AuthorizationWebFilter handles null Authentication

If the AuthorizationManager used the Authentication and the Authentication
was null the AuthorizationWebFilter would produce a NullPointerException

This commit fixes the test to ensure that Authentication is subscribed to
and ensures that the Authentication is not null

Fixes: gh-4966
This commit is contained in:
Rob Winch
2018-01-22 15:16:32 -06:00
parent e6cac604f3
commit 6a0833165a
2 changed files with 2 additions and 1 deletions

View File

@@ -40,6 +40,7 @@ public class AuthorizationWebFilter implements WebFilter {
@Override
public Mono<Void> filter(ServerWebExchange exchange, WebFilterChain chain) {
return ReactiveSecurityContextHolder.getContext()
.filter(c -> c.getAuthentication() != null)
.map(SecurityContext::getAuthentication)
.as(authentication -> this.accessDecisionManager.verify(authentication, exchange))
.switchIfEmpty(chain.filter(exchange));