Spring/spring-boot
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Relocate and unify reactive cookie properties

Browse Source 
Relocate the recently introduced `spring.webflux.session` properties
to `server.reactive.session` and create a unified `Cookie` properties
class.

Reactive session properties now mirror the existing
`server.servlet.session` properties and better reflect the fact that
they are related to the server and not just for WebFlux.

See gh-26714
This commit is contained in:
Phillip Webb
2021-10-19 22:21:12 -07:00
parent 3c71637fa2
commit b72ff25220
13 changed files with 423 additions and 352 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/session/MongoReactiveSessionConfiguration.java
View File

@@ -22,7 +22,7 @@ import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.boot.autoconfigure.condition.ConditionalOnBean;
import org.springframework.boot.autoconfigure.condition.ConditionalOnClass;
import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean;
import org.springframework.boot.autoconfigure.web.reactive.WebFluxProperties;
import org.springframework.boot.autoconfigure.web.ServerProperties;
import org.springframework.boot.context.properties.EnableConfigurationProperties;
import org.springframework.context.annotation.Conditional;
import org.springframework.context.annotation.Configuration;
@@ -50,8 +50,9 @@ class MongoReactiveSessionConfiguration {
@Autowired
void customize(SessionProperties sessionProperties, MongoSessionProperties mongoSessionProperties,
WebFluxProperties webFluxProperties) {
Duration timeout = sessionProperties.determineTimeout(() -> webFluxProperties.getSession().getTimeout());
ServerProperties serverProperties) {
Duration timeout = sessionProperties
.determineTimeout(() -> serverProperties.getReactive().getSession().getTimeout());
if (timeout != null) {
setMaxInactiveIntervalInSeconds((int) timeout.getSeconds());
}

7
spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/session/RedisReactiveSessionConfiguration.java
View File

@@ -22,7 +22,7 @@ import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.boot.autoconfigure.condition.ConditionalOnBean;
import org.springframework.boot.autoconfigure.condition.ConditionalOnClass;
import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean;
import org.springframework.boot.autoconfigure.web.reactive.WebFluxProperties;
import org.springframework.boot.autoconfigure.web.ServerProperties;
import org.springframework.boot.context.properties.EnableConfigurationProperties;
import org.springframework.context.annotation.Conditional;
import org.springframework.context.annotation.Configuration;
@@ -50,8 +50,9 @@ class RedisReactiveSessionConfiguration {
@Autowired
void customize(SessionProperties sessionProperties, RedisSessionProperties redisSessionProperties,
WebFluxProperties webFluxProperties) {
Duration timeout = sessionProperties.determineTimeout(() -> webFluxProperties.getSession().getTimeout());
ServerProperties serverProperties) {
Duration timeout = sessionProperties
.determineTimeout(() -> serverProperties.getReactive().getSession().getTimeout());
if (timeout != null) {
setMaxInactiveIntervalInSeconds((int) timeout.getSeconds());
}

39
spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/session/SessionAutoConfiguration.java
View File

@@ -45,7 +45,7 @@ import org.springframework.boot.autoconfigure.web.ServerProperties;
import org.springframework.boot.autoconfigure.web.reactive.HttpHandlerAutoConfiguration;
import org.springframework.boot.autoconfigure.web.reactive.WebFluxAutoConfiguration;
import org.springframework.boot.autoconfigure.web.reactive.WebFluxProperties;
import org.springframework.boot.autoconfigure.web.reactive.WebFluxProperties.SameSite;
import org.springframework.boot.autoconfigure.web.reactive.WebSessionIdResolverAutoConfiguration;
import org.springframework.boot.context.properties.EnableConfigurationProperties;
import org.springframework.boot.context.properties.PropertyMapper;
import org.springframework.boot.web.servlet.server.Session.Cookie;
@@ -56,7 +56,6 @@ import org.springframework.context.annotation.Configuration;
import org.springframework.context.annotation.Import;
import org.springframework.context.annotation.ImportSelector;
import org.springframework.core.type.AnnotationMetadata;
import org.springframework.http.ResponseCookie.ResponseCookieBuilder;
import org.springframework.security.web.authentication.RememberMeServices;
import org.springframework.session.ReactiveSessionRepository;
import org.springframework.session.Session;
@@ -66,9 +65,6 @@ import org.springframework.session.web.http.CookieHttpSessionIdResolver;
import org.springframework.session.web.http.CookieSerializer;
import org.springframework.session.web.http.DefaultCookieSerializer;
import org.springframework.session.web.http.HttpSessionIdResolver;
import org.springframework.util.StringUtils;
import org.springframework.web.server.session.CookieWebSessionIdResolver;
import org.springframework.web.server.session.WebSessionIdResolver;
/**
* {@link EnableAutoConfiguration Auto-configuration} for Spring Session.
@@ -87,7 +83,8 @@ import org.springframework.web.server.session.WebSessionIdResolver;
@EnableConfigurationProperties({ ServerProperties.class, SessionProperties.class, WebFluxProperties.class })
@AutoConfigureAfter({ DataSourceAutoConfiguration.class, HazelcastAutoConfiguration.class,
JdbcTemplateAutoConfiguration.class, MongoDataAutoConfiguration.class, MongoReactiveDataAutoConfiguration.class,
RedisAutoConfiguration.class, RedisReactiveAutoConfiguration.class })
RedisAutoConfiguration.class, RedisReactiveAutoConfiguration.class,
WebSessionIdResolverAutoConfiguration.class })
@AutoConfigureBefore({ HttpHandlerAutoConfiguration.class, WebFluxAutoConfiguration.class })
public class SessionAutoConfiguration {
@@ -140,36 +137,6 @@ public class SessionAutoConfiguration {
@Import(ReactiveSessionRepositoryValidator.class)
static class ReactiveSessionConfiguration {
private final WebFluxProperties webFluxProperties;
ReactiveSessionConfiguration(WebFluxProperties webFluxProperties) {
this.webFluxProperties = webFluxProperties;
}
@Bean
@ConditionalOnMissingBean
WebSessionIdResolver webSessionIdResolver() {
WebFluxProperties.Cookie cookieProperties = this.webFluxProperties.getSession().getCookie();
CookieWebSessionIdResolver webSessionIdResolver = new CookieWebSessionIdResolver();
String cookieName = cookieProperties.getName();
if (StringUtils.hasText(cookieName)) {
webSessionIdResolver.setCookieName(cookieName);
}
webSessionIdResolver.addCookieInitializer(this::initializeCookie);
return webSessionIdResolver;
}
private void initializeCookie(ResponseCookieBuilder builder) {
WebFluxProperties.Cookie cookie = this.webFluxProperties.getSession().getCookie();
PropertyMapper map = PropertyMapper.get().alwaysApplyingWhenNonNull();
map.from(cookie::getDomain).to(builder::domain);
map.from(cookie::getPath).to(builder::path);
map.from(cookie::getHttpOnly).to(builder::httpOnly);
map.from(cookie::getSecure).to(builder::secure);
map.from(cookie::getMaxAge).to(builder::maxAge);
map.from(cookie::getSameSite).as(SameSite::attribute).to(builder::sameSite);
}
@Configuration(proxyBeanMethods = false)
@ConditionalOnMissingBean(ReactiveSessionRepository.class)
@Import({ ReactiveSessionRepositoryImplementationValidator.class,

47
spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/web/ServerProperties.java
View File

@@ -34,6 +34,7 @@ import org.springframework.boot.context.properties.ConfigurationProperties;
import org.springframework.boot.context.properties.NestedConfigurationProperty;
import org.springframework.boot.convert.DurationUnit;
import org.springframework.boot.web.server.Compression;
import org.springframework.boot.web.server.Cookie;
import org.springframework.boot.web.server.Http2;
import org.springframework.boot.web.server.Shutdown;
import org.springframework.boot.web.server.Ssl;
@@ -116,6 +117,8 @@ public class ServerProperties {
private final Servlet servlet = new Servlet();
private final Reactive reactive = new Reactive();
private final Tomcat tomcat = new Tomcat();
private final Jetty jetty = new Jetty();
@@ -188,6 +191,10 @@ public class ServerProperties {
return this.servlet;
}
public Reactive getReactive() {
return this.reactive;
}
public Tomcat getTomcat() {
return this.tomcat;
}
@@ -213,7 +220,7 @@ public class ServerProperties {
}
/**
* Servlet properties.
* Servlet server properties.
*/
public static class Servlet {
@@ -296,6 +303,44 @@ public class ServerProperties {
}
/**
* Reactive server properties.
*/
public static class Reactive {
private final Session session = new Session();
public Session getSession() {
return this.session;
}
public static class Session {
/**
* Session timeout. If a duration suffix is not specified, seconds will be
* used.
*/
@DurationUnit(ChronoUnit.SECONDS)
private Duration timeout = Duration.ofMinutes(30);
private final Cookie cookie = new Cookie();
public Duration getTimeout() {
return this.timeout;
}
public void setTimeout(Duration timeout) {
this.timeout = timeout;
}
public Cookie getCookie() {
return this.cookie;
}
}
}
/**
* Tomcat properties.
*/

83
spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/web/reactive/WebFluxAutoConfiguration.java
View File

@@ -17,7 +17,6 @@
package org.springframework.boot.autoconfigure.web.reactive;
import java.time.Duration;
import java.util.function.Supplier;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
@@ -37,15 +36,13 @@ import org.springframework.boot.autoconfigure.template.TemplateAvailabilityProvi
import org.springframework.boot.autoconfigure.validation.ValidationAutoConfiguration;
import org.springframework.boot.autoconfigure.validation.ValidatorAdapter;
import org.springframework.boot.autoconfigure.web.ConditionalOnEnabledResourceChain;
import org.springframework.boot.autoconfigure.web.ServerProperties;
import org.springframework.boot.autoconfigure.web.WebProperties;
import org.springframework.boot.autoconfigure.web.WebProperties.Resources;
import org.springframework.boot.autoconfigure.web.format.DateTimeFormatters;
import org.springframework.boot.autoconfigure.web.format.WebConversionService;
import org.springframework.boot.autoconfigure.web.reactive.WebFluxProperties.Cookie;
import org.springframework.boot.autoconfigure.web.reactive.WebFluxProperties.Format;
import org.springframework.boot.autoconfigure.web.reactive.WebFluxProperties.SameSite;
import org.springframework.boot.context.properties.EnableConfigurationProperties;
import org.springframework.boot.context.properties.PropertyMapper;
import org.springframework.boot.convert.ApplicationConversionService;
import org.springframework.boot.web.codec.CodecCustomizer;
import org.springframework.boot.web.reactive.filter.OrderedHiddenHttpMethodFilter;
@@ -57,10 +54,8 @@ import org.springframework.core.Ordered;
import org.springframework.core.annotation.Order;
import org.springframework.format.FormatterRegistry;
import org.springframework.format.support.FormattingConversionService;
import org.springframework.http.ResponseCookie.ResponseCookieBuilder;
import org.springframework.http.codec.ServerCodecConfigurer;
import org.springframework.util.ClassUtils;
import org.springframework.util.StringUtils;
import org.springframework.validation.Validator;
import org.springframework.web.filter.reactive.HiddenHttpMethodFilter;
import org.springframework.web.reactive.config.DelegatingWebFluxConfiguration;
@@ -83,7 +78,6 @@ import org.springframework.web.server.adapter.WebHttpHandlerBuilder;
import org.springframework.web.server.i18n.AcceptHeaderLocaleContextResolver;
import org.springframework.web.server.i18n.FixedLocaleContextResolver;
import org.springframework.web.server.i18n.LocaleContextResolver;
import org.springframework.web.server.session.CookieWebSessionIdResolver;
import org.springframework.web.server.session.DefaultWebSessionManager;
import org.springframework.web.server.session.InMemoryWebSessionStore;
import org.springframework.web.server.session.WebSessionIdResolver;
@@ -108,7 +102,8 @@ import org.springframework.web.server.session.WebSessionManager;
@ConditionalOnClass(WebFluxConfigurer.class)
@ConditionalOnMissingBean({ WebFluxConfigurationSupport.class })
@AutoConfigureAfter({ ReactiveWebServerFactoryAutoConfiguration.class, CodecsAutoConfiguration.class,
ReactiveMultipartAutoConfiguration.class, ValidationAutoConfiguration.class })
ReactiveMultipartAutoConfiguration.class, ValidationAutoConfiguration.class,
WebSessionIdResolverAutoConfiguration.class })
@AutoConfigureOrder(Ordered.HIGHEST_PRECEDENCE + 10)
public class WebFluxAutoConfiguration {
@@ -240,19 +235,22 @@ public class WebFluxAutoConfiguration {
* Configuration equivalent to {@code @EnableWebFlux}.
*/
@Configuration(proxyBeanMethods = false)
@EnableConfigurationProperties(WebProperties.class)
@EnableConfigurationProperties({ WebProperties.class, ServerProperties.class })
public static class EnableWebFluxConfiguration extends DelegatingWebFluxConfiguration {
private final WebFluxProperties webFluxProperties;
private final WebProperties webProperties;
private final ServerProperties serverProperties;
private final WebFluxRegistrations webFluxRegistrations;
public EnableWebFluxConfiguration(WebFluxProperties webFluxProperties, WebProperties webProperties,
ObjectProvider<WebFluxRegistrations> webFluxRegistrations) {
ServerProperties serverProperties, ObjectProvider<WebFluxRegistrations> webFluxRegistrations) {
this.webFluxProperties = webFluxProperties;
this.webProperties = webProperties;
this.serverProperties = serverProperties;
this.webFluxRegistrations = webFluxRegistrations.getIfUnique();
}
@@ -313,54 +311,12 @@ public class WebFluxAutoConfiguration {
@ConditionalOnMissingBean(name = WebHttpHandlerBuilder.WEB_SESSION_MANAGER_BEAN_NAME)
public WebSessionManager webSessionManager(ObjectProvider<WebSessionIdResolver> webSessionIdResolver) {
DefaultWebSessionManager webSessionManager = new DefaultWebSessionManager();
Duration timeout = this.webFluxProperties.getSession().getTimeout();
Duration timeout = this.serverProperties.getReactive().getSession().getTimeout();
webSessionManager.setSessionStore(new MaxIdleTimeInMemoryWebSessionStore(timeout));
webSessionManager.setSessionIdResolver(webSessionIdResolver.getIfAvailable(cookieWebSessionIdResolver()));
webSessionIdResolver.ifAvailable(webSessionManager::setSessionIdResolver);
return webSessionManager;
}
private Supplier<WebSessionIdResolver> cookieWebSessionIdResolver() {
return () -> {
CookieWebSessionIdResolver resolver = new CookieWebSessionIdResolver();
String cookieName = this.webFluxProperties.getSession().getCookie().getName();
if (StringUtils.hasText(cookieName)) {
resolver.setCookieName(cookieName);
}
resolver.addCookieInitializer(this::initializeCookie);
return resolver;
};
}
private void initializeCookie(ResponseCookieBuilder builder) {
Cookie cookie = this.webFluxProperties.getSession().getCookie();
PropertyMapper map = PropertyMapper.get().alwaysApplyingWhenNonNull();
map.from(cookie::getDomain).to(builder::domain);
map.from(cookie::getPath).to(builder::path);
map.from(cookie::getHttpOnly).to(builder::httpOnly);
map.from(cookie::getSecure).to(builder::secure);
map.from(cookie::getMaxAge).to(builder::maxAge);
map.from(cookie::getSameSite).as(SameSite::attribute).to(builder::sameSite);
}
static final class MaxIdleTimeInMemoryWebSessionStore extends InMemoryWebSessionStore {
private final Duration timeout;
private MaxIdleTimeInMemoryWebSessionStore(Duration timeout) {
this.timeout = timeout;
}
@Override
public Mono<WebSession> createWebSession() {
return super.createWebSession().doOnSuccess(this::setMaxIdleTime);
}
private void setMaxIdleTime(WebSession session) {
session.setMaxIdleTime(this.timeout);
}
}
}
@Configuration(proxyBeanMethods = false)
@@ -375,4 +331,23 @@ public class WebFluxAutoConfiguration {
}
static final class MaxIdleTimeInMemoryWebSessionStore extends InMemoryWebSessionStore {
private final Duration timeout;
private MaxIdleTimeInMemoryWebSessionStore(Duration timeout) {
this.timeout = timeout;
}
@Override
public Mono<WebSession> createWebSession() {
return super.createWebSession().doOnSuccess(this::setMaxIdleTime);
}
private void setMaxIdleTime(WebSession session) {
session.setMaxIdleTime(this.timeout);
}
}
}

125
spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/web/reactive/WebFluxProperties.java
View File

@@ -16,11 +16,8 @@
package org.springframework.boot.autoconfigure.web.reactive;
import java.time.Duration;
import java.time.temporal.ChronoUnit;
import org.springframework.boot.context.properties.ConfigurationProperties;
import org.springframework.boot.convert.DurationUnit;
import org.springframework.boot.context.properties.DeprecatedConfigurationProperty;
import org.springframework.util.StringUtils;
/**
@@ -71,6 +68,7 @@ public class WebFluxProperties {
return this.format;
}
@DeprecatedConfigurationProperty(replacement = "server.reactive.session")
public Session getSession() {
return this.session;
}
@@ -126,120 +124,39 @@ public class WebFluxProperties {
}
/**
* Session properties.
*
* @deprecated since 2.6.0 for removal in 2.8.0 in favor of
* {@code server.reactive.session}.
*/
@Deprecated
public static class Session {
/**
* Session timeout. If a duration suffix is not specified, seconds will be used.
*/
@DurationUnit(ChronoUnit.SECONDS)
private Duration timeout = Duration.ofMinutes(30);
private final Cookie cookie = new Cookie();
public Duration getTimeout() {
return this.timeout;
}
public void setTimeout(Duration timeout) {
this.timeout = timeout;
}
@DeprecatedConfigurationProperty(replacement = "server.reactive.session.cookie")
public Cookie getCookie() {
return this.cookie;
}
}
/**
* Session cookie properties.
*
* @deprecated since 2.6.0 for removal in 2.8.0 in favor of
* {@link org.springframework.boot.web.server.Cookie}.
*/
@Deprecated
public static class Cookie {
/**
* Name attribute value for session Cookies.
*/
private String name;
/**
* Domain attribute value for session Cookies.
*/
private String domain;
/**
* Path attribute value for session Cookies.
*/
private String path;
/**
* HttpOnly attribute value for session Cookies.
*/
private Boolean httpOnly;
/**
* Secure attribute value for session Cookies.
*/
private Boolean secure;
/**
* Maximum age of the session cookie. If a duration suffix is not specified,
* seconds will be used. A positive value indicates when the cookie expires
* relative to the current time. A value of 0 means the cookie should expire
* immediately. A negative value means no "Max-Age" attribute in which case the
* cookie is removed when the browser is closed.
*/
@DurationUnit(ChronoUnit.SECONDS)
private Duration maxAge;
/**
* SameSite attribute value for session Cookies.
*/
private SameSite sameSite;
public String getName() {
return this.name;
}
public void setName(String name) {
this.name = name;
}
public String getDomain() {
return this.domain;
}
public void setDomain(String domain) {
this.domain = domain;
}
public String getPath() {
return this.path;
}
public void setPath(String path) {
this.path = path;
}
public Boolean getHttpOnly() {
return this.httpOnly;
}
public void setHttpOnly(Boolean httpOnly) {
this.httpOnly = httpOnly;
}
public Boolean getSecure() {
return this.secure;
}
public void setSecure(Boolean secure) {
this.secure = secure;
}
public Duration getMaxAge() {
return this.maxAge;
}
public void setMaxAge(Duration maxAge) {
this.maxAge = maxAge;
}
@DeprecatedConfigurationProperty(replacement = "server.reactive.session.cookie.same-site")
public SameSite getSameSite() {
return this.sameSite;
}
@@ -250,6 +167,12 @@ public class WebFluxProperties {
}
/**
* SameSite values.
* @deprecated since 2.6.0 for removal in 2.8.0 in favor of
* {@link org.springframework.boot.web.server.Cookie.SameSite}.
*/
@Deprecated
public enum SameSite {
/**

106
spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/web/reactive/WebSessionIdResolverAutoConfiguration.java Normal file
View File

@@ -0,0 +1,106 @@
/*
* Copyright 2012-2021 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* https://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.springframework.boot.autoconfigure.web.reactive;
import reactor.core.publisher.Mono;
import org.springframework.boot.autoconfigure.condition.ConditionalOnClass;
import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean;
import org.springframework.boot.autoconfigure.web.ServerProperties;
import org.springframework.boot.context.properties.EnableConfigurationProperties;
import org.springframework.boot.context.properties.PropertyMapper;
import org.springframework.boot.context.properties.source.MutuallyExclusiveConfigurationPropertiesException;
import org.springframework.boot.web.server.Cookie;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.http.ResponseCookie.ResponseCookieBuilder;
import org.springframework.util.StringUtils;
import org.springframework.web.server.session.CookieWebSessionIdResolver;
import org.springframework.web.server.session.WebSessionIdResolver;
import org.springframework.web.server.session.WebSessionManager;
/**
* Auto-configuration for {@link WebSessionIdResolver}.
*
* @author Phillip Webb
* @author Brian Clozel
* @author Weix Sun
* @since 2.6.0
*/
@Configuration(proxyBeanMethods = false)
@ConditionalOnClass({ WebSessionManager.class, Mono.class })
@EnableConfigurationProperties({ WebFluxProperties.class, ServerProperties.class })
public class WebSessionIdResolverAutoConfiguration {
private final ServerProperties serverProperties;
private final WebFluxProperties webFluxProperties;
public WebSessionIdResolverAutoConfiguration(ServerProperties serverProperties,
WebFluxProperties webFluxProperties) {
this.serverProperties = serverProperties;
this.webFluxProperties = webFluxProperties;
assertNoMutuallyExclusiveProperties(serverProperties, webFluxProperties);
}
@SuppressWarnings("deprecation")
private void assertNoMutuallyExclusiveProperties(ServerProperties serverProperties,
WebFluxProperties webFluxProperties) {
MutuallyExclusiveConfigurationPropertiesException.throwIfMultipleNonNullValuesIn((entries) -> {
entries.put("spring.webflux.session.cookie.same-site",
webFluxProperties.getSession().getCookie().getSameSite());
entries.put("server.reactive.session.cookie.same-site",
serverProperties.getReactive().getSession().getCookie().getSameSite());
});
}
@Bean
@ConditionalOnMissingBean
public WebSessionIdResolver webSessionIdResolver() {
CookieWebSessionIdResolver resolver = new CookieWebSessionIdResolver();
String cookieName = this.serverProperties.getReactive().getSession().getCookie().getName();
if (StringUtils.hasText(cookieName)) {
resolver.setCookieName(cookieName);
}
resolver.addCookieInitializer(this::initializeCookie);
return resolver;
}
private void initializeCookie(ResponseCookieBuilder builder) {
Cookie cookie = this.serverProperties.getReactive().getSession().getCookie();
PropertyMapper map = PropertyMapper.get().alwaysApplyingWhenNonNull();
map.from(cookie::getDomain).to(builder::domain);
map.from(cookie::getPath).to(builder::path);
map.from(cookie::getHttpOnly).to(builder::httpOnly);
map.from(cookie::getSecure).to(builder::secure);
map.from(cookie::getMaxAge).to(builder::maxAge);
map.from(getSameSite(cookie)).to(builder::sameSite);
}
@SuppressWarnings("deprecation")
private String getSameSite(Cookie properties) {
if (properties.getSameSite() != null) {
return properties.getSameSite().attributeValue();
}
WebFluxProperties.Cookie deprecatedProperties = this.webFluxProperties.getSession().getCookie();
if (deprecatedProperties.getSameSite() != null) {
return deprecatedProperties.getSameSite().attribute();
}
return null;
}
}

48
spring-boot-project/spring-boot-autoconfigure/src/main/resources/META-INF/additional-spring-configuration-metadata.json
View File

@@ -158,34 +158,6 @@
"level": "error"
}
},
{
"name": "server.servlet.session.cookie.comment",
"description": "Comment for the session cookie."
},
{
"name": "server.servlet.session.cookie.domain",
"description": "Domain for the session cookie."
},
{
"name": "server.servlet.session.cookie.http-only",
"description": "Whether to use \"HttpOnly\" cookies for session cookies."
},
{
"name": "server.servlet.session.cookie.max-age",
"description": "Maximum age of the session cookie. If a duration suffix is not specified, seconds will be used."
},
{
"name": "server.servlet.session.cookie.name",
"description": "Session cookie name."
},
{
"name": "server.servlet.session.cookie.path",
"description": "Path of the session cookie."
},
{
"name": "server.servlet.session.cookie.secure",
"description": "Whether to always mark the session cookie as secure."
},
{
"name": "server.servlet.session.persistent",
"description": "Whether to persist session data between restarts.",
@@ -2031,26 +2003,6 @@
"name": "spring.webflux.session.timeout",
"defaultValue": "30m"
},
{
"name": "spring.webflux.session.cookie.name",
"defaultValue": "SESSION"
},
{
"name": "spring.webflux.session.cookie.path",
"defaultValue": "server.servlet.context-path"
},
{
"name": "spring.webflux.session.cookie.max-age",
"defaultValue": "-1s"
},
{
"name": "spring.webflux.session.cookie.http-only",
"defaultValue": true
},
{
"name": "spring.webflux.session.cookie.same-site",
"defaultValue": "lax"
},
{
"name": "spring.webservices.wsdl-locations",
"type": "java.util.List<java.lang.String>",

1
spring-boot-project/spring-boot-autoconfigure/src/main/resources/META-INF/spring.factories
View File

@@ -141,6 +141,7 @@ org.springframework.boot.autoconfigure.web.reactive.HttpHandlerAutoConfiguration
org.springframework.boot.autoconfigure.web.reactive.ReactiveMultipartAutoConfiguration,\
org.springframework.boot.autoconfigure.web.reactive.ReactiveWebServerFactoryAutoConfiguration,\
org.springframework.boot.autoconfigure.web.reactive.WebFluxAutoConfiguration,\
org.springframework.boot.autoconfigure.web.reactive.WebSessionIdResolverAutoConfiguration,\
org.springframework.boot.autoconfigure.web.reactive.error.ErrorWebFluxAutoConfiguration,\
org.springframework.boot.autoconfigure.web.reactive.function.client.ClientHttpConnectorAutoConfiguration,\
org.springframework.boot.autoconfigure.web.reactive.function.client.WebClientAutoConfiguration,\

24
spring-boot-project/spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/session/ReactiveSessionAutoConfigurationMongoTests.java
View File

@@ -27,6 +27,7 @@ import org.springframework.boot.autoconfigure.data.mongo.MongoReactiveDataAutoCo
import org.springframework.boot.autoconfigure.mongo.MongoAutoConfiguration;
import org.springframework.boot.autoconfigure.mongo.MongoReactiveAutoConfiguration;
import org.springframework.boot.autoconfigure.mongo.embedded.EmbeddedMongoAutoConfiguration;
import org.springframework.boot.autoconfigure.web.reactive.WebSessionIdResolverAutoConfiguration;
import org.springframework.boot.test.context.FilteredClassLoader;
import org.springframework.boot.test.context.assertj.AssertableReactiveWebApplicationContext;
import org.springframework.boot.test.context.runner.ContextConsumer;
@@ -81,8 +82,8 @@ class ReactiveSessionAutoConfigurationMongoTests extends AbstractSessionAutoConf
}
@Test
void defaultConfigWithCustomWebFluxTimeout() {
this.contextRunner.withPropertyValues("spring.session.store-type=mongodb", "spring.webflux.session.timeout=1m")
void defaultConfigWithCustomSessionTimeout() {
this.contextRunner.withPropertyValues("spring.session.store-type=mongodb", "server.reactive.session.timeout=1m")
.withConfiguration(AutoConfigurations.of(EmbeddedMongoAutoConfiguration.class,
MongoAutoConfiguration.class, MongoDataAutoConfiguration.class,
MongoReactiveAutoConfiguration.class, MongoReactiveDataAutoConfiguration.class))
@@ -105,17 +106,16 @@ class ReactiveSessionAutoConfigurationMongoTests extends AbstractSessionAutoConf
@Test
void sessionCookieConfigurationIsAppliedToAutoConfiguredWebSessionIdResolver() {
this.contextRunner
.withConfiguration(AutoConfigurations.of(EmbeddedMongoAutoConfiguration.class,
MongoAutoConfiguration.class, MongoDataAutoConfiguration.class,
MongoReactiveAutoConfiguration.class, MongoReactiveDataAutoConfiguration.class))
.withUserConfiguration(Config.class)
AutoConfigurations autoConfigurations = AutoConfigurations.of(EmbeddedMongoAutoConfiguration.class,
MongoAutoConfiguration.class, MongoDataAutoConfiguration.class, MongoReactiveAutoConfiguration.class,
MongoReactiveDataAutoConfiguration.class, WebSessionIdResolverAutoConfiguration.class);
this.contextRunner.withConfiguration(autoConfigurations).withUserConfiguration(Config.class)
.withPropertyValues("spring.session.store-type=mongodb",
"spring.webflux.session.cookie.name:JSESSIONID",
"spring.webflux.session.cookie.domain:.example.com",
"spring.webflux.session.cookie.path:/example", "spring.webflux.session.cookie.max-age:60",
"spring.webflux.session.cookie.http-only:false", "spring.webflux.session.cookie.secure:false",
"spring.webflux.session.cookie.same-site:strict")
"server.reactive.session.cookie.name:JSESSIONID",
"server.reactive.session.cookie.domain:.example.com",
"server.reactive.session.cookie.path:/example", "server.reactive.session.cookie.max-age:60",
"server.reactive.session.cookie.http-only:false", "server.reactive.session.cookie.secure:false",
"server.reactive.session.cookie.same-site:strict")
.run(assertExchangeWithSession((exchange) -> {
List<ResponseCookie> cookies = exchange.getResponse().getCookies().get("JSESSIONID");
assertThat(cookies).isNotEmpty();

31
spring-boot-project/spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/web/reactive/WebFluxAutoConfigurationTests.java
View File

@@ -40,6 +40,7 @@ import org.springframework.boot.autoconfigure.AutoConfigurations;
import org.springframework.boot.autoconfigure.validation.ValidationAutoConfiguration;
import org.springframework.boot.autoconfigure.validation.ValidatorAdapter;
import org.springframework.boot.autoconfigure.web.reactive.WebFluxAutoConfiguration.WebFluxConfig;
import org.springframework.boot.context.properties.source.MutuallyExclusiveConfigurationPropertiesException;
import org.springframework.boot.test.context.runner.ContextConsumer;
import org.springframework.boot.test.context.runner.ReactiveWebApplicationContextRunner;
import org.springframework.boot.web.codec.CodecCustomizer;
@@ -111,7 +112,8 @@ class WebFluxAutoConfigurationTests {
private static final MockReactiveWebServerFactory mockReactiveWebServerFactory = new MockReactiveWebServerFactory();
private final ReactiveWebApplicationContextRunner contextRunner = new ReactiveWebApplicationContextRunner()
.withConfiguration(AutoConfigurations.of(WebFluxAutoConfiguration.class))
.withConfiguration(
AutoConfigurations.of(WebFluxAutoConfiguration.class, WebSessionIdResolverAutoConfiguration.class))
.withUserConfiguration(Config.class);
@Test
@@ -571,19 +573,36 @@ class WebFluxAutoConfigurationTests {
@Test
void customSessionTimeoutConfigurationShouldBeApplied() {
this.contextRunner.withPropertyValues("spring.webflux.session.timeout:123")
this.contextRunner.withPropertyValues("server.reactive.session.timeout:123")
.run((assertSessionTimeoutWithWebSession((webSession) -> {
webSession.start();
assertThat(webSession.getMaxIdleTime()).hasSeconds(123);
})));
}
@Test
void sameSiteAttributesAreExclusive() {
this.contextRunner.withPropertyValues("spring.webflux.session.cookie.same-site:strict",
"server.reactive.session.cookie.same-site:strict").run((context) -> {
assertThat(context).hasFailed();
assertThat(context).getFailure()
.hasRootCauseExactlyInstanceOf(MutuallyExclusiveConfigurationPropertiesException.class);
});
}
@Test
void deprecatedCustomSameSiteConfigurationShouldBeApplied() {
this.contextRunner.withPropertyValues("spring.webflux.session.cookie.same-site:strict").run(
assertExchangeWithSession((exchange) -> assertThat(exchange.getResponse().getCookies().get("SESSION"))
.isNotEmpty().allMatch((cookie) -> cookie.getSameSite().equals("Strict"))));
}
@Test
void customSessionCookieConfigurationShouldBeApplied() {
this.contextRunner.withPropertyValues("spring.webflux.session.cookie.name:JSESSIONID",
"spring.webflux.session.cookie.domain:.example.com", "spring.webflux.session.cookie.path:/example",
"spring.webflux.session.cookie.max-age:60", "spring.webflux.session.cookie.http-only:false",
"spring.webflux.session.cookie.secure:false", "spring.webflux.session.cookie.same-site:strict")
this.contextRunner.withPropertyValues("server.reactive.session.cookie.name:JSESSIONID",
"server.reactive.session.cookie.domain:.example.com", "server.reactive.session.cookie.path:/example",
"server.reactive.session.cookie.max-age:60", "server.reactive.session.cookie.http-only:false",
"server.reactive.session.cookie.secure:false", "server.reactive.session.cookie.same-site:strict")
.run(assertExchangeWithSession((exchange) -> {
List<ResponseCookie> cookies = exchange.getResponse().getCookies().get("JSESSIONID");
assertThat(cookies).isNotEmpty();

164
spring-boot-project/spring-boot/src/main/java/org/springframework/boot/web/server/Cookie.java Normal file
View File

@@ -0,0 +1,164 @@
/*
* Copyright 2012-2021 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* https://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.springframework.boot.web.server;
import java.time.Duration;
import java.time.temporal.ChronoUnit;
import org.springframework.boot.convert.DurationUnit;
/**
* Cookie properties.
*
* @author Phillip Webb
* @author Andy Wilkinson
* @author Brian Clozel
* @author Weix Sun
* @since 2.6.0
*/
public class Cookie {
/**
* Name for the cookie.
*/
private String name;
/**
* Domain for the cookie.
*/
private String domain;
/**
* Path of the cookie.
*/
private String path;
/**
* Whether to use "HttpOnly" cookies for the cookie.
*/
private Boolean httpOnly;
/**
* Whether to always mark the cookie as secure.
*/
private Boolean secure;
/**
* Maximum age of the cookie. If a duration suffix is not specified, seconds will be
* used. A positive value indicates when the cookie expires relative to the current
* time. A value of 0 means the cookie should expire immediately. A negative value
* means no "Max-Age".
*/
@DurationUnit(ChronoUnit.SECONDS)
private Duration maxAge;
/**
* SameSite setting for the cookie.
*/
private SameSite sameSite;
public String getName() {
return this.name;
}
public void setName(String name) {
this.name = name;
}
public String getDomain() {
return this.domain;
}
public void setDomain(String domain) {
this.domain = domain;
}
public String getPath() {
return this.path;
}
public void setPath(String path) {
this.path = path;
}
public Boolean getHttpOnly() {
return this.httpOnly;
}
public void setHttpOnly(Boolean httpOnly) {
this.httpOnly = httpOnly;
}
public Boolean getSecure() {
return this.secure;
}
public void setSecure(Boolean secure) {
this.secure = secure;
}
public Duration getMaxAge() {
return this.maxAge;
}
public void setMaxAge(Duration maxAge) {
this.maxAge = maxAge;
}
public SameSite getSameSite() {
return this.sameSite;
}
public void setSameSite(SameSite sameSite) {
this.sameSite = sameSite;
}
/**
* SameSite values.
*/
public enum SameSite {
/**
* Cookies are sent in both first-party and cross-origin requests.
*/
NONE("None"),
/**
* Cookies are sent in a first-party context, also when following a link to the
* origin site.
*/
LAX("Lax"),
/**
* Cookies are only sent in a first-party context (i.e. not when following a link
* to the origin site).
*/
STRICT("Strict");
private final String attributeValue;
SameSite(String attributeValue) {
this.attributeValue = attributeValue;
}
public String attributeValue() {
return this.attributeValue;
}
}
}

93
spring-boot-project/spring-boot/src/main/java/org/springframework/boot/web/servlet/server/Session.java
View File

@@ -101,61 +101,15 @@ public class Session {
}
/**
* Cookie properties.
* Session cookie properties.
*/
public static class Cookie {
private String name;
private String domain;
private String path;
public static class Cookie extends org.springframework.boot.web.server.Cookie {
/**
* Comment for the session cookie.
*/
private String comment;
private Boolean httpOnly;
private Boolean secure;
@DurationUnit(ChronoUnit.SECONDS)
private Duration maxAge;
/**
* Return the session cookie name.
* @return the session cookie name
*/
public String getName() {
return this.name;
}
public void setName(String name) {
this.name = name;
}
/**
* Return the domain for the session cookie.
* @return the session cookie domain
*/
public String getDomain() {
return this.domain;
}
public void setDomain(String domain) {
this.domain = domain;
}
/**
* Return the path of the session cookie.
* @return the session cookie path
*/
public String getPath() {
return this.path;
}
public void setPath(String path) {
this.path = path;
}
/**
* Return the comment for the session cookie.
* @return the session cookie comment
@@ -168,43 +122,6 @@ public class Session {
this.comment = comment;
}
/**
* Return whether to use "HttpOnly" cookies for session cookies.
* @return {@code true} to use "HttpOnly" cookies for session cookies.
*/
public Boolean getHttpOnly() {
return this.httpOnly;
}
public void setHttpOnly(Boolean httpOnly) {
this.httpOnly = httpOnly;
}
/**
* Return whether to always mark the session cookie as secure.
* @return {@code true} to mark the session cookie as secure even if the request
* that initiated the corresponding session is using plain HTTP
*/
public Boolean getSecure() {
return this.secure;
}
public void setSecure(Boolean secure) {
this.secure = secure;
}
/**
* Return the maximum age of the session cookie.
* @return the maximum age of the session cookie
*/
public Duration getMaxAge() {
return this.maxAge;
}
public void setMaxAge(Duration maxAge) {
this.maxAge = maxAge;
}
}
/**