Skip to content

Add option to get the CSRF token from the Session Storage #1501

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 3 commits into from
Feb 27, 2022
Merged

Add option to get the CSRF token from the Session Storage #1501

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
650ca27
Added CSRF Session Storage config properties and html transformer
Feb 10, 2022
8418aa8
Deleted apostrophes/quotation marks from CSRF token header value. Thi…
Feb 10, 2022
e9bab25
Fixed addCSRFLocalStorage indentation issue: Some backslashes were mi…
Feb 10, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
46 changes: 46 additions & 0 deletions springdoc-openapi-common/src/main/java/org/springdoc/core/SwaggerUiConfigProperties.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -145,6 +145,11 @@ public static class Csrf {
*/
private boolean useLocalStorage;

/**
* Use Session storage.
*/
private boolean useSessionStorage;

/**
* The Cookie name.
*/
Expand All @@ -155,6 +160,11 @@ public static class Csrf {
*/
private String localStorageKey = Constants.CSRF_DEFAULT_LOCAL_STORAGE_KEY;

/**
* The Session storage key.
*/
private String sessionStorageKey = Constants.CSRF_DEFAULT_LOCAL_STORAGE_KEY;

/**
* The Header name.
*/
Expand Down Expand Up @@ -187,6 +197,15 @@ public boolean isUseLocalStorage() {
return useLocalStorage;
}

/**
* Use Session storage boolean.
*
* @return the boolean
*/
public boolean isUseSessionStorage() {
return useSessionStorage;
}

/**
* Sets useLocalStorage.
*
Expand All @@ -196,6 +215,15 @@ public void setUseLocalStorage(boolean useLocalStorage) {
this.useLocalStorage = useLocalStorage;
}

/**
* Sets useSessionStorage.
*
* @param useSessionStorage the use local storage
*/
public void setUseSessionStorage(boolean useSessionStorage) {
this.useSessionStorage = useSessionStorage;
}

/**
* Gets cookie name.
*
Expand Down Expand Up @@ -223,6 +251,15 @@ public String getLocalStorageKey() {
return localStorageKey;
}

/**
* Gets session storage key.
*
* @return the cookie name
*/
public String getSessionStorageKey() {
return sessionStorageKey;
}

/**
* Sets local storage key.
*
Expand All @@ -232,6 +269,15 @@ public void setLocalStorageKey(String localStorageKey) {
this.localStorageKey = localStorageKey;
}

/**
* Sets local storage key.
*
* @param sessionStorageKey the local storage key
*/
public void setSessionStorageKey(String sessionStorageKey) {
this.sessionStorageKey = sessionStorageKey;
}

/**
* Gets header name.
*
Expand Down
38 changes: 32 additions & 6 deletions springdoc-openapi-common/src/main/java/org/springdoc/ui/AbstractSwaggerIndexTransformer.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -145,6 +145,8 @@ protected String defaultTransformations(InputStream inputStream) throws IOExcept
if (swaggerUiConfig.isCsrfEnabled()) {
if (swaggerUiConfig.getCsrf().isUseLocalStorage())
html = addCSRFLocalStorage(html);
else if (swaggerUiConfig.getCsrf().isUseSessionStorage())
html = addCSRFSessionStorage(html);
else
html = addCSRF(html);
}
Expand Down Expand Up @@ -226,21 +228,45 @@ protected String addCSRF(String html) {
protected String addCSRFLocalStorage(String html) {
StringBuilder stringBuilder = new StringBuilder();
stringBuilder.append("requestInterceptor: (request) => {\n");
stringBuilder.append("t\t\tconst value = window.localStorage.getItem('");
stringBuilder.append("\t\t\tconst value = window.localStorage.getItem('");
stringBuilder.append(swaggerUiConfig.getCsrf().getLocalStorageKey() + "');\n");
stringBuilder.append("t\t\tconst currentURL = new URL(document.URL);\n");
stringBuilder.append("t\t\tconst requestURL = new URL(request.url, document.location.origin);\n");
stringBuilder.append("t\t\tconst isSameOrigin = (currentURL.protocol === requestURL.protocol && currentURL.host === requestURL.host);\n");
stringBuilder.append("t\t\tif (isSameOrigin) ");
stringBuilder.append("\t\t\tconst currentURL = new URL(document.URL);\n");
stringBuilder.append("\t\t\tconst requestURL = new URL(request.url, document.location.origin);\n");
stringBuilder.append("\t\t\tconst isSameOrigin = (currentURL.protocol === requestURL.protocol && currentURL.host === requestURL.host);\n");
stringBuilder.append("\t\t\tif (isSameOrigin) ");
stringBuilder.append("request.headers['");
stringBuilder.append(swaggerUiConfig.getCsrf().getHeaderName());
stringBuilder.append("'] = value;\n");
stringBuilder.append("t\t\treturn request;\n");
stringBuilder.append("\t\t\treturn request;\n");
stringBuilder.append("\t\t},\n");
stringBuilder.append("\t\t" + PRESETS);
return html.replace(PRESETS, stringBuilder.toString());
}

/**
* Add csrf string from Session storage.
*
* @param html the html
* @return the string
*/
protected String addCSRFSessionStorage(String html) {
StringBuilder stringBuilder = new StringBuilder();
stringBuilder.append("requestInterceptor: (request) => {\n");
stringBuilder.append("\t\t\tconst value = window.sessionStorage.getItem('");
stringBuilder.append(swaggerUiConfig.getCsrf().getSessionStorageKey() + "');\n");
stringBuilder.append("\t\t\tconst currentURL = new URL(document.URL);\n");
stringBuilder.append("\t\t\tconst requestURL = new URL(request.url, document.location.origin);\n");
stringBuilder.append("\t\t\tconst isSameOrigin = (currentURL.protocol === requestURL.protocol && currentURL.host === requestURL.host);\n");
stringBuilder.append("\t\t\tif (isSameOrigin) ");
stringBuilder.append("request.headers['");
stringBuilder.append(swaggerUiConfig.getCsrf().getHeaderName());
stringBuilder.append("'] = value.replace(/['\"]+/g,'');\n");
stringBuilder.append("\t\t\treturn request;\n");
stringBuilder.append("\t\t},\n");
stringBuilder.append("\t\t" + PRESETS);
return html.replace(PRESETS, stringBuilder.toString());
}

/**
* Add syntax highlight string.
*
Expand Down