liveBook · Manning

Servlet request attribute

As explained in Spring Security in Action, Second Edition

A request attribute is a named value attached to an HTTP request for access by components processing that request.

A servlet request attribute is a named value attached to an HTTP request so filters and other processing components can retrieve it. Spring Security's CsrfFilter stores a CsrfToken under the _csrf attribute. section 9.1

The attribute supports a practical CSRF-token flow:

  • A custom servlet Filter retrieves _csrf with request.getAttribute("_csrf"). section 9.1
  • The retrieved CsrfToken exposes its string value through getToken(). section 9.1
  • Registering the custom filter after CsrfFilter ensures the attribute has been deposited before retrieval. section 9.1

Logging a CSRF token

A CsrfTokenLogger obtains the _csrf request attribute, casts it to CsrfToken, logs getToken(), and continues the filter chain. A GET request can expose the token for testing; a POST without it receives HTTP 403. section 9.1

How Spring Security in Action, Second Edition covers it

How deep it goes
Explains named-value retrieval, CsrfToken casting, filter ordering, and request testing, but not general servlet attribute internals.
Examples
Uses CsrfTokenLogger, the _csrf attribute, curl GET and POST requests, and HTTP 403 behavior.
What it assumes
Assumes basic Spring Security, Java, and servlet-filter knowledge while demonstrating attribute access explicitly.
What you can do after
Diagnose CSRF handling by retrieving and logging the token from a request attribute.
How it connects
Connects servlet filters, CsrfFilter, CSRF tokens, HTTP sessions, and HTTP POST requests.
Cover of Spring Security in Action, Second Edition
liveBookmanning.com
Read Spring Security in Action, Second Edition on liveBook Get the book at manning.com

Also explained in

Compare how 2 books explain servlet request attribute →

Related concepts

This explainer was generated by Manning's knowledge graph from the text of Spring Security in Action, Second Edition. The section links point to the parts of the book it draws on.