Spring/spring-security
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Default to XorCsrfChannelInterceptor in 6.0.x

Browse Source 
Closes gh-12378
This commit is contained in:
Steve Riesenberg
2023-01-26 00:03:57 -06:00
parent 1363a4eece
commit 13487be268
2 changed files with 7 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
config/src/test/java/org/springframework/security/config/annotation/web/socket/WebSocketMessageBrokerSecurityConfigurationTests.java
View File

@@ -66,7 +66,7 @@ import org.springframework.security.messaging.access.intercept.AuthorizationChan
import org.springframework.security.messaging.access.intercept.MessageAuthorizationContext;
import org.springframework.security.messaging.access.intercept.MessageMatcherDelegatingAuthorizationManager;
import org.springframework.security.messaging.context.SecurityContextChannelInterceptor;
import org.springframework.security.messaging.web.csrf.CsrfChannelInterceptor;
import org.springframework.security.messaging.web.csrf.XorCsrfChannelInterceptor;
import org.springframework.security.web.csrf.CsrfToken;
import org.springframework.security.web.csrf.DefaultCsrfToken;
import org.springframework.security.web.csrf.DeferredCsrfToken;
@@ -96,6 +96,8 @@ import static org.springframework.security.web.csrf.CsrfTokenAssert.assertThatCs
public class WebSocketMessageBrokerSecurityConfigurationTests {
private static final String XOR_CSRF_TOKEN_VALUE = "wpe7zB62-NCpcA==";
AnnotationConfigWebApplicationContext context;
Authentication messageUser;
@@ -198,7 +200,7 @@ public class WebSocketMessageBrokerSecurityConfigurationTests {
MessageChannel messageChannel = clientInboundChannel();
Stream<Class<? extends ChannelInterceptor>> interceptors = ((AbstractMessageChannel) messageChannel)
.getInterceptors().stream().map(ChannelInterceptor::getClass);
assertThat(interceptors).contains(CsrfChannelInterceptor.class);
assertThat(interceptors).contains(XorCsrfChannelInterceptor.class);
}
@Test
@@ -238,7 +240,7 @@ public class WebSocketMessageBrokerSecurityConfigurationTests {
public void messagesContextWebSocketUseSecurityContextHolderStrategy() {
loadConfig(WebSocketSecurityConfig.class, SecurityContextChangedListenerConfig.class);
SimpMessageHeaderAccessor headers = SimpMessageHeaderAccessor.create(SimpMessageType.CONNECT);
headers.setNativeHeader(this.token.getHeaderName(), this.token.getToken());
headers.setNativeHeader(this.token.getHeaderName(), XOR_CSRF_TOKEN_VALUE);
Message<?> message = message(headers, "/authenticated");
headers.getSessionAttributes().put(CsrfToken.class.getName(), this.token);
MessageChannel messageChannel = clientInboundChannel();