web/src/main/java/org/springframework/security/web/csrf/CsrfFilter.java
@Override
	protected void doFilterInternal(HttpServletRequest request,
			HttpServletResponse response, FilterChain filterChain)
					throws ServletException, IOException {
		request.setAttribute(HttpServletResponse.class.getName(), response);

		CsrfToken csrfToken = this.tokenRepository.loadToken(request);
		final boolean missingToken = csrfToken == null;
		if (missingToken) {
			csrfToken = this.tokenRepository.generateToken(request);
			this.tokenRepository.saveToken(csrfToken, request, response);
		}
		request.setAttribute(CsrfToken.class.getName(), csrfToken);
		request.setAttribute(csrfToken.getParameterName(), csrfToken);

		if (!this.requireCsrfProtectionMatcher.matches(request)) {
			filterChain.doFilter(request, response);
			return;
		}

		String actualToken = request.getHeader(csrfToken.getHeaderName());
		if (actualToken == null) {
			actualToken = request.getParameter(csrfToken.getParameterName());
		}
		if (!csrfToken.getToken().equals(actualToken)) {
			if (this.logger.isDebugEnabled()) {
				this.logger.debug("Invalid CSRF token found for "
						+ UrlUtils.buildFullRequestUrl(request));
			}
			if (missingToken) {
				this.accessDeniedHandler.handle(request, response,
						new MissingCsrfTokenException(actualToken));
			}
			else {
				this.accessDeniedHandler.handle(request, response,
						new InvalidCsrfTokenException(csrfToken, actualToken));
			}
			return;
		}

		filterChain.doFilter(request, response);
	}
@Override
	protected void doFilterInternal(HttpServletRequest request,
			HttpServletResponse response, FilterChain filterChain)
					throws ServletException, IOException {
		request.setAttribute(HttpServletResponse.class.getName(), response);

		CsrfToken csrfToken = this.tokenRepository.loadToken(request);
		final boolean missingToken = csrfToken == null;
		if (missingToken) {
			csrfToken = this.tokenRepository.generateToken(request);
			this.tokenRepository.saveToken(csrfToken, request, response);
		}
		request.setAttribute(CsrfToken.class.getName(), csrfToken);
		request.setAttribute(csrfToken.getParameterName(), csrfToken);

		if (!this.requireCsrfProtectionMatcher.matches(request)) {
			filterChain.doFilter(request, response);
			return;
		}

		String actualToken = request.getHeader(csrfToken.getHeaderName());
		if (actualToken == null) {
			actualToken = request.getParameter(csrfToken.getParameterName());
		}
		if (!csrfToken.getToken().equals(actualToken)) {
			if (this.logger.isDebugEnabled()) {
				this.logger.debug("Invalid CSRF token found for "
						+ UrlUtils.buildFullRequestUrl(request));
			}
			if (missingToken) {
				this.accessDeniedHandler.handle(request, response,
						new MissingCsrfTokenException(actualToken));
			}
			else {
				this.accessDeniedHandler.handle(request, response,
						new InvalidCsrfTokenException(csrfToken, actualToken));
			}
			return;
		}

		filterChain.doFilter(request, response);
	}
@ Override protected void doFilterInternal ( HttpServletRequest request , HttpServletResponse response , FilterChain filterChain ) throws ServletException , IOException { request . setAttribute ( HttpServletResponse . class . getName ( ) , response ) ; CsrfToken csrfToken = this . tokenRepository . loadToken ( request ) ; final boolean missingToken = csrfToken == null ; if ( missingToken ) { csrfToken = this . tokenRepository . generateToken ( request ) ; this . tokenRepository . saveToken ( csrfToken , request , response ) ; } request . setAttribute ( CsrfToken . class . getName ( ) , csrfToken ) ; request . setAttribute ( csrfToken . getParameterName ( ) , csrfToken ) ; if ( ! this . requireCsrfProtectionMatcher . matches ( request ) ) { filterChain . doFilter ( request , response ) ; return ; } String actualToken = request . getHeader ( csrfToken . getHeaderName ( ) ) ; if ( actualToken == null ) { actualToken = request . getParameter ( csrfToken . getParameterName ( ) ) ; } if ( ! csrfToken . getToken ( ) . equals ( actualToken ) ) { if ( this . logger . isDebugEnabled ( ) ) { this . logger . debug ( "Invalid CSRF token found for " + UrlUtils . buildFullRequestUrl ( request ) ) ; } if ( missingToken ) { this . accessDeniedHandler . handle ( request , response , new MissingCsrfTokenException ( actualToken ) ) ; } else { this . accessDeniedHandler . handle ( request , response , new InvalidCsrfTokenException ( csrfToken , actualToken ) ) ; } return ; } filterChain . doFilter ( request , response ) ; }
/*
(non-Javadoc)

@see
org.springframework.web.filter.OncePerRequestFilter#doFilterInternal(javax.servlet
.http.HttpServletRequest, javax.servlet.http.HttpServletResponse,
javax.servlet.FilterChain)
/ * ( non - Javadoc )