Spring/spring-security
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Add Set-Cookie header value for XSRF-TOKEN

Browse Source 
This commit fixes an issue where using HttpServletResponse#setHeader
causes previous header values to be overwritten.

Closes gh-13075
This commit is contained in:
Steve Riesenberg
2023-04-25 15:15:02 -05:00
parent a44e91d044
commit 07b884a2cb
2 changed files with 15 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
web/src/main/java/org/springframework/security/web/csrf/CookieCsrfTokenRepository.java
View File

@@ -1,5 +1,5 @@
/*
* Copyright 2012-2022 the original author or authors.
* Copyright 2012-2023 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -97,7 +97,7 @@ public final class CookieCsrfTokenRepository implements CsrfTokenRepository {
this.cookieCustomizer.accept(cookieBuilder);
response.setHeader(HttpHeaders.SET_COOKIE, cookieBuilder.build().toString());
response.addHeader(HttpHeaders.SET_COOKIE, cookieBuilder.build().toString());
// Set request attribute to signal that response has blank cookie value,
// which allows loadToken to return null when token has been removed