Spring/spring-security
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Check for existing token before clearing

Browse Source 
Closes gh-12236
This commit is contained in:
Steve Riesenberg
2022-11-17 17:00:21 -06:00
parent 1919b4e38b
commit 2ed7cff643
3 changed files with 22 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
web/src/main/java/org/springframework/security/web/csrf/CsrfAuthenticationStrategy.java
View File

@@ -33,6 +33,7 @@ import org.springframework.util.Assert;
* the next request.
*
* @author Rob Winch
* @author Steve Riesenberg
* @since 3.2
*/
public final class CsrfAuthenticationStrategy implements SessionAuthenticationStrategy {
@@ -65,10 +66,13 @@ public final class CsrfAuthenticationStrategy implements SessionAuthenticationSt
@Override
public void onAuthentication(Authentication authentication, HttpServletRequest request,
HttpServletResponse response) throws SessionAuthenticationException {
this.tokenRepository.saveToken(null, request, response);
DeferredCsrfToken deferredCsrfToken = this.tokenRepository.loadDeferredToken(request, response);
this.requestHandler.handle(request, response, deferredCsrfToken::get);
this.logger.debug("Replaced CSRF Token");
boolean containsToken = this.tokenRepository.loadToken(request) != null;
if (containsToken) {
this.tokenRepository.saveToken(null, request, response);
DeferredCsrfToken deferredCsrfToken = this.tokenRepository.loadDeferredToken(request, response);
this.requestHandler.handle(request, response, deferredCsrfToken::get);
this.logger.debug("Replaced CSRF Token");
}
}
}