Package org.kohsuke.stapler

Class CrumbIssuer

java.lang.Object
org.kohsuke.stapler.CrumbIssuer
public abstract class CrumbIssuer extends Object
Generates a nonce value that allows us to protect against cross-site request forgery (CSRF) attacks.

We send this with each JavaScript proxy and verify them when we receive a request.

Author:
Kohsuke Kawaguchi
See Also:

  • Field Details

    • NONE

      public static final CrumbIssuer NONE
      No-op crumb issuer.

  • Constructor Details

    • CrumbIssuer

      public CrumbIssuer()

  • Method Details

    • issueCrumb

      public String issueCrumb(StaplerRequest2 request)
      Issues a crumb for the given request.

    • issueCrumb

      @Deprecated public String issueCrumb(StaplerRequest request)
      Deprecated.
      use issueCrumb(StaplerRequest2)

    • issueCrumb

      public final String issueCrumb()

    • getCrumbExpression

      public abstract String getCrumbExpression()
      Returns the JavaScript expression that evaluates to the crumb value for the given request, for example, document.head.dataset.crumbValue.
      Returns:
      the JavaScript expression that evaluates to the crumb value for the given request. Never the crumb itself.

    • doCrumb

      public HttpResponse doCrumb()
      Sends the crumb value in plain text, enabling retrieval through XmlHttpRequest.

    • validateCrumb

      public void validateCrumb(StaplerRequest2 request, String submittedCrumb)
      Validates a crumb that was submitted along with the request.
      Parameters:
      request - The request that submitted the crumb
      submittedCrumb - The submitted crumb value to be validated.
      Throws:
      SecurityException - If the crumb doesn't match and the request processing should abort.

    • validateCrumb

      @Deprecated public void validateCrumb(StaplerRequest request, String submittedCrumb)
      Deprecated.
      use validateCrumb(StaplerRequest2, String)