Spring/spring-security
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

serverCsrfTokenRepository->csrfTokenRepository

Browse Source 
Issue: gh-4822
This commit is contained in:
Rob Winch
2017-11-14 15:19:53 -06:00
parent 3bfda6cff7
commit 2cbdb4ba02
3 changed files with 17 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
config/src/main/java/org/springframework/security/config/web/server/ServerHttpSecurity.java
View File

@@ -399,9 +399,9 @@ public class ServerHttpSecurity {
return this; return this;
} }
public CsrfSpec serverCsrfTokenRepository( public CsrfSpec csrfTokenRepository(
ServerCsrfTokenRepository serverCsrfTokenRepository) { ServerCsrfTokenRepository csrfTokenRepository) {
this.filter.setServerCsrfTokenRepository(serverCsrfTokenRepository); this.filter.setCsrfTokenRepository(csrfTokenRepository);
return this; return this;
} }

18
web/src/main/java/org/springframework/security/web/server/csrf/CsrfWebFilter.java
View File

@@ -55,7 +55,7 @@ public class CsrfWebFilter implements WebFilter {
private ServerWebExchangeMatcher requireCsrfProtectionMatcher = new DefaultRequireCsrfProtectionMatcher(); private ServerWebExchangeMatcher requireCsrfProtectionMatcher = new DefaultRequireCsrfProtectionMatcher();
private ServerCsrfTokenRepository serverCsrfTokenRepository = new WebSessionServerCsrfTokenRepository(); private ServerCsrfTokenRepository csrfTokenRepository = new WebSessionServerCsrfTokenRepository();
private ServerAccessDeniedHandler accessDeniedHandler = new HttpStatusServerAccessDeniedHandler(HttpStatus.FORBIDDEN); private ServerAccessDeniedHandler accessDeniedHandler = new HttpStatusServerAccessDeniedHandler(HttpStatus.FORBIDDEN);
@@ -65,10 +65,10 @@ public class CsrfWebFilter implements WebFilter {
this.accessDeniedHandler = accessDeniedHandler; this.accessDeniedHandler = accessDeniedHandler;
} }
public void setServerCsrfTokenRepository( public void setCsrfTokenRepository(
ServerCsrfTokenRepository serverCsrfTokenRepository) { ServerCsrfTokenRepository csrfTokenRepository) {
Assert.notNull(serverCsrfTokenRepository, "serverCsrfTokenRepository cannot be null"); Assert.notNull(csrfTokenRepository, "csrfTokenRepository cannot be null");
this.serverCsrfTokenRepository = serverCsrfTokenRepository; this.csrfTokenRepository = csrfTokenRepository;
} }
public void setRequireCsrfProtectionMatcher( public void setRequireCsrfProtectionMatcher(
@@ -90,7 +90,7 @@ public class CsrfWebFilter implements WebFilter {
} }
private Mono<Void> validateToken(ServerWebExchange exchange) { private Mono<Void> validateToken(ServerWebExchange exchange) {
return this.serverCsrfTokenRepository.loadToken(exchange) return this.csrfTokenRepository.loadToken(exchange)
.switchIfEmpty(Mono.error(new CsrfException("CSRF Token has been associated to this client"))) .switchIfEmpty(Mono.error(new CsrfException("CSRF Token has been associated to this client")))
.filterWhen(expected -> containsValidCsrfToken(exchange, expected)) .filterWhen(expected -> containsValidCsrfToken(exchange, expected))
.switchIfEmpty(Mono.error(new CsrfException("Invalid CSRF Token"))) .switchIfEmpty(Mono.error(new CsrfException("Invalid CSRF Token")))
@@ -113,13 +113,13 @@ public class CsrfWebFilter implements WebFilter {
} }
private Mono<CsrfToken> csrfToken(ServerWebExchange exchange) { private Mono<CsrfToken> csrfToken(ServerWebExchange exchange) {
return this.serverCsrfTokenRepository.loadToken(exchange) return this.csrfTokenRepository.loadToken(exchange)
.switchIfEmpty(generateToken(exchange)); .switchIfEmpty(generateToken(exchange));
} }
private Mono<CsrfToken> generateToken(ServerWebExchange exchange) { private Mono<CsrfToken> generateToken(ServerWebExchange exchange) {
return this.serverCsrfTokenRepository.generateToken(exchange) return this.csrfTokenRepository.generateToken(exchange)
.flatMap(token -> this.serverCsrfTokenRepository.saveToken(exchange, token)); .flatMap(token -> this.csrfTokenRepository.saveToken(exchange, token));
} }
private static class DefaultRequireCsrfProtectionMatcher implements ServerWebExchangeMatcher { private static class DefaultRequireCsrfProtectionMatcher implements ServerWebExchangeMatcher {

10
web/src/test/java/org/springframework/security/web/server/csrf/CsrfWebFilterTests.java
View File

@@ -86,7 +86,7 @@ public class CsrfWebFilterTests {
@Test @Test
public void filterWhenPostAndEstablishedCsrfTokenAndRequestMissingTokenThenCsrfException() { public void filterWhenPostAndEstablishedCsrfTokenAndRequestMissingTokenThenCsrfException() {
this.csrfFilter.setServerCsrfTokenRepository(this.repository); this.csrfFilter.setCsrfTokenRepository(this.repository);
when(this.repository.loadToken(any())) when(this.repository.loadToken(any()))
.thenReturn(Mono.just(this.token)); .thenReturn(Mono.just(this.token));
when(this.repository.generateToken(any())) when(this.repository.generateToken(any()))
@@ -103,7 +103,7 @@ public class CsrfWebFilterTests {
@Test @Test
public void filterWhenPostAndEstablishedCsrfTokenAndRequestParamInvalidTokenThenCsrfException() { public void filterWhenPostAndEstablishedCsrfTokenAndRequestParamInvalidTokenThenCsrfException() {
this.csrfFilter.setServerCsrfTokenRepository(this.repository); this.csrfFilter.setCsrfTokenRepository(this.repository);
when(this.repository.loadToken(any())) when(this.repository.loadToken(any()))
.thenReturn(Mono.just(this.token)); .thenReturn(Mono.just(this.token));
when(this.repository.generateToken(any())) when(this.repository.generateToken(any()))
@@ -124,7 +124,7 @@ public class CsrfWebFilterTests {
PublisherProbe<Void> chainResult = PublisherProbe.empty(); PublisherProbe<Void> chainResult = PublisherProbe.empty();
when(this.chain.filter(any())).thenReturn(chainResult.mono()); when(this.chain.filter(any())).thenReturn(chainResult.mono());
this.csrfFilter.setServerCsrfTokenRepository(this.repository); this.csrfFilter.setCsrfTokenRepository(this.repository);
when(this.repository.loadToken(any())) when(this.repository.loadToken(any()))
.thenReturn(Mono.just(this.token)); .thenReturn(Mono.just(this.token));
when(this.repository.generateToken(any())) when(this.repository.generateToken(any()))
@@ -143,7 +143,7 @@ public class CsrfWebFilterTests {
@Test @Test
public void filterWhenPostAndEstablishedCsrfTokenAndHeaderInvalidTokenThenCsrfException() { public void filterWhenPostAndEstablishedCsrfTokenAndHeaderInvalidTokenThenCsrfException() {
this.csrfFilter.setServerCsrfTokenRepository(this.repository); this.csrfFilter.setCsrfTokenRepository(this.repository);
when(this.repository.loadToken(any())) when(this.repository.loadToken(any()))
.thenReturn(Mono.just(this.token)); .thenReturn(Mono.just(this.token));
when(this.repository.generateToken(any())) when(this.repository.generateToken(any()))
@@ -164,7 +164,7 @@ public class CsrfWebFilterTests {
PublisherProbe<Void> chainResult = PublisherProbe.empty(); PublisherProbe<Void> chainResult = PublisherProbe.empty();
when(this.chain.filter(any())).thenReturn(chainResult.mono()); when(this.chain.filter(any())).thenReturn(chainResult.mono());
this.csrfFilter.setServerCsrfTokenRepository(this.repository); this.csrfFilter.setCsrfTokenRepository(this.repository);
when(this.repository.loadToken(any())) when(this.repository.loadToken(any()))
.thenReturn(Mono.just(this.token)); .thenReturn(Mono.just(this.token));
when(this.repository.generateToken(any())) when(this.repository.generateToken(any()))