@ Override public String extractTokenFromRequest ( Context context ) { // First check the tags, this is where tokens are added if it's added to the current request // In that case, the request scope contains the token String token = ( String ) context . request ( ) . data ( ) . get ( TOKEN_KEY ) ; if ( token == null && getCookieName ( ) != null ) { // Search in a cookie Cookie cookie = context . cookie ( getCookieName ( ) ) ; if ( cookie != null ) { token = cookie . value ( ) ; } } if ( token == null ) { // Check in the session token = context . session ( ) . get ( getTokenName ( ) ) ; } if ( token != null && isSignedToken ( ) ) { // Extract the signed token, and then resign it. This makes the token random per request, preventing // the BREACH vulnerability return crypto . signToken ( crypto . extractSignedToken ( token ) ) ; } else { return token ; } }
Extracts the token from the request . This implementation checks in the request data then in the CORS cookie if any and finally in the session cookie . If the token is signed it resigns it to avoid the BREACH vulnerability .