Class CSRFProtection

dw.web

Object

dw.web.CSRFProtection

Used to generate and validate CSRF tokens. CSRFProtection allows applications to protect themselves against CSRF attacks, using synchronizer tokens, a best practice. Once created, these tokens are tied to a user’s session and valid for 60 minutes.

Usage:
Adding CSRF token to forms:

 //CSRF token generation
 <form ... action="">
   <input name="foo" value="bar">
   <input name="${dw.web.CSRFProtection.getTokenName()}"
             value="${dw.web.CSRFProtection.generateToken()">
 </form>

Then, in scripts call:

 dw.web.CSRFProtection.validateRequest();

tokenName : String (Read Only)

The system generated CSRF token name. Currently, this name is not user configurable. Must be used for validateRequest() to work

This class does not have a constructor, so you cannot create it directly.

static generateToken() : String

Constructs a new unique CSRF token for this session.

static getTokenName() : String

Returns the system generated CSRF token name.

static validateRequest() : boolean

Verifies that a client request contains a valid CSRF token, and that the token has not expired.

Methods inherited from class Object

assign, create, create, defineProperties, defineProperty, entries, freeze, fromEntries, getOwnPropertyDescriptor, getOwnPropertyNames, getOwnPropertySymbols, getPrototypeOf, hasOwnProperty, is, isExtensible, isFrozen, isPrototypeOf, isSealed, keys, preventExtensions, propertyIsEnumerable, seal, setPrototypeOf, toLocaleString, toString, valueOf, values

generateToken

static generateToken() : String

Constructs a new unique CSRF token for this session.

Returns:

a new CSRF token

getTokenName

static getTokenName() : String

Returns the system generated CSRF token name. Currently, this name is not user configurable. Must be used for validateRequest() to work

Returns:

System-generated CSRF token parameter name

validateRequest

static validateRequest() : boolean

Verifies that a client request contains a valid CSRF token, and that the token has not expired. Returns true if these conditions are met, and false otherwise

Returns:

true if request contains a valid CSRF token, false otherwise