Package org.springframework.security.web.csrf

# Class CsrfAuthenticationStrategy

java.lang.Object
org.springframework.security.web.csrf.CsrfAuthenticationStrategy

All Implemented Interfaces:
  `SessionAuthenticationStrategy`

public final class CsrfAuthenticationStrategy extends Object implements SessionAuthenticationStrategy
`CsrfAuthenticationStrategy` is in charge of removing the `CsrfToken` upon authenticating. A new `CsrfToken` will then be generated by the framework upon the next request.

Since:
  3.2

## Constructor Summary

Constructors
Constructor
Description
`CsrfAuthenticationStrategy(CsrfTokenRepository tokenRepository)`
Creates a new instance

## Method Summary

Modifier and Type
Method
Description
`void`
`onAuthentication(org.springframework.security.core.Authentication authentication, jakarta.servlet.http.HttpServletRequest request, jakarta.servlet.http.HttpServletResponse response)`
Performs Http session-related functionality when a new authentication occurs.
`void`
`setRequestHandler(CsrfTokenRequestHandler requestHandler)`
Specify a `CsrfTokenRequestHandler` to use for making the `CsrfToken` available as a request attribute.

### Methods inherited from class java.lang.Object

`clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait`

## Constructor Details

### CsrfAuthenticationStrategy

public CsrfAuthenticationStrategy(CsrfTokenRepository tokenRepository)
Creates a new instance

Parameters:
  `tokenRepository` - the `CsrfTokenRepository` to use

## Method Details

### setRequestHandler

public void setRequestHandler(CsrfTokenRequestHandler requestHandler)
Specify a `CsrfTokenRequestHandler` to use for making the `CsrfToken` available as a request attribute.

Parameters:
  `requestHandler` - the `CsrfTokenRequestHandler` to use

### onAuthentication

public void onAuthentication(org.springframework.security.core.Authentication authentication, jakarta.servlet.http.HttpServletRequest request, jakarta.servlet.http.HttpServletResponse response) throws SessionAuthenticationException
Description copied from interface: `SessionAuthenticationStrategy`
Performs Http session-related functionality when a new authentication occurs.

Specified by:
  `onAuthentication` in interface `SessionAuthenticationStrategy`
Throws:
  `SessionAuthenticationException` - if it is decided that the authentication is not allowed for the session. This will typically be because the user has too many sessions open at once.