com.google.gwt.user.server.rpc

## Class XsrfProtectedServiceServlet

- java.lang.Object
- - javax.servlet.GenericServlet
  - - javax.servlet.http.HttpServlet
    - - com.google.gwt.user.server.rpc.AbstractRemoteServiceServlet
      - - com.google.gwt.user.server.rpc.RemoteServiceServlet
        - - com.google.gwt.user.server.rpc.AbstractXsrfProtectedServiceServlet
          - - com.google.gwt.user.server.rpc.XsrfProtectedServiceServlet

All Implemented Interfaces:
  SerializationPolicyProvider, java.io.Serializable, javax.servlet.Servlet, javax.servlet.ServletConfig

    public class XsrfProtectedServiceServlet
    extends AbstractXsrfProtectedServiceServlet

EXPERIMENTAL and subject to change. Do not use this in production code.

The servlet base class for RPC service implementations using default XSRF protection tied to authentication session cookie.

XSRF token validation is performed by generating MD5 hash of the session cookie and comparing supplied `XsrfToken` with the generated hash. Session cookie name is specified by the "gwt.xsrf.session_cookie_name" context parameter in `web.xml`.

`XsrfTokenService` can be used by clients to obtain `XsrfToken`s that will pass validation performed by this class.

See Also:
  `XsrfTokenServiceServlet`, `AbstractXsrfProtectedServiceServlet`, Serialized Form

### Field Summary

Fields
`(package private) java.lang.String` `sessionCookieName`

### Fields inherited from class com.google.gwt.user.server.rpc.AbstractRemoteServiceServlet

`perThreadRequest, perThreadResponse`

### Constructor Summary

Constructors
Constructor and Description
`XsrfProtectedServiceServlet()`
`XsrfProtectedServiceServlet(java.lang.Object delegate)`
`XsrfProtectedServiceServlet(java.lang.Object delegate, java.lang.String sessionCookieName)`
`XsrfProtectedServiceServlet(java.lang.String sessionCookieName)`

### Method Summary

All Methods Instance Methods Concrete Methods
`void` `init()`
`protected void` `validateXsrfToken(RpcToken token, java.lang.reflect.Method method)` Validates `XsrfToken` included with `RPCRequest` against XSRF cookie.

### Methods inherited from class com.google.gwt.user.server.rpc.AbstractXsrfProtectedServiceServlet

`onAfterRequestDeserialized, shouldValidateXsrfToken`

### Methods inherited from class com.google.gwt.user.server.rpc.RemoteServiceServlet

`checkPermutationStrongName, doGetSerializationPolicy, getCodeServerPolicyUrl, getRequestModuleBasePath, getSerializationPolicy, init, loadPolicyFromCodeServer, loadSerializationPolicy, onAfterResponseSerialized, onBeforeRequestDeserialized, processCall, processCall, processPost, shouldCompressResponse`

### Methods inherited from class com.google.gwt.user.server.rpc.AbstractRemoteServiceServlet

`doPost, doUnexpectedFailure, getPermutationStrongName, getThreadLocalRequest, getThreadLocalResponse, readContent`

### Methods inherited from class javax.servlet.http.HttpServlet

`doDelete, doGet, doHead, doOptions, doPut, doTrace, getLastModified, service, service`

### Methods inherited from class javax.servlet.GenericServlet

`destroy, getInitParameter, getInitParameterNames, getServletConfig, getServletContext, getServletInfo, getServletName, log, log`

### Methods inherited from class java.lang.Object

`clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait`

### Field Detail

#### sessionCookieName

    java.lang.String sessionCookieName

### Constructor Detail

#### XsrfProtectedServiceServlet

    public XsrfProtectedServiceServlet()

#### XsrfProtectedServiceServlet

    public XsrfProtectedServiceServlet(java.lang.String sessionCookieName)

#### XsrfProtectedServiceServlet

    public XsrfProtectedServiceServlet(java.lang.Object delegate)

#### XsrfProtectedServiceServlet

    public XsrfProtectedServiceServlet(java.lang.Object delegate,
                                       java.lang.String sessionCookieName)

### Method Detail

#### init

    public void init()
              throws javax.servlet.ServletException

Overrides:
  `init` in class `javax.servlet.GenericServlet`
Throws:
  `javax.servlet.ServletException`

#### validateXsrfToken

    protected void validateXsrfToken(RpcToken token,
                                     java.lang.reflect.Method method)
                              throws RpcTokenException

Validates `XsrfToken` included with `RPCRequest` against XSRF cookie.

Specified by:
  `validateXsrfToken` in class `AbstractXsrfProtectedServiceServlet`
Parameters:
  `token` - `RpcToken` included with an RPC request.
  `method` - method being invoked via this RPC call.
Throws:
  `RpcTokenException` - if token verification failed.