bayou.form

Class CsrfException

java.lang.Object

java.lang.Throwable

java.lang.Exception

bayou.form.CsrfException

All Implemented Interfaces:

Serializable

public class CsrfException
extends Exception

To indicate that an HTTP POST request might be CSRF.

This exception is used when a FormParser cannot definitely prove that a request is non-CSRF.

Generate a response for a CsrfException

Always assume that the client is innocent when generating an error response for a CsrfException (at the risk of being too nice to a real attacker).

Possible reasons for the CsrfException (assuming the client is innocent):

• If the application does *not* use CsrfToken in the form,
  it's likely that the client hides/obfuscates Referer headers for privacy reasons.
• If the application *does* use CsrfToken in the form,
  it's likely that the client disables cookies *and* hides/obfuscates Referer headers.

See Also:

Serialized Form

Constructor Summary

Constructors

Constructor and Description
CsrfException(String msg)

Method Summary

Methods inherited from class java.lang.Throwable

addSuppressed, fillInStackTrace, getCause, getLocalizedMessage, getMessage, getStackTrace, getSuppressed, initCause, printStackTrace, printStackTrace, printStackTrace, setStackTrace, toString

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, wait, wait, wait

Constructor Detail

CsrfException

public CsrfException(String msg)