### Question:
TokenGeneratorFilter implements Filter { @Override public void doFilter(final ServletRequest request, final ServletResponse response, final FilterChain chain) throws IOException, ServletException { final HttpServletRequest req = (HttpServletRequest) request; final HttpServletResponse res = (HttpServletResponse) response; final String apiTokenFromClient = tokenGenerator.createOrLoadToken(req.getSession()); tokenGenerator.setTokenToResponseHeader(res, apiTokenFromClient); portalCookies.addCSRFTokenCookieToResponse(req, res, apiTokenFromClient); chain.doFilter(req, res); }  @Override void doFilter(final ServletRequest request, final ServletResponse response, final FilterChain chain); @Override void init(final FilterConfig filterConfig); @Override void destroy();  }### Answer:
@Test public void should_add_security_token_in_headers_and_in_cookies_when_token_already_exists() throws Exception { session.setAttribute(TokenGenerator.API_TOKEN, bonitaTokenValue); response.addHeader(bonitaTokenName, bonitaTokenValue); tokenGeneratorFilter.doFilter(request, response, filterChain); final Cookie csrfCookie = response.getCookie(bonitaTokenName); assertThat(csrfCookie.getName()).isEqualTo(bonitaTokenName); assertThat(csrfCookie.getPath()).isEqualTo(contextPath); assertThat(csrfCookie.getValue()).isEqualTo(bonitaTokenValue); assertThat(session.getAttribute(TokenGenerator.API_TOKEN)).isEqualTo(bonitaTokenValue); assertThat(response.getHeader(bonitaTokenName)).isEqualTo(bonitaTokenValue); verify(filterChain).doFilter(request, response); }
@Test public void should_add_security_token_in_headers_and_in_cookies_when_no_previous_call() throws Exception { tokenGeneratorFilter.doFilter(request, response, filterChain); final Cookie csrfCookie = response.getCookie(bonitaTokenName); assertThat(csrfCookie.getName()).isEqualTo(bonitaTokenName); assertThat(csrfCookie.getPath()).isEqualTo(contextPath); assertThat(csrfCookie.getValue()).isNotEqualTo(bonitaTokenValue); assertThat(session.getAttribute(TokenGenerator.API_TOKEN)).isEqualTo(csrfCookie.getValue()); assertThat(response.getHeader(bonitaTokenName)).isEqualTo(csrfCookie.getValue()); verify(filterChain).doFilter(request, response); }