CSRFGuard 2.2 Installation - Revision history

Michael Kopinsky at 06:07, 28 September 2010

2010-09-28T06:07:02Z

Esheridan: /* Ant Installation Script */

2008-04-05T17:32:51Z

‎Ant Installation Script

Esheridan: /* Ant Installation Script */

2008-04-05T17:32:22Z

‎Ant Installation Script

Esheridan: /* Ant Installation Script */

2008-04-05T17:32:03Z

‎Ant Installation Script

Esheridan: New page: '''UNDER DEVELOPMENT''' == Overview == OWASP CSRFGuard 2.2 offers several advantages over previous releases. One such advantage is the partial automation of the installation process. The...

2008-04-05T17:30:22Z

New page: '''UNDER DEVELOPMENT''' == Overview == OWASP CSRFGuard 2.2 offers several advantages over previous releases. One such advantage is the partial automation of the installation process. The...

New page

'''UNDER DEVELOPMENT'''

== Overview ==

OWASP CSRFGuard 2.2 offers several advantages over previous releases. One such advantage is the partial automation of the installation process. The purpose of this document is to describe all of the steps, both automated and manual, required to successfully install CSRFGuard within your web application.

== Ant Installation Script ==

This release contains an Ant build script that includes a "deploy" target. The purpose of this target is to compile and deploy all of the necessary OWASP CSRFGuard artifacts in a web application deployment directory. Successfully running the target requires the developer to simply modify a couple Ant properties. The following describes the process of configuring the Ant build script for a fictitious web application.

'''Application Name:''' TestApp '''Root Location:''' /usr/local/www/TestApp

'''Step 1: Specify the location of WEB-INF Using the deploy.webinf Property'''

The deploy.webinf property should point to the WEB-INF folder of your J2EE web application. A small number of configuration files will be deployed to this directory. For our sample application, we would set the deploy.webinf property to "/usr/local/www/TestApp/WEB-INF" as follows:

<property name="deploy.webinf" location="/usr/local/www/TestApp/WEB-INF" />

'''Step 2: Specify the location of WEB-INF/lib Using the deploy.webinf.lib Property'''

The deploy.webinf.lib property should point to the WEB-INF/lib folder of your J2EE web application. The OWASP CSRFGuard Jar file and dependencies will be copied to this folder. For our sample application, we would set the deploy.webinf.lib property to

<property name="deploy.webinf.lib" location="${deploy.webinf}/lib" />

'''Step 3: Configure CSRFGuard.properties For Your Environment'''

The latest CSRFGuard release contains a number of new configuration operations. For the detailed list of configuration options and their purpose, please check out [FIXME]. '''Note:''' The Ant installation script assumes the properties file you wish to use is located at ./conf/CSRFGuard.properties. If you wish to change this, you must modify the guard.properties Ant property.

'''Step 4: Run the Ant 'deploy' Target'''

At this point, you are ready to run the Ant 'deploy' target to copy all necessary files to your web application. To run the 'deploy' target, either double-click the 'deploy' target in the 'Ant View' within Eclipse or execute the command manually as follows: ant deploy.

== Application Deployment Descriptor ==

Java EE filters provide the ability to intercept, view, and modify both the request and associated response for the requesting client. In order for our application to make use of the OWASP CSRFGuard filter, we must modify the application's web.xml file. First we must declare the filter and the 'config' initialization parameter. By default (i.e. using the vanilla Ant 'deploy' script), the configuration file is found at WEB-INF/CSRFGuard.properties.

The following is a sample entry used to test CSRFGuard in TestApp:

<filter>
<filter-name>CSRFGuard</filter-name>
<filter-class>org.owasp.csrf.CSRFGuardFilter</filter-class>
<init-param>
<param-name>config</param-name>
<param-value>WEB-INF/CSRFGuard.properties</param-value>
</init-param>
</filter>

After declaring the filter in the descriptor, we must specify what resources this filter should handle. We can instruct the filter to handle requests for entire servlets or specific URL patterns. The following example instructs the OWASP CSRFGuard to handle all requests to the 'HelloWorld' servlet as well as any requests ending in a .jsp:

<filter-mapping>
<filter-name>CSRFGuard</filter-name>
<servlet-name>HelloWorld</servlet-name>
</filter-mapping>

<filter-mapping>
<filter-name>CSRFGuard</filter-name>
<url-pattern>*.jsp</url-pattern>
</filter-mapping>

If you wish to have OWASP CSRFGuard monitor requests for every resource, use the following configuration:

<filter-mapping>
<filter-name>CSRFGuard</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>

'''Note:''' By default, all resources monitored by OWASP CSRFGuard are protected. To modify OWASP CSRFGuard's behavior with respect to your web application resources, consult the properties configuration manual at [FIXME].

'''Note:''' If you map OWASP CSRFGuard to a resource that does not contain nor generate HTML (ex. images, Javascript source, etc.), you will may get runtime exceptions depending on the selected ResponseHandler!

@@ Line 21: / Line 21: @@
   '''Step 3: Configure CSRFGuard.properties For Your Environment'''
-The latest CSRFGuard release contains a number of new configuration operations. For the detailed list of configuration options and their purpose, please check out [FIXME].
+The latest CSRFGuard release contains a number of new configuration operations. For the detailed list of configuration options and their purpose, please check out the [[CSRFGuard_2.2_Configuration_Manual]].
 '''Note:''' The Ant installation script assumes the properties file you wish to use is located at ./conf/CSRFGuard.properties. If you wish to change this, you must modify the guard.properties Ant property.
@@ Line 37: / Line 37: @@
   <filter>
     <filter-name>CSRFGuard</filter-name>
-    <filter-class>org.owasp.csrf.CSRFGuardFilter</filter-class>
+    <filter-class>org.owasp.csrfguard.CSRFGuardFilter</filter-class>
       <init-param>
         <param-name>config</param-name>
@@ Line 63: / Line 63: @@
   </filter-mapping>
-'''Note:''' By default, all resources monitored by OWASP CSRFGuard are protected. To modify OWASP CSRFGuard's behavior with respect to your web application resources, consult the properties configuration manual at [FIXME].
+'''Note:''' By default, all resources monitored by OWASP CSRFGuard are protected. To modify OWASP CSRFGuard's behavior with respect to your web application resources, consult the [[CSRFGuard_2.2_Configuration_Manual]].
 '''Note:''' If you map OWASP CSRFGuard to a resource that does not contain nor generate HTML (ex. images, Javascript source, etc.), you will may get runtime exceptions depending on the selected ResponseHandler!

@@ Line 13: / Line 13: @@
   '''Step 1: Specify the location of WEB-INF Using the deploy.webinf Property'''
-The deploy.webinf property should point to the WEB-INF folder of your J2EE web application. A small number of configuration files will be deployed to this directory. For our sample application, we would set the deploy.webinf property to "/usr/local/www/TestApp/WEB-INF" as follows:
+The deploy.webinf property should point to the WEB-INF folder of your J2EE web application. A small number of configuration files will be deployed to this directory. For our sample application, we would set the deploy.webinf property to "/usr/local/www/TestApp/WEB-INF" as follows: <property name="deploy.webinf" location="/usr/local/www/TestApp/WEB-INF" />
   '''Step 2: Specify the location of WEB-INF/lib Using the deploy.webinf.lib Property'''
-The deploy.webinf.lib property should point to the WEB-INF/lib folder of your J2EE web application. The OWASP CSRFGuard Jar file and dependencies will be copied to this folder. For our sample application, we would set the deploy.webinf.lib property to
+The deploy.webinf.lib property should point to the WEB-INF/lib folder of your J2EE web application. The OWASP CSRFGuard Jar file and dependencies will be copied to this folder. For our sample application, we would set the deploy.webinf.lib property as follows: <property name="deploy.webinf.lib" location="${deploy.webinf}/lib" />
   '''Step 3: Configure CSRFGuard.properties For Your Environment'''

@@ Line 25: / Line 25: @@
   '''Step 3: Configure CSRFGuard.properties For Your Environment'''
-The latest CSRFGuard release contains a number of new configuration operations. For the detailed list of configuration options and their purpose, please check out [FIXME]. '''Note:''' The Ant installation script assumes the properties file you wish to use is located at ./conf/CSRFGuard.properties. If you wish to change this, you must modify the guard.properties Ant property.
+The latest CSRFGuard release contains a number of new configuration operations. For the detailed list of configuration options and their purpose, please check out [FIXME].
   '''Step 4: Run the Ant 'deploy' Target'''