Package org.springframework.security.web.csrf

# Class CookieCsrfTokenRepository

java.lang.Object
org.springframework.security.web.csrf.CookieCsrfTokenRepository

All Implemented Interfaces:
  `CsrfTokenRepository`

public final class CookieCsrfTokenRepository extends Object implements CsrfTokenRepository
A `CsrfTokenRepository` that persists the CSRF token in a cookie named "XSRF-TOKEN" and reads from the header "X-XSRF-TOKEN" following the conventions of AngularJS. When using with AngularJS be sure to use `withHttpOnlyFalse()`.

Since:
  4.1

## Constructor Summary

Constructors
Constructor
Description
`CookieCsrfTokenRepository()`

## Method Summary

Modifier and Type
Method
Description
`CsrfToken`
`generateToken(jakarta.servlet.http.HttpServletRequest request)`
Generates a `CsrfToken`
`String`
`getCookiePath()`
Get the path that the CSRF cookie will be set to.
`CsrfToken`
`loadToken(jakarta.servlet.http.HttpServletRequest request)`
Loads the expected `CsrfToken` from the `HttpServletRequest`
`void`
`saveToken(CsrfToken token, jakarta.servlet.http.HttpServletRequest request, jakarta.servlet.http.HttpServletResponse response)`
Saves the `CsrfToken` using the `HttpServletRequest` and `HttpServletResponse`.
`void`
`setCookieCustomizer(Consumer<org.springframework.http.ResponseCookie.ResponseCookieBuilder> cookieCustomizer)`
Add a `Consumer` for a `ResponseCookieBuilder` that will be invoked for each cookie being built, just before the call to `build()`.
`void`
`setCookieDomain(String cookieDomain)`
Deprecated.
Use `setCookieCustomizer(Consumer)` instead.
`void`
`setCookieHttpOnly(boolean cookieHttpOnly)`
Deprecated.
Use `setCookieCustomizer(Consumer)` instead.
`void`
`setCookieMaxAge(int cookieMaxAge)`
Deprecated.
Use `setCookieCustomizer(Consumer)` instead.
`void`
`setCookieName(String cookieName)`
Sets the name of the cookie that the expected CSRF token is saved to and read from.
`void`
`setCookiePath(String path)`
Set the path that the Cookie will be created with.
`void`
`setHeaderName(String headerName)`
Sets the name of the HTTP header that should be used to provide the token.
`void`
`setParameterName(String parameterName)`
Sets the name of the HTTP request parameter that should be used to provide a token.
`void`
`setSecure(Boolean secure)`
Deprecated.
Use `setCookieCustomizer(Consumer)` instead.
`static CookieCsrfTokenRepository`
`withHttpOnlyFalse()`
Factory method to conveniently create an instance that creates cookies where `Cookie.isHttpOnly()` is set to false.

### Methods inherited from class java.lang.Object

`clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait`

### Methods inherited from interface org.springframework.security.web.csrf.CsrfTokenRepository

`loadDeferredToken`

## Constructor Details

### CookieCsrfTokenRepository

public CookieCsrfTokenRepository()

## Method Details

### setCookieCustomizer

public void setCookieCustomizer(Consumer<org.springframework.http.ResponseCookie.ResponseCookieBuilder> cookieCustomizer)
Add a `Consumer` for a `ResponseCookieBuilder` that will be invoked for each cookie being built, just before the call to `build()`.

Parameters:
  `cookieCustomizer` - consumer for a cookie builder
Since:
  6.1

### generateToken

public CsrfToken generateToken(jakarta.servlet.http.HttpServletRequest request)
Description copied from interface: `CsrfTokenRepository`
Generates a `CsrfToken`

Specified by:
  `generateToken` in interface `CsrfTokenRepository`
Parameters:
  `request` - the `HttpServletRequest` to use
Returns:
  the `CsrfToken` that was generated. Cannot be null.

### saveToken

public void saveToken(CsrfToken token, jakarta.servlet.http.HttpServletRequest request, jakarta.servlet.http.HttpServletResponse response)
Description copied from interface: `CsrfTokenRepository`
Saves the `CsrfToken` using the `HttpServletRequest` and `HttpServletResponse`. If the `CsrfToken` is null, it is the same as deleting it.

Specified by:
  `saveToken` in interface `CsrfTokenRepository`
Parameters:
  `token` - the `CsrfToken` to save or null to delete
  `request` - the `HttpServletRequest` to use
  `response` - the `HttpServletResponse` to use

### loadToken

public CsrfToken loadToken(jakarta.servlet.http.HttpServletRequest request)
Description copied from interface: `CsrfTokenRepository`
Loads the expected `CsrfToken` from the `HttpServletRequest`

Specified by:
  `loadToken` in interface `CsrfTokenRepository`
Parameters:
  `request` - the `HttpServletRequest` to use
Returns:
  the `CsrfToken` or null if none exists

### setParameterName

public void setParameterName(String parameterName)
Sets the name of the HTTP request parameter that should be used to provide a token.

Parameters:
  `parameterName` - the name of the HTTP request parameter that should be used to provide a token

### setHeaderName

public void setHeaderName(String headerName)
Sets the name of the HTTP header that should be used to provide the token.

Parameters:
  `headerName` - the name of the HTTP header that should be used to provide the token

### setCookieName

public void setCookieName(String cookieName)
Sets the name of the cookie that the expected CSRF token is saved to and read from.

Parameters:
  `cookieName` - the name of the cookie that the expected CSRF token is saved to and read from

### setCookieHttpOnly

@Deprecated(since="6.1") public void setCookieHttpOnly(boolean cookieHttpOnly)
Deprecated.
Use `setCookieCustomizer(Consumer)` instead.

### withHttpOnlyFalse

public static CookieCsrfTokenRepository withHttpOnlyFalse()
Factory method to conveniently create an instance that creates cookies where `Cookie.isHttpOnly()` is set to false.

Returns:
  an instance of CookieCsrfTokenRepository that creates cookies where `Cookie.isHttpOnly()` is set to false.

### setCookiePath

public void setCookiePath(String path)
Set the path that the Cookie will be created with. This will override the default functionality which uses the request context as the path.

Parameters:
  `path` - the path to use

### getCookiePath

public String getCookiePath()
Get the path that the CSRF cookie will be set to.

Returns:
  the path to be used.

### setCookieDomain

@Deprecated(since="6.1") public void setCookieDomain(String cookieDomain)
Deprecated.
Use `setCookieCustomizer(Consumer)` instead.

Since:
  5.2

### setSecure

@Deprecated(since="6.1") public void setSecure(Boolean secure)
Deprecated.
Use `setCookieCustomizer(Consumer)` instead.

Since:
  5.4

### setCookieMaxAge

@Deprecated(since="6.1") public void setCookieMaxAge(int cookieMaxAge)
Deprecated.
Use `setCookieCustomizer(Consumer)` instead.

Since:
  5.5