retrieving tokens from TokenHolder interface

[itachiuchihamadara]

Do you have any idea on how to retrieve tokens that are stored in InMemoryTokenHolder? In our project with version 3.1.0 we usually compare CSRF tokens from request with httpsession [since HttpSession contains csrf tokens as an attribute] and check equality. However, from version 4.0.0 we cannot retrieve csrf token attribute from sessions. In this case what can be done and how can I retrieve tokens from TokenHolder to be compared with request token since httpsession no longer contain csrf attribute?

[forgedhallpass]

Hello @itachiuchihamadara

I am not sure I understand why would you want to access the CSRF tokens. Everything should happen seamlessly within CSRF Guard.

[forgedhallpass]

Something is not right on your side. There is no validateCsrfToken method in the latest version of CSRF Guard, also the doFilter line number doesn't match either. See:

www-project-csrfguard/csrfguard/src/main/java/org/owasp/csrfguard/CsrfGuardFilter.java

Line 58 in 74008a2

public void doFilter(final ServletRequest request, final ServletResponse response, final FilterChain filterChain) throws IOException, ServletException {

As mentioned earlier, the CSRF token validation happens seamlessly. Please make sure to use the right dependencies: https://github.com/OWASP/www-project-csrfguard#using-with-maven

The same goes for the JavaScript and properties files as well.

To see a working setup where you can easily debug or play around, please refer to the provided test application:
https://github.com/OWASP/www-project-csrfguard/tree/master/csrfguard-test/csrfguard-test-jsp

[forgedhallpass]

I still don't understand your use-case. Request tokens are validated in the code I've linked above. In version 4.x, CSRFGuard doesn't store CSRF tokens on the session anymore, but through the TokenHolder interface. This abstraction was introduced to also support stateless(sessionless) applications. The InMemoryTokenHolder is the default implementation, but you can also create your own storage (e.g. database) if you want by implementing the interface and setting the org.owasp.csrfguard.TokenHolder in your csrfguard.properties file (see

www-project-csrfguard/csrfguard/src/main/resources/csrfguard.properties

Line 447 in 74008a2

## Custom Token storage ##

)

Furthermore, CSRF attacks are limited to a browser context (which is handled by CSRFGuard already), hence for machine-to-machine(m2m) interactions it is not needed.

Have you checked out the test application like I've recommended?