTokens​(String tokenA,
                                           String tokenB)
        Description copied from interface: CSRFTokenSigner
        Compare two signed tokens.
        Specified by:
        compareSignedTokens in interface CSRFTokenSigner
        tokenA - the first token
        tokenB - another token
        true if the tokens match and are signed, false otherwise.
      • asScala

        public play.api.libs.crypto.CSRFTokenSigner asScala()
        Description copied from interface: CSRFTokenSigner
        Utility method needed for CSRFCheck. Should not need to be used or extended by user level code.
        Specified by:
        asScala in interface CSRFTokenSigner
        the Scala API CSRFTokenSigner component.