@@ -0,0 +1,2550 @@
+/*%0A * Copyright Camunda Services GmbH and/or licensed to Camunda Services GmbH%0A * under one or more contributor license agreements. See the NOTICE file%0A * distributed with this work for additional information regarding copyright%0A * ownership. Camunda licenses this file to you under the Apache License,%0A * Version 2.0; you may not use this file except in compliance with the License.%0A * You may obtain a copy of the License at%0A *%0A *     http://www.apache.org/licenses/LICENSE-2.0%0A *%0A * Unless required by applicable law or agreed to in writing, software%0A * distributed under the License is distributed on an %22AS IS%22 BASIS,%0A * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.%0A * See the License for the specific language governing permissions and%0A * limitations under the License.%0A */%0Apackage org.camunda.bpm;%0A%0Aimport com.sun.jersey.api.client.ClientResponse;%0Aimport org.junit.Before;%0Aimport org.junit.Test;%0A%0Aimport javax.ws.rs.core.MultivaluedMap;%0Aimport java.util.List;%0A%0Aimport static org.junit.Assert.assertEquals;%0Aimport static org.junit.Assert.assertTrue;%0A%0Apublic class CsrfPreventionIT extends AbstractWebappIntegrationTest %7B%0A%0A  @Override%0A  protected String getApplicationContextPath() %7B%0A    return %22camunda/app/tasklist/default/%22;%0A  %7D%0A%0A  @Before%0A  public void preventRaceConditions() throws InterruptedException %7B%0A    // just wait some seconds before starting because of Wildfly / Cargo race conditions%0A    Thread.sleep(5 * 1000);%0A  %7D%0A%0A  @Test(timeout=10000)%0A  public void shouldCheckPresenceOfCsrfPreventionCookie() %7B%0A    // given%0A%0A    // when%0A    ClientResponse response = client.resource(APP_BASE_PATH)%0A        .get(ClientResponse.class);%0A%0A    // then%0A    assertEquals(200, response.getStatus());%0A    assertTrue(checkCookieSet(response));%0A    assertTrue(checkXsrfTokenHeaderPresent(response));%0A%0A    // cleanup%0A    response.close();%0A  %7D%0A%0A  protected boolean checkCookieSet(ClientResponse response) %7B%0A    MultivaluedMap%3CString, String%3E headers = response.getHeaders();%0A%0A    List%3CString%3E values = headers.get(%22Set-Cookie%22);%0A    for (String value : values) %7B%0A      if (value.startsWith(%22XSRF-TOKEN=%22)) %7B%0A        return value.contains(%22;SameSite=Strict%22);%0A      %7D%0A    %7D%0A%0A    return false;%0A  %7D%0A%0A  protected boolean checkXsrfTokenHeaderPresent(ClientResponse response) %7B%0A    MultivaluedMap%3CString, String%3E headers = response.getHeaders();%0A%0A    List%3CString%3E values = headers.get(%22X-XSRF-TOKEN%22);%0A    for (String value : values) %7B%0A      if (value.length() == 32) %7B%0A        return true;%0A      %7D%0A    %7D%0A%0A    return false;%0A  %7D%0A%0A%7D%0A

add csrf prevention integration test