Spring/spring-framework
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Check the user of a SockJS request

Browse Source 
Issue: SPR-12497
(backport of commit dc5b5c)
This commit is contained in:
Rossen Stoyanchev
2014-12-08 11:22:45 -05:00
parent 328ba7b6d4
commit ac5c361688
2 changed files with 32 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
spring-websocket/src/main/java/org/springframework/web/socket/sockjs/transport/TransportHandlingSockJsService.java
View File

@@ -242,6 +242,15 @@ public class TransportHandlingSockJsService extends AbstractSockJsService implem
return;
}
}
else {
if (session.getPrincipal() != null) {
if (!session.getPrincipal().equals(request.getPrincipal())) {
logger.debug("The user for the session does not match the user for the request.");
response.setStatusCode(HttpStatus.NOT_FOUND);
return;
}
}
}
if (transportType.sendsNoCacheInstruction()) {
addNoCacheHeaders(response);

23
spring-websocket/src/test/java/org/springframework/web/socket/sockjs/transport/handler/DefaultSockJsServiceTests.java
View File

@@ -27,6 +27,7 @@ import org.mockito.MockitoAnnotations;
import org.springframework.scheduling.TaskScheduler;
import org.springframework.web.socket.AbstractHttpRequestTests;
import org.springframework.web.socket.WebSocketHandler;
import org.springframework.web.socket.handler.TestPrincipal;
import org.springframework.web.socket.sockjs.transport.SockJsSessionFactory;
import org.springframework.web.socket.sockjs.transport.TransportHandler;
import org.springframework.web.socket.sockjs.transport.TransportHandlingSockJsService;
@@ -178,6 +179,28 @@ public class DefaultSockJsServiceTests extends AbstractHttpRequestTests {
verify(this.xhrSendHandler).handleRequest(this.request, this.response, this.wsHandler, this.session);
}
@Test
public void handleTransportRequestXhrSendWithDifferentUser() throws Exception {
String sockJsPath = sessionUrlPrefix + "xhr";
setRequest("POST", sockJsPrefix + sockJsPath);
this.service.handleRequest(this.request, this.response, sockJsPath, this.wsHandler);
assertEquals(200, this.servletResponse.getStatus()); // session created
verify(this.xhrHandler).handleRequest(this.request, this.response, this.wsHandler, this.session);
this.session.setPrincipal(new TestPrincipal("little red riding hood"));
this.servletRequest.setUserPrincipal(new TestPrincipal("wolf"));
resetResponse();
reset(this.xhrSendHandler);
sockJsPath = sessionUrlPrefix + "xhr_send";
setRequest("POST", sockJsPrefix + sockJsPath);
this.service.handleRequest(this.request, this.response, sockJsPath, this.wsHandler);
assertEquals(404, this.servletResponse.getStatus());
verifyNoMoreInteractions(this.xhrSendHandler);
}
interface SessionCreatingTransportHandler extends TransportHandler, SockJsSessionFactory {
}