@Override
  public void init(FilterConfig filterConfig) {
    String customHeader = filterConfig.getInitParameter(CUSTOM_HEADER_PARAM);
    if (customHeader != null) {
      headerName = customHeader;
    }
    String customMethodsToIgnore = filterConfig.getInitParameter(CUSTOM_METHODS_TO_IGNORE_PARAM);
    if (customMethodsToIgnore != null) {
      parseMethodsToIgnore(customMethodsToIgnore);
    } else {
      parseMethodsToIgnore(METHODS_TO_IGNORE_DEFAULT);
    }

    String agents = filterConfig.getInitParameter(BROWSER_USER_AGENT_PARAM);
    if (agents == null) {
      agents = BROWSER_USER_AGENTS_DEFAULT;
    }
    parseBrowserUserAgents(agents);
    LOG.info(String.format(
      "Adding cross-site request forgery (CSRF) protection, "
        + "headerName = %s, methodsToIgnore = %s, browserUserAgents = %s",
      headerName, methodsToIgnore, browserUserAgents));
  }
This filter provides protection against cross site request forgery (CSRF) attacks for REST APIs.
Enabling this filter on an endpoint results in the requirement of all client to send a particular
(configurable) HTTP header with every request. In the absense of this header the filter will
reject the attempt as a bad request.
hbase-rest/src/main/java/org/apache/hadoop/hbase/rest/filter/RestCsrfPreventionFilter.java