Spring/spring-security
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Cache Xor CsrfToken

Browse Source 
Closes gh-11988
This commit is contained in:
Steve Riesenberg
2022-10-12 10:27:09 -05:00
parent ffbcaca24a
commit 05e4a1dd20
4 changed files with 44 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
web/src/main/java/org/springframework/security/web/csrf/XorCsrfTokenRequestAttributeHandler.java
View File

@@ -59,12 +59,12 @@ public final class XorCsrfTokenRequestAttributeHandler extends CsrfTokenRequestA
}
private Supplier<CsrfToken> deferCsrfTokenUpdate(Supplier<CsrfToken> csrfTokenSupplier) {
return () -> {
return new CachedCsrfTokenSupplier(() -> {
CsrfToken csrfToken = csrfTokenSupplier.get();
Assert.state(csrfToken != null, "csrfToken supplier returned null");
String updatedToken = createXoredCsrfToken(this.secureRandom, csrfToken.getToken());
return new DefaultCsrfToken(csrfToken.getHeaderName(), csrfToken.getParameterName(), updatedToken);
};
});
}
@Override
@@ -123,4 +123,24 @@ public final class XorCsrfTokenRequestAttributeHandler extends CsrfTokenRequestA
return xoredCsrf;
}
private static final class CachedCsrfTokenSupplier implements Supplier<CsrfToken> {
private final Supplier<CsrfToken> delegate;
private CsrfToken csrfToken;
private CachedCsrfTokenSupplier(Supplier<CsrfToken> delegate) {
this.delegate = delegate;
}
@Override
public CsrfToken get() {
if (this.csrfToken == null) {
this.csrfToken = this.delegate.get();
}
return this.csrfToken;
}
}
}

3
web/src/main/java/org/springframework/security/web/server/csrf/XorServerCsrfTokenRequestAttributeHandler.java
View File

@@ -53,7 +53,8 @@ public final class XorServerCsrfTokenRequestAttributeHandler extends ServerCsrfT
Assert.notNull(exchange, "exchange cannot be null");
Assert.notNull(csrfToken, "csrfToken cannot be null");
Mono<CsrfToken> updatedCsrfToken = csrfToken.map((token) -> new DefaultCsrfToken(token.getHeaderName(),
token.getParameterName(), createXoredCsrfToken(this.secureRandom, token.getToken())));
token.getParameterName(), createXoredCsrfToken(this.secureRandom, token.getToken())))
.cast(CsrfToken.class).cache();
super.handle(exchange, updatedCsrfToken);
}