Can logger property still be used in version above 4.0.0?

[itachiuchihamadara]

Hi everyone, I am migrating from 3.1.0 to 4.1.4 and saw we no longer have ILogger class in csrguard 4.1.4 jar. In our application we set logger property to our custom logger java file which implements ILogger.java

org.owasp.csrfguard.logger = com.project.csrfguardLogger

The csrfguardLogger implements the ILogger.java from the jar. So, my questions is, what changes need to be done for the logging from our side? How is logging is done in newer versions?

[forgedhallpass]

Hello @itachiuchihamadara,

The logging mechanism has been replaced by SLF4J. You just need to add any implementation to your dependencies and it should work out of the box. We have a test application set up with LogBack. You can use that to play around with different configuration.

Related ticket in which the implementation was done: #30

[itachiuchihamadara]

You just need to add any implementation to your dependencies

Can you please explain this more? We have a java file that implements ILogger so when we compile our code with updated version we can't compile, so what can be done? How can I add it as dependency?

[forgedhallpass]

SLF4J is a widely used library. You can find a lot of examples on the internet. E.g. https://www.baeldung.com/slf4j-with-log4j2-logback

We have a java file that implements ILogger so when we compile our code with updated version we can't compile, so what can be done?

The interface has been removed. See the ticket referenced above.

How can I add it as dependency?

It needs to be added to the classpath. That can be achieved usually by adding it as a maven or gradle dependency etc.

We have a test application set up with LogBack. You can use that to play around with different configuration.

^^^ see this