Package org.springframework.security.web.header.writers.frameoptions

# Class AbstractRequestParameterAllowFromStrategy

java.lang.Object
org.springframework.security.web.header.writers.frameoptions.AbstractRequestParameterAllowFromStrategy

All Implemented Interfaces:
  `AllowFromStrategy`

Direct Known Subclasses:
  `RegExpAllowFromStrategy`, `WhiteListedAllowFromStrategy`

@Deprecated public abstract class AbstractRequestParameterAllowFromStrategy extends Object implements AllowFromStrategy
Deprecated.
ALLOW-FROM is an obsolete directive that no longer works in modern browsers. Instead use Content-Security-Policy with the frame-ancestors directive.
Base class for AllowFromStrategy implementations which use a request parameter to retrieve the origin. By default the parameter named `x-frames-allow-from` is read from the request.

Since:
  3.2

## Field Summary

Fields
Modifier and Type
Field
Description
`protected final org.apache.commons.logging.Log`
`log`
Deprecated.
Logger for use by subclasses

## Method Summary

Modifier and Type
Method
Description
`protected abstract boolean`
`allowed(String allowFromOrigin)`
Deprecated.
Method to be implemented by base classes, used to determine if the supplied origin is allowed.
`String`
`getAllowFromValue(jakarta.servlet.http.HttpServletRequest request)`
Deprecated.
Gets the value for ALLOW-FROM excluding the ALLOW-FROM.
`void`
`setAllowFromParameterName(String allowFromParameterName)`
Deprecated.
Sets the HTTP parameter used to retrieve the value for the origin that is allowed from.

### Methods inherited from class java.lang.Object

`clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait`

## Field Details

### log

protected final org.apache.commons.logging.Log log
Deprecated.
Logger for use by subclasses

## Method Details

### getAllowFromValue

public String getAllowFromValue(jakarta.servlet.http.HttpServletRequest request)
Deprecated.
Description copied from interface: `AllowFromStrategy`
Gets the value for ALLOW-FROM excluding the ALLOW-FROM. For example, the result might be "https://example.com/".

Specified by:
  `getAllowFromValue` in interface `AllowFromStrategy`
Parameters:
  `request` - the `HttpServletRequest`
Returns:
  the value for ALLOW-FROM or null if no header should be added for this request.

### setAllowFromParameterName

public void setAllowFromParameterName(String allowFromParameterName)
Deprecated.
Sets the HTTP parameter used to retrieve the value for the origin that is allowed from. The value of the parameter should be a valid URL. The default parameter name is "x-frames-allow-from".

Parameters:
  `allowFromParameterName` - the name of the HTTP parameter to

### allowed

protected abstract boolean allowed(String allowFromOrigin)
Deprecated.
Method to be implemented by base classes, used to determine if the supplied origin is allowed.

Parameters:
  `allowFromOrigin` - the supplied origin
Returns:
  `true` if the supplied origin is allowed.