Is jakarta EE supported?

[KotlinIsland]

I want to update to using jakarta, is this supported?

[forgedhallpass]

No, it is not.

Maven dependency tree:

org.owasp:csrfguard🫙4.1.2-SNAPSHOT

+- javax.servlet:servlet-api:jar:2.5:provided
+- org.apache.commons:commons-lang3:jar:3.12.0:compile
+- commons-io:commons-io:jar:2.8.0:compile
+- com.google.code.gson:gson:jar:2.8.6:compile
+- org.slf4j:slf4j-api:jar:1.7.31:compile

org.owasp:csrfguard-extension-session🫙4.1.2-SNAPSHOT

+- org.owasp:csrfguard:jar:4.1.2-SNAPSHOT:compile
|  +- org.apache.commons:commons-lang3:jar:3.12.0:compile
|  +- commons-io:commons-io:jar:2.8.0:compile
|  +- com.google.code.gson:gson:jar:2.8.6:compile
|  \- org.slf4j:slf4j-api:jar:1.7.31:compile
\- javax.servlet:servlet-api:jar:2.5:provided

org.owasp:csrfguard-jsp-tags🫙4.1.2-SNAPSHOT

+- org.owasp:csrfguard:jar:4.1.2-SNAPSHOT:compile
|  +- org.apache.commons:commons-lang3:jar:3.12.0:compile
|  +- commons-io:commons-io:jar:2.8.0:compile
|  +- com.google.code.gson:gson:jar:2.8.6:compile
|  \- org.slf4j:slf4j-api:jar:1.7.31:compile
+- javax.servlet:servlet-api:jar:2.5:provided
+- javax.servlet.jsp:jsp-api:jar:2.1:provided
\- javax.servlet:jstl:jar:1.2:provided

[KotlinIsland]

Oh, 😕. Any plans to add support? Maybe make two distributions?

[forgedhallpass]

We could potentially change the dependencies from javax to the following versions of jakarta:

<dependency>
    <groupId>jakarta.servlet</groupId>
    <artifactId>jakarta.servlet-api</artifactId>
    <version>4.0.4</version>
    <scope>provided</scope>
</dependency>
<dependency>
    <groupId>jakarta.servlet.jsp</groupId>
    <artifactId>jakarta.servlet.jsp-api</artifactId>
    <version>2.3.6</version>
    <scope>provided</scope>
</dependency>
<dependency>
    <groupId>jakarta.servlet.jsp.jstl</groupId>
    <artifactId>jakarta.servlet.jsp.jstl-api</artifactId>
    <version>2.0.0</version>
    <scope>provided</scope>
</dependency>

This should be a non-breaking change, which still contains the javax package namespace, hence no code modifications would be needed.

Two distributions?
Not likely, unless the number of people requesting this would increase (you are currently the first and only one).

[forgedhallpass]

Although you can do this dependency change in your project, if you are using the above mentioned versions of jakarta by excluding the javax dependencies.

[KotlinIsland]

The issue is that I am using parts of api that are expecting javax classes:

CsrfGuard.getInstance().tokenService.getTokenValue(
    CsrfGuard.getInstance().logicalSessionExtractor.extract(req).key, "login"
) //                                                ^ Cannot access class 'javax.servlet.http.HttpServletRequest'...

So I think just excluding those dependencies wouldn't be a solution.

[forgedhallpass]

The above mentioned jakarta versions work with the javax namespace. I've tested it locally, and it works. If you want to use newer versions, then you'll have issues.