1

I need to implement a CSRF filter in my application which is running on Tomcat 7. I have Used Tomcat CSRF Filter to make this filter works in my Application. I need to submit every action needs to encoded by HttpServlet#encodeURL

Since my application is very legacy there are lot of jsp's nearly 700 which are calling actions from jsp to jsp or jsp to servlet using Scriptlet tag or Javascript.

How to configure a filter or any kind of mechanism which makes every action which submitted to servlet will be encoded by HttpServletResponse#encodeURL

Anyway I have tried to implement a filter which will wraps Servlet Request with encodedURL,I have followed this link Request URL Rewriting as below.

public class UrlRewriteFilter implements Filter {

@Override
public void init(FilterConfig config) throws ServletException {
    //
}

 @Override
public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
    final HttpServletRequest req = (HttpServletRequest) request;
    final HttpServletResponse res = (HttpServletResponse) response;
    final HttpServletRequestWrapper wrapped = new HttpServletRequestWrapper(req) {
        @Override
        public StringBuffer getRequestURL() {
            final StringBuffer originalUrl = ((HttpServletRequest) req).getRequestURL();
            return new StringBuffer(res.encodeURL(req.getRequestURL()));
//I have added in above string Buffer building with including server path, but still no work
        }
    };
    chain.doFilter(wrapped, response);
}

@Override
public void destroy() {
    //
}
}

I have tried the above solution, Still Not working

Not working means The filter CsrfPreventionFilter is denying every request by returning 403 code. if I submit any jsp with response.encodeURL("url") its working.

Please help to suggest anyway which i can write a filter.

Community
  • 1
  • 1
Rookie007
  • 1,229
  • 2
  • 18
  • 50
  • Did you tried running this and is it working? What's the issue now? – lsiva Sep 20 '16 at 14:40
  • @Isiva No its not working the filter is still denying requests. – Rookie007 Sep 20 '16 at 14:45
  • 1
    Sorry not providing full answer. I use HandlerInterceptorAdapter (an Spring request listener) to generate a token if needed (GET) and to validate a token (POST) the token will be read from HttpSession and also set there if needed. After the servlets methods you should fetch what is on session and setting on request. (Aspect programming could help here or some filter/listener) – corlaez Nov 10 '16 at 16:49

0 Answers0