Attributes
- Companion
- trait
- Graph
-
- Supertypes
-
class Objecttrait Matchableclass Any
- Self type
-
Pac4jCsrfSupport.type
Members list
Value members
Concrete methods
A stub that always reports no token; suitable for tests that don't exercise the authenticated CSRF flow.
A stub that always reports no token; suitable for tests that don't exercise the authenticated CSRF flow.
Attributes
Registers ConstantTimeCsrfAuthorizer under the csrfCheck name in the Pac4j Config.
Registers ConstantTimeCsrfAuthorizer under the csrfCheck name in the Pac4j Config.
DefaultAuthorizationChecker.retrieveAuthorizer first consults config.getAuthorizers before falling back to pac4j-core's stock singleton CsrfAuthorizer; installing our subclass under the csrfCheck name therefore replaces the vulnerable hashEquals in the default authorizer chain that Pac4jHttpSecurity.secure applies to IndirectClient sessions.
Attributes
Overrides the default CsrfTokenGeneratorMatcher on the shared Config with a non-rotating one so the same token remains valid across many partial POSTs in a session.
Overrides the default CsrfTokenGeneratorMatcher on the shared Config with a non-rotating one so the same token remains valid across many partial POSTs in a session.
Pac4j's DefaultCsrfTokenGenerator rotates the token on every matched request. A single stale POST is accepted via the PREVIOUS_CSRF_TOKEN grace, but a second sequential POST with the same client-cached token fails 403. Frontends that render the token once per full page load and reuse it for every subsequent partial POST (HTMX, most SPA fetch clients) are incompatible with rotation. A stable per-session token matches that flow.
The token is delivered via the page (meta tag or hidden field) and echoed as a request header named pac4jCsrfToken — so we disable the matcher's cookie and header outputs and keep only the request-attribute output (used by pac4j-core internally).