Package com.google.gerrit.server.mail

Class SignedToken

java.lang.Object

com.google.gerrit.server.mail.SignedToken

public class SignedToken
extends Object

Utility function to compute and verify XSRF tokens.

SignedTokenEmailTokenVerifier uses this class to verify tokens appearing in the custom xsrfKey JSON request property. The tokens protect against cross-site request forgery by depending upon the browser's security model. The classic browser security model prohibits a script from site A from reading any data received from site B. By sending unforgeable tokens from the server and asking the client to return them to us, the client script must have had read access to the token at some point and is therefore also from our server.

Constructor Summary

Constructors

Constructor	Description
SignedToken(int age, String keyBase64)	Create a new utility, using the specific key.

Method Summary

Modifier and Type	Method	Description
com.google.gerrit.server.mail.ValidToken	checkToken(String tokenString, String text)	Validate a returned token.
static String	generateRandomKey()	Generate a random key for use with the XSRF library.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

SignedToken

public SignedToken(int age,
                   String keyBase64)
            throws XsrfException

Create a new utility, using the specific key.

Parameters:

age - the number of seconds a token may remain valid.

keyBase64 - base 64 encoded representation of the key.

Throws:

XsrfException - the JVM doesn't support the necessary algorithms.

Method Detail

generateRandomKey

public static String generateRandomKey()

Generate a random key for use with the XSRF library.

Returns:

a new private key, base 64 encoded.

checkToken

public com.google.gerrit.server.mail.ValidToken checkToken(String tokenString,
                                                           String text)
                                                    throws XsrfException,
                                                           CheckTokenException

Validate a returned token. If the token is valid then return a ValidToken, else will throw XsrfException when it's an unexpected token overflow or CheckTokenException when it's an illegal token string format.

Parameters:

tokenString - a token string previously created by this class.

text - text that must have been used during newToken(String) in order for the token to be valid. If null the text will be taken from the token string itself.

Returns:

the token which is valid.

Throws:

XsrfException - the JVM doesn't support the necessary algorithms to generate a token. XSRF services are simply not available.

CheckTokenException - throws when token is null, the empty string, has expired, does not match the text supplied, or is a forged token.