Spring/spring-framework
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Polish CookieWebSessionIdResolver

Browse Source
This commit is contained in:
Rossen Stoyanchev
2018-06-29 15:33:08 -03:00
parent 907a306ee2
commit 5ec8db1adc
2 changed files with 24 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
spring-web/src/main/java/org/springframework/http/ResponseCookie.java
View File

@@ -115,6 +115,7 @@ public final class ResponseCookie extends HttpCookie {
* <p>This limits the scope of the cookie such that it will only be attached to
* same site requests if {@code "Strict"} or cross-site requests if {@code "Lax"}.
* @see <a href="https://tools.ietf.org/html/draft-ietf-httpbis-rfc6265bis#section-4.1.2.7">RFC6265 bis</a>
* @since 5.1
*/
@Nullable
public String getSameSite() {
@@ -235,7 +236,7 @@ public final class ResponseCookie extends HttpCookie {
}
@Override
public ResponseCookieBuilder sameSite(String sameSite) {
public ResponseCookieBuilder sameSite(@Nullable String sameSite) {
this.sameSite = sameSite;
return this;
}
@@ -295,9 +296,11 @@ public final class ResponseCookie extends HttpCookie {
* <p>This limits the scope of the cookie such that it will only be
* attached to same site requests if {@code "Strict"} or cross-site
* requests if {@code "Lax"}.
* <p>By default set to {@code "Strict"}.
* @see <a href="https://tools.ietf.org/html/draft-ietf-httpbis-rfc6265bis#section-4.1.2.7">RFC6265 bis</a>
* @since 5.1
*/
ResponseCookieBuilder sameSite(String sameSite);
ResponseCookieBuilder sameSite(@Nullable String sameSite);
/**
* Create the HttpCookie.

29
spring-web/src/main/java/org/springframework/web/server/session/CookieWebSessionIdResolver.java
View File

@@ -23,6 +23,7 @@ import java.util.stream.Collectors;
import org.springframework.http.HttpCookie;
import org.springframework.http.ResponseCookie;
import org.springframework.lang.Nullable;
import org.springframework.util.Assert;
import org.springframework.util.MultiValueMap;
import org.springframework.web.server.ServerWebExchange;
@@ -81,8 +82,9 @@ public class CookieWebSessionIdResolver implements WebSessionIdResolver {
* Set the value for the "SameSite" attribute of the cookie that holds the
* session id. For its meaning and possible values, see
* {@link ResponseCookie#getSameSite()}.
* <p>By default set to {@code "Strict"}
* <p>By default set to {@code "Strict"}.
* @param sameSite the SameSite value
* @since 5.1
*/
public void setSameSite(String sameSite) {
this.sameSite = sameSite;
@@ -90,11 +92,13 @@ public class CookieWebSessionIdResolver implements WebSessionIdResolver {
/**
* Return the configured "SameSite" attribute value for the session cookie.
* @since 5.1
*/
public String getSameSite() {
return this.sameSite;
}
@Override
public List<String> resolveSessionIds(ServerWebExchange exchange) {
MultiValueMap<String, HttpCookie> cookieMap = exchange.getRequest().getCookies();
@@ -108,21 +112,26 @@ public class CookieWebSessionIdResolver implements WebSessionIdResolver {
@Override
public void setSessionId(ServerWebExchange exchange, String id) {
Assert.notNull(id, "'id' is required");
setSessionCookie(exchange, id, getCookieMaxAge(), getSameSite());
ResponseCookie cookie = initSessionCookie(exchange, id, getCookieMaxAge(), getSameSite());
exchange.getResponse().getCookies().set(this.cookieName, cookie);
}
@Override
public void expireSession(ServerWebExchange exchange) {
setSessionCookie(exchange, "", Duration.ofSeconds(0), "");
ResponseCookie cookie = initSessionCookie(exchange, "", Duration.ZERO, null);
exchange.getResponse().getCookies().set(this.cookieName, cookie);
}
private void setSessionCookie(ServerWebExchange exchange, String id, Duration maxAge, String sameSite) {
String name = getCookieName();
boolean secure = "https".equalsIgnoreCase(exchange.getRequest().getURI().getScheme());
String path = exchange.getRequest().getPath().contextPath().value() + "/";
exchange.getResponse().getCookies().set(name,
ResponseCookie.from(name, id).path(path)
.maxAge(maxAge).httpOnly(true).secure(secure).sameSite(sameSite).build());
private ResponseCookie initSessionCookie(
ServerWebExchange exchange, String id, Duration maxAge, @Nullable String sameSite) {
return ResponseCookie.from(this.cookieName, id)
.path(exchange.getRequest().getPath().contextPath().value() + "/")
.maxAge(maxAge)
.httpOnly(true)
.secure("https".equalsIgnoreCase(exchange.getRequest().getURI().getScheme()))
.sameSite(sameSite)
.build();
}
}