Package org.springframework.security.web.csrf

Class CsrfAuthenticationStrategy

java.lang.Object

org.springframework.security.web.csrf.CsrfAuthenticationStrategy

All Implemented Interfaces:

SessionAuthenticationStrategy

public final class CsrfAuthenticationStrategy
extends Object
implements SessionAuthenticationStrategy

CsrfAuthenticationStrategy is in charge of removing the CsrfToken upon authenticating. A new CsrfToken will then be generated by the framework upon the next request.

Since:

3.2

Constructor Summary

Constructors

Constructor	Description
CsrfAuthenticationStrategy(CsrfTokenRepository csrfTokenRepository)	Creates a new instance

Method Summary

Modifier and Type	Method	Description
void	onAuthentication(Authentication authentication, jakarta.servlet.http.HttpServletRequest request, jakarta.servlet.http.HttpServletResponse response)	Performs Http session-related functionality when a new authentication occurs.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

CsrfAuthenticationStrategy

public CsrfAuthenticationStrategy(CsrfTokenRepository csrfTokenRepository)

Creates a new instance

Parameters:

csrfTokenRepository - the CsrfTokenRepository to use

Method Details

onAuthentication

public void onAuthentication(Authentication authentication,
 jakarta.servlet.http.HttpServletRequest request,
 jakarta.servlet.http.HttpServletResponse response)
                      throws SessionAuthenticationException

Description copied from interface: SessionAuthenticationStrategy

Performs Http session-related functionality when a new authentication occurs.

Specified by:

onAuthentication in interface SessionAuthenticationStrategy

Throws:

SessionAuthenticationException - if it is decided that the authentication is not allowed for the session. This will typically be because the user has too many sessions open at once.