### Question:
TokenValidatorFilter extends AbstractAuthorizationFilter { @Override boolean checkValidCondition(HttpServletRequest httpRequest, HttpServletResponse httpResponse) { if (isCsrfProtectionEnabled() && !isSafeMethod(httpRequest.getMethod())) { String headerFromRequest = getCSRFToken(httpRequest); String apiToken = (String) httpRequest.getSession().getAttribute("api_token"); if (headerFromRequest == null || !headerFromRequest.equals(apiToken)) { if (LOGGER.isLoggable(Level.FINE)) { LOGGER.log(Level.FINE, "Token Validation failed, expected: " + apiToken + ", received: " + headerFromRequest); } httpResponse.setStatus(HttpServletResponse.SC_UNAUTHORIZED); return false; } } return true; }    }### Answer:
@Test public void should_check_csrf_token_from_request_header() throws Exception { request.addHeader("X-Bonita-API-Token", SESSION_CSRF_TOKEN); boolean valid = filter.checkValidCondition(request, response); assertThat(valid).isTrue(); }
@Test public void should_not_check_csrf_token_for_GET_request() throws Exception { request.setMethod("GET"); boolean valid = filter.checkValidCondition(request, response); assertThat(valid).isTrue(); }
@Test public void should_not_check_csrf_token_for_HEAD_request() throws Exception { request.setMethod("HEAD"); boolean valid = filter.checkValidCondition(request, response); assertThat(valid).isTrue(); }
@Test public void should_set_401_status_when_csrf_request_header_is_wrong() throws Exception { request.addHeader("X-Bonita-API-Token", "notAValidToken"); boolean valid = filter.checkValidCondition(request, response); assertThat(valid).isFalse(); assertThat(response.getStatus()).isEqualTo(401); }
@Test public void should_set_401_status_when_csrf_request_header_is_not_set() throws Exception { boolean valid = filter.checkValidCondition(request, response); assertThat(valid).isFalse(); assertThat(response.getStatus()).isEqualTo(401); }
@Test public void should_check_csrf_token_from_request_parameter() throws Exception { request.addParameter("CSRFToken", SESSION_CSRF_TOKEN); boolean valid = filter.checkValidCondition(request, response); assertThat(valid).isTrue(); }
@Test public void should_set_401_status_when_csrf_request_parameter_is_wrong() throws Exception { request.addParameter("CSRFToken", "notAValidToken"); boolean valid = filter.checkValidCondition(request, response); assertThat(valid).isFalse(); assertThat(response.getStatus()).isEqualTo(401); }
@Test public void should_check_csrf_token_from_request_form_data() throws Exception { request = mockMultipartRequestFor(SESSION_CSRF_TOKEN); boolean valid = filter.checkValidCondition(request, response); assertThat(valid).isTrue(); }
@Test public void should_set_401_status_when_csrf_form_data_is_wrong() throws Exception { request = mockMultipartRequestFor("notAValidToken"); boolean valid = filter.checkValidCondition(request, response); assertThat(valid).isFalse(); assertThat(response.getStatus()).isEqualTo(401); }