Skip to content

Commit f8c8af9

Browse files
dschadowdschadow
committed
First part CSRF protection
Signed-off-by: Dominik Schadow <dominikschadow@googlemail.com>
1 parent 384ba24 commit f8c8af9

File tree

4 files changed

+125
-7
lines changed

4 files changed

+125
-7
lines changed

‎Ch08_CSRF/src/main/java/de/dominikschadow/webappsecurity/ProtectedServlet.java‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
/*
2+
* Copyright (C) 2013 Dominik Schadow, dominikschadow@gmail.com
3+
*
4+
* This file is part of JavaWebAppSecurity.
5+
*
6+
* Licensed under the Apache License, Version 2.0 (the "License");
7+
* you may not use this file except in compliance with the License.
8+
* You may obtain a copy of the License at
9+
*
10+
* http://www.apache.org/licenses/LICENSE-2.0
11+
*
12+
* Unless required by applicable law or agreed to in writing, software
13+
* distributed under the License is distributed on an "AS IS" BASIS,
14+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
15+
* See the License for the specific language governing permissions and
16+
* limitations under the License.
17+
*/
18+
package de.dominikschadow.webappsecurity;
19+
20+
import java.io.IOException;
21+
import java.io.PrintWriter;
22+
23+
import javax.servlet.ServletException;
24+
import javax.servlet.http.HttpServlet;
25+
import javax.servlet.http.HttpServletRequest;
26+
import javax.servlet.http.HttpServletResponse;
27+
28+
/**
29+
* @author Dominik Schadow
30+
*/
31+
public class ProtectedServlet extends HttpServlet {
32+
private static final long serialVersionUID = 1L;
33+
34+
/**
35+
* @see HttpServlet#HttpServlet()
36+
*/
37+
public ProtectedServlet() {
38+
super();
39+
}
40+
41+
/**
42+
* @see HttpServlet#doPost(HttpServletRequest request, HttpServletResponse response)
43+
*/
44+
protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException,
45+
IOException {
46+
System.out.println("Processing POST request");
47+
48+
String name = request.getParameter("name");
49+
System.out.println("Received " + name + " as POST parameter");
50+
51+
response.setContentType("text/html");
52+
53+
PrintWriter out = response.getWriter();
54+
out.println("<html><body>");
55+
out.println("<p>Received " + name + " as POST parameter</p>");
56+
out.println("</body></html>");
57+
out.flush();
58+
out.close();
59+
}
60+
}

‎Ch08_CSRF/src/main/webapp/WEB-INF/web.xml‎

Lines changed: 12 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
<web-app xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://java.sun.com/xml/ns/javaee" xmlns:web="http://java.sun.com/xml/ns/javaee/web-app_2_5.xsd" xsi:schemaLocation="http://java.sun.com/xml/ns/javaee http://java.sun.com/xml/ns/javaee/web-app_3_0.xsd" id="CSRF" version="3.0">
33
<display-name>Cross-Site Request Forgery Sample Application</display-name>
44
<servlet>
5-
<description></description>
5+
<description>Servlet to handle POST and GET requests without any protection</description>
66
<display-name>CSRFServlet</display-name>
77
<servlet-name>CSRFServlet</servlet-name>
88
<servlet-class>de.dominikschadow.webappsecurity.CSRFServlet</servlet-class>
@@ -11,4 +11,15 @@
1111
<servlet-name>CSRFServlet</servlet-name>
1212
<url-pattern>/CSRFServlet</url-pattern>
1313
</servlet-mapping>
14+
15+
<servlet>
16+
<description>Servlet to handle POST requests with random user value protection</description>
17+
<display-name>ProtectedServlet</display-name>
18+
<servlet-name>ProtectedServlet</servlet-name>
19+
<servlet-class>de.dominikschadow.webappsecurity.ProtectedServlet</servlet-class>
20+
</servlet>
21+
<servlet-mapping>
22+
<servlet-name>ProtectedServlet</servlet-name>
23+
<url-pattern>/ProtectedServlet</url-pattern>
24+
</servlet-mapping>
1425
</web-app>

‎Ch08_CSRF/src/main/webapp/index.jsp‎

Lines changed: 28 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -8,19 +8,21 @@
88
<body>
99
<h1>Cross-Site Request Forgery</h1>
1010

11-
<h2>GET</h2>
11+
<h2>Unprotected</h2>
1212

13-
<h3>Normal browser link</h3>
13+
<h3>GET</h3>
14+
15+
<h4>Normal browser link</h4>
1416

1517
<a href="CSRFServlet?name=BrowserLink">Send</a>
1618

17-
<h3>Image</h3>
19+
<h4>Image</h4>
1820

1921
<a href="image.html">Image</a>
2022

21-
<h2>POST</h2>
23+
<h3>POST</h3>
2224

23-
<h3>Normal browser form</h3>
25+
<h4>Normal browser form</h4>
2426

2527
<form name="greeting" method="post" action="CSRFServlet">
2628
<table>
@@ -32,8 +34,28 @@
3234
</table>
3335
</form>
3436

35-
<h3>XMLHttpRequest</h3>
37+
<h4>XMLHttpRequest</h4>
3638

3739
<a href="xmlhttprequest.html">XMLHttpRequest</a>
40+
41+
<h2>Protected</h2>
42+
43+
<h3>POST</h3>
44+
45+
<h4>Normal browser form</h4>
46+
47+
<form name="greetingProtected" method="post" action="ProtectedServlet">
48+
<table>
49+
<tr>
50+
<td>Name</td>
51+
<td><input type="text" name="name"></td>
52+
<td><input type="submit" value="Senden"></td>
53+
</tr>
54+
</table>
55+
</form>
56+
57+
<h4>XMLHttpRequest</h4>
58+
59+
<a href="xmlhttprequest-protected.html">XMLHttpRequest</a>
3860
</body>
3961
</html>

‎Ch08_CSRF/src/main/webapp/xmlhttprequest-protected.html‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
<html>
2+
<head>
3+
<title>Cross-Site Request Forgery</title>
4+
5+
<script type="text/javascript">
6+
function sendForm() {
7+
var params = "name=CSRF-XMLHttpRequest";
8+
9+
var request = new XMLHttpRequest();
10+
request.open("POST", "http://localhost:8080/CSRF/ProtectedServlet", true);
11+
request.setRequestHeader("Content-type", "application/x-www-form-urlencoded");
12+
request.send(params);
13+
14+
request.onreadystatechange = function() {
15+
if (request.readyState == 4 && request.status == 200) {
16+
alert("Response " + request.responseText);
17+
}
18+
};
19+
}
20+
</script>
21+
</head>
22+
<body onload="sendForm()">
23+
<h1>Form post with XMLHttpRequest</h1>
24+
</body>
25+
</html>

0 commit comments

Comments
 (0)