@ Override public String extractTokenFromContent ( Context context ) { // check query String String token = context . request ( ) . parameter ( getTokenName ( ) ) ; if ( token == null ) { // Check a specified header token = context . header ( CSRF_TOKEN_HEADER ) ; } // If still not found, check in body if ( token == null ) { if ( context . request ( ) . contentType ( ) . startsWith ( MimeTypes . FORM ) || context . request ( ) . contentType ( ) . startsWith ( MimeTypes . MULTIPART ) ) { List < String > list = context . form ( ) . get ( getTokenName ( ) ) ; if ( list != null && ! list . isEmpty ( ) ) { return list . get ( 0 ) ; } } } return token ; }
Extracts the token from the content of the request . This implementation checks inside the headers and inside form body .