Package com.google.gwt.user.server.rpc.jakarta

## Class XsrfProtectedServiceServlet

- java.lang.Object
- - jakarta.servlet.GenericServlet
  - - jakarta.servlet.http.HttpServlet
    - - com.google.gwt.user.server.rpc.jakarta.AbstractRemoteServiceServlet
      - - com.google.gwt.user.server.rpc.jakarta.RemoteServiceServlet
        - - com.google.gwt.user.server.rpc.jakarta.AbstractXsrfProtectedServiceServlet
          - - com.google.gwt.user.server.rpc.jakarta.XsrfProtectedServiceServlet

- All Implemented Interfaces:
    `SerializationPolicyProvider`, `jakarta.servlet.Servlet`, `jakarta.servlet.ServletConfig`, `java.io.Serializable`

      public class XsrfProtectedServiceServlet
      extends AbstractXsrfProtectedServiceServlet

  EXPERIMENTAL and subject to change. Do not use this in production code.

  The servlet base class for RPC service implementations using default XSRF protection tied to authentication session cookie.

  XSRF token validation is performed by generating MD5 hash of the session cookie and comparing supplied `XsrfToken` with the generated hash. Session cookie name is specified by the "gwt.xsrf.session_cookie_name" context parameter in `web.xml`.

  `XsrfTokenService` can be used by clients to obtain `XsrfToken`s that will pass validation performed by this class.

  See Also:
    `XsrfTokenServiceServlet`, `AbstractXsrfProtectedServiceServlet`, Serialized Form

- - ### Field Summary

    Fields
    Modifier and Type | Field | Description
    --- | --- | ---
    `(package private) java.lang.String` | `sessionCookieName` |

    - ### Fields inherited from class com.google.gwt.user.server.rpc.jakarta.AbstractRemoteServiceServlet

      `perThreadRequest, perThreadResponse`

  - ### Constructor Summary

    Constructors
    Constructor | Description
    --- | ---
    `XsrfProtectedServiceServlet()` |
    `XsrfProtectedServiceServlet​(java.lang.Object delegate)` |
    `XsrfProtectedServiceServlet​(java.lang.Object delegate, java.lang.String sessionCookieName)` |
    `XsrfProtectedServiceServlet​(java.lang.String sessionCookieName)` |

  - ### Method Summary

    All Methods Instance Methods Concrete Methods
    Modifier and Type | Method | Description
    --- | --- | ---
    `void` | `init()` |
    `protected void` | `validateXsrfToken​(RpcToken token, java.lang.reflect.Method method)` | Validates `XsrfToken` included with `RPCRequest` against XSRF cookie.

    - ### Methods inherited from class com.google.gwt.user.server.rpc.jakarta.AbstractXsrfProtectedServiceServlet

      `onAfterRequestDeserialized, shouldValidateXsrfToken`

    - ### Methods inherited from class com.google.gwt.user.server.rpc.jakarta.RemoteServiceServlet

      `checkPermutationStrongName, doGetSerializationPolicy, getCodeServerPolicyUrl, getRequestModuleBasePath, getSerializationPolicy, init, loadPolicyFromCodeServer, loadSerializationPolicy, onAfterResponseSerialized, onBeforeRequestDeserialized, processCall, processCall, processPost`

    - ### Methods inherited from class com.google.gwt.user.server.rpc.jakarta.AbstractRemoteServiceServlet

      `doPost, doUnexpectedFailure, getPermutationStrongName, getThreadLocalRequest, getThreadLocalResponse, readContent`

    - ### Methods inherited from class jakarta.servlet.http.HttpServlet

      `doDelete, doGet, doHead, doOptions, doPut, doTrace, getLastModified, service, service`

    - ### Methods inherited from class jakarta.servlet.GenericServlet

      `destroy, getInitParameter, getInitParameterNames, getServletConfig, getServletContext, getServletInfo, getServletName, log, log`

    - ### Methods inherited from class java.lang.Object

      `clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait`

- - ### Field Detail

    - #### sessionCookieName

          java.lang.String sessionCookieName

  - ### Constructor Detail

    - #### XsrfProtectedServiceServlet

          public XsrfProtectedServiceServlet()

    - #### XsrfProtectedServiceServlet

          public XsrfProtectedServiceServlet​(java.lang.String sessionCookieName)

    - #### XsrfProtectedServiceServlet

          public XsrfProtectedServiceServlet​(java.lang.Object delegate)

    - #### XsrfProtectedServiceServlet

          public XsrfProtectedServiceServlet​(java.lang.Object delegate,
                                             java.lang.String sessionCookieName)

  - ### Method Detail

    - #### init

          public void init()
                    throws jakarta.servlet.ServletException

      Overrides:
        `init` in class `jakarta.servlet.GenericServlet`
      Throws:
        `jakarta.servlet.ServletException`

    - #### validateXsrfToken

          protected void validateXsrfToken​(RpcToken token,
                                           java.lang.reflect.Method method)
                                    throws RpcTokenException

      Validates `XsrfToken` included with `RPCRequest` against XSRF cookie.
      Specified by:
        `validateXsrfToken` in class `AbstractXsrfProtectedServiceServlet`
      Parameters:
        `token` - `RpcToken` included with an RPC request.
        `method` - method being invoked via this RPC call.
      Throws:
        `RpcTokenException` - if token verification failed.