Package com.google.gerrit.server.mail

Class SignedToken

java.lang.Object
com.google.gerrit.server.mail.SignedToken
public class SignedToken extends Object
Utility function to compute and verify XSRF tokens.

SignedTokenEmailTokenVerifier uses this class to verify tokens appearing in the custom xsrfKey JSON request property. The tokens protect against cross-site request forgery by depending upon the browser's security model. The classic browser security model prohibits a script from site A from reading any data received from site B. By sending unforgeable tokens from the server and asking the client to return them to us, the client script must have had read access to the token at some point and is therefore also from our server.

  • Constructor Details

    • SignedToken

      public SignedToken(int age, String keyBase64) throws XsrfException
      Create a new utility, using the specific key.
      Parameters:
      age - the number of seconds a token may remain valid.
      keyBase64 - base 64 encoded representation of the key.
      Throws:
      XsrfException - the JVM doesn't support the necessary algorithms.

  • Method Details

    • generateRandomKey

      public static String generateRandomKey()
      Generate a random key for use with the XSRF library.
      Returns:
      a new private key, base 64 encoded.

    • checkToken

      public com.google.gerrit.server.mail.ValidToken checkToken(String tokenString, String text) throws XsrfException, CheckTokenException
      Validate a returned token. If the token is valid then return a ValidToken, else will throw XsrfException when it's an unexpected token overflow or CheckTokenException when it's an illegal token string format.
      Parameters:
      tokenString - a token string previously created by this class.
      text - text that must have been used during newToken(String) in order for the token to be valid. If null the text will be taken from the token string itself.
      Returns:
      the token which is valid.
      Throws:
      XsrfException - the JVM doesn't support the necessary algorithms to generate a token. XSRF services are simply not available.
      CheckTokenException - throws when token is null, the empty string, has expired, does not match the text supplied, or is a forged token.