Spring/spring-security
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Cache Xor CsrfToken

Browse Source 
Closes gh-11988
This commit is contained in:
Steve Riesenberg
2022-10-12 10:27:09 -05:00
parent ffbcaca24a
commit 05e4a1dd20
4 changed files with 44 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
web/src/test/java/org/springframework/security/web/csrf/XorCsrfTokenRequestAttributeHandlerTests.java
View File

@@ -148,6 +148,15 @@ public class XorCsrfTokenRequestAttributeHandlerTests {
assertThat(csrfTokenAttribute.getToken()).isEqualTo(XOR_CSRF_TOKEN_VALUE);
}
@Test
public void handleWhenCsrfTokenRequestedTwiceThenCached() {
this.handler.handle(this.request, this.response, () -> this.token);
CsrfToken csrfTokenAttribute = (CsrfToken) this.request.getAttribute(CsrfToken.class.getName());
assertThat(csrfTokenAttribute.getToken()).isNotEqualTo(this.token.getToken());
assertThat(csrfTokenAttribute.getToken()).isEqualTo(csrfTokenAttribute.getToken());
}
@Test
public void resolveCsrfTokenValueWhenRequestIsNullThenThrowsIllegalArgumentException() {
assertThatIllegalArgumentException().isThrownBy(() -> this.handler.resolveCsrfTokenValue(null, this.token))

11
web/src/test/java/org/springframework/security/web/server/csrf/XorServerCsrfTokenRequestAttributeHandlerTests.java
View File

@@ -110,6 +110,17 @@ public class XorServerCsrfTokenRequestAttributeHandlerTests {
verify(this.secureRandom).nextBytes(anyByteArray());
}
@Test
public void handleWhenCsrfTokenRequestedTwiceThenCached() {
this.handler.handle(this.exchange, Mono.just(this.token));
Mono<CsrfToken> csrfTokenAttribute = this.exchange.getAttribute(CsrfToken.class.getName());
assertThat(csrfTokenAttribute).isNotNull();
CsrfToken csrfToken1 = csrfTokenAttribute.block();
CsrfToken csrfToken2 = csrfTokenAttribute.block();
assertThat(csrfToken1.getToken()).isNotEqualTo(this.token.getToken());
assertThat(csrfToken1.getToken()).isEqualTo(csrfToken2.getToken());
}
@Test
public void resolveCsrfTokenValueWhenExchangeIsNullThenThrowsIllegalArgumentException() {
assertThatIllegalArgumentException().isThrownBy(() -> this.handler.resolveCsrfTokenValue(null, this.token))