Spring/spring-security
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Default CsrfTokenRequestProcessor.csrfRequestAttributeName = _csrf

Browse Source 
Issue gh-11764
Issue gh-4001
This commit is contained in:
Steve Riesenberg
2022-09-06 12:15:08 -05:00
parent ed41a60aae
commit 088ebe2e00
7 changed files with 27 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
web/src/test/java/org/springframework/security/web/csrf/CsrfTokenRequestProcessorTests.java
View File

@@ -78,17 +78,17 @@ public class CsrfTokenRequestProcessorTests {
@Test
public void handleWhenCsrfRequestAttributeSetThenUsed() {
this.processor.setCsrfRequestAttributeName("_csrf");
this.processor.setCsrfRequestAttributeName("_csrf.attr");
this.processor.handle(this.request, this.response, () -> this.token);
assertThat(this.request.getAttribute(CsrfToken.class.getName())).isEqualTo(this.token);
assertThat(this.request.getAttribute("_csrf")).isEqualTo(this.token);
assertThat(this.request.getAttribute("_csrf.attr")).isEqualTo(this.token);
}
@Test
public void handleWhenValidParametersThenRequestAttributesSet() {
this.processor.handle(this.request, this.response, () -> this.token);
assertThat(this.request.getAttribute(CsrfToken.class.getName())).isEqualTo(this.token);
assertThat(this.request.getAttribute(this.token.getParameterName())).isEqualTo(this.token);
assertThat(this.request.getAttribute("_csrf")).isEqualTo(this.token);
}
@Test