org.apache.struts2.interceptor

## Class FetchMetadataInterceptor

- java.lang.Object
- - com.opensymphony.xwork2.interceptor.AbstractInterceptor
  - - org.apache.struts2.interceptor.FetchMetadataInterceptor

- All Implemented Interfaces:
    ConditionalInterceptor, Interceptor, Serializable

      public class FetchMetadataInterceptor
      extends AbstractInterceptor

  Interceptor that implements Fetch Metadata policy on incoming requests used to protect against CSRF, XSSI, and cross-origin information leaks. Uses `StrutsResourceIsolationPolicy` to filter the requests allowed to be processed.
  See Also:
    https://web.dev/fetch-metadata/, https://www.w3.org/TR/fetch-metadata/, Serialized Form

- - ### Constructor Summary

    Constructors
    Constructor and Description
    `FetchMetadataInterceptor()`

  - ### Method Summary

    All Methods Instance Methods Concrete Methods
    Modifier and Type | Method and Description
    --- | ---
    `String` | `intercept(ActionInvocation invocation)` Override to handle interception
    `void` | `setExemptedPaths(String paths)`

    - ### Methods inherited from class com.opensymphony.xwork2.interceptor.AbstractInterceptor

      `destroy, init, setDisabled, shouldIntercept`

    - ### Methods inherited from class java.lang.Object

      `clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait`

- - ### Constructor Detail

    - #### FetchMetadataInterceptor

          public FetchMetadataInterceptor()

  - ### Method Detail

    - #### setExemptedPaths

          public void setExemptedPaths(String paths)

    - #### intercept

          public String intercept(ActionInvocation invocation)
                           throws Exception

      Description copied from class: `AbstractInterceptor`
      Override to handle interception
      Specified by:
        `intercept` in interface `Interceptor`
      Specified by:
        `intercept` in class `AbstractInterceptor`
      Parameters:
        `invocation` - the action invocation
      Returns:
        the return code, either returned from `ActionInvocation.invoke()`, or from the interceptor itself.
      Throws:
        `Exception` - any system-level error, as defined in `Action.execute()`.

Copyright © 2000–2022 Apache Software Foundation. All rights reserved.