com.google.gwt.user.server.rpc

## Class XsrfProtectedServiceServlet

- java.lang.Object
- - javax.servlet.GenericServlet
  - - javax.servlet.http.HttpServlet
    - - com.google.gwt.user.server.rpc.AbstractRemoteServiceServlet
      - - com.google.gwt.user.server.rpc.RemoteServiceServlet
        - - com.google.gwt.user.server.rpc.AbstractXsrfProtectedServiceServlet
          - - com.google.gwt.user.server.rpc.XsrfProtectedServiceServlet

- All Implemented Interfaces:
    SerializationPolicyProvider, java.io.Serializable, javax.servlet.Servlet, javax.servlet.ServletConfig

      public class XsrfProtectedServiceServlet
      extends AbstractXsrfProtectedServiceServlet

  EXPERIMENTAL and subject to change. Do not use this in production code.

  The servlet base class for RPC service implementations using default XSRF protection tied to authentication session cookie.

  XSRF token validation is performed by generating MD5 hash of the session cookie and comparing supplied `XsrfToken` with the generated hash. Session cookie name is specified by the "gwt.xsrf.session_cookie_name" context parameter in `web.xml`.

  `XsrfTokenService` can be used by clients to obtain `XsrfToken`s that will pass validation performed by this class.

  See Also:
    `XsrfTokenServiceServlet`, `AbstractXsrfProtectedServiceServlet`, Serialized Form

- - ### Field Summary

    Fields
    Modifier and Type | Field and Description
    --- | ---
    `(package private) java.lang.String` | `sessionCookieName`

    - ### Fields inherited from class com.google.gwt.user.server.rpc.AbstractRemoteServiceServlet

      `perThreadRequest, perThreadResponse`

  - ### Constructor Summary

    Constructors
    Constructor and Description
    `XsrfProtectedServiceServlet()`
    `XsrfProtectedServiceServlet(java.lang.Object delegate)`
    `XsrfProtectedServiceServlet(java.lang.Object delegate, java.lang.String sessionCookieName)`
    `XsrfProtectedServiceServlet(java.lang.String sessionCookieName)`

  - ### Method Summary

    Methods
    Modifier and Type | Method and Description
    --- | ---
    `void` | `init()`
    `protected void` | `validateXsrfToken(RpcToken token, java.lang.reflect.Method method)` Validates `XsrfToken` included with `RPCRequest` against XSRF cookie.

    - ### Methods inherited from class com.google.gwt.user.server.rpc.AbstractXsrfProtectedServiceServlet

      `onAfterRequestDeserialized, shouldValidateXsrfToken`

    - ### Methods inherited from class com.google.gwt.user.server.rpc.RemoteServiceServlet

      `checkPermutationStrongName, doGetSerializationPolicy, getSerializationPolicy, loadSerializationPolicy, onAfterResponseSerialized, onBeforeRequestDeserialized, processCall, processPost, shouldCompressResponse`

    - ### Methods inherited from class com.google.gwt.user.server.rpc.AbstractRemoteServiceServlet

      `doPost, doUnexpectedFailure, getPermutationStrongName, getThreadLocalRequest, getThreadLocalResponse, readContent`

    - ### Methods inherited from class javax.servlet.http.HttpServlet

      `doDelete, doGet, doHead, doOptions, doPut, doTrace, getLastModified, service, service`

    - ### Methods inherited from class javax.servlet.GenericServlet

      `destroy, getInitParameter, getInitParameterNames, getServletConfig, getServletContext, getServletInfo, getServletName, init, log, log`

    - ### Methods inherited from class java.lang.Object

      `clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait`

- - ### Field Detail

    - #### sessionCookieName

          java.lang.String sessionCookieName

  - ### Constructor Detail

    - #### XsrfProtectedServiceServlet

          public XsrfProtectedServiceServlet()

    - #### XsrfProtectedServiceServlet

          public XsrfProtectedServiceServlet(java.lang.String sessionCookieName)

    - #### XsrfProtectedServiceServlet

          public XsrfProtectedServiceServlet(java.lang.Object delegate)

    - #### XsrfProtectedServiceServlet

          public XsrfProtectedServiceServlet(java.lang.Object delegate,
                                     java.lang.String sessionCookieName)

  - ### Method Detail

    - #### init

          public void init()
                    throws javax.servlet.ServletException

      Overrides:
        `init` in class `javax.servlet.GenericServlet`
      Throws:
        `javax.servlet.ServletException`

    - #### validateXsrfToken

          protected void validateXsrfToken(RpcToken token,
                               java.lang.reflect.Method method)
                                    throws RpcTokenException

      Validates `XsrfToken` included with `RPCRequest` against XSRF cookie.
      Specified by:
        `validateXsrfToken` in class `AbstractXsrfProtectedServiceServlet`
      Parameters:
        `token` - `RpcToken` included with an RPC request.
        `method` - method being invoked via this RPC call.
      Throws:
        `RpcTokenException` - if token verification failed.