Spring/spring-security
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Fix CSRF / DefaultLoginPageGeneratingFilter package tangle

Browse Source 
Issue: gh-4636
This commit is contained in:
Rob Winch
2017-10-13 15:11:08 -05:00
parent 7fd1cff3ce
commit a74f7c6faa
3 changed files with 46 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
config/src/main/java/org/springframework/security/config/annotation/web/configurers/DefaultLoginPageConfigurer.java
View File

@@ -19,6 +19,9 @@ import org.springframework.security.config.annotation.web.HttpSecurityBuilder;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.web.AuthenticationEntryPoint;
import org.springframework.security.web.authentication.ui.DefaultLoginPageGeneratingFilter;
import org.springframework.security.web.csrf.CsrfToken;
import java.util.Collections;
/**
* Adds a Filter that will generate a login page if one is not specified otherwise when
@@ -65,6 +68,13 @@ public final class DefaultLoginPageConfigurer<H extends HttpSecurityBuilder<H>>
@Override
public void init(H http) throws Exception {
this.loginPageGeneratingFilter.setResolveHiddenInputs( request -> {
CsrfToken token = (CsrfToken) request.getAttribute(CsrfToken.class.getName());
if(token == null) {
return Collections.emptyMap();
}
return Collections.singletonMap(token.getParameterName(), token.getToken());
});
http.setSharedObject(DefaultLoginPageGeneratingFilter.class,
loginPageGeneratingFilter);
}

16
config/src/main/java/org/springframework/security/config/http/AuthenticationConfigBuilder.java
View File

@@ -50,13 +50,16 @@ import org.springframework.security.web.authentication.preauth.x509.X509Authenti
import org.springframework.security.web.authentication.ui.DefaultLoginPageGeneratingFilter;
import org.springframework.security.web.authentication.www.BasicAuthenticationEntryPoint;
import org.springframework.security.web.authentication.www.BasicAuthenticationFilter;
import org.springframework.security.web.csrf.CsrfToken;
import org.springframework.util.Assert;
import org.springframework.util.StringUtils;
import org.springframework.util.xml.DomUtils;
import org.w3c.dom.Element;
import javax.servlet.http.HttpServletRequest;
import java.security.SecureRandom;
import java.util.*;
import java.util.function.Function;
/**
* Handles creation of authentication mechanism filters and related beans for &lt;http&gt;
@@ -539,6 +542,7 @@ final class AuthenticationConfigBuilder {
+ "' attribute to set the URL of the login page.");
BeanDefinitionBuilder loginPageFilter = BeanDefinitionBuilder
.rootBeanDefinition(DefaultLoginPageGeneratingFilter.class);
loginPageFilter.addPropertyValue("resolveHiddenInputs", new CsrfTokenHiddenInputFunction());
if (formFilterId != null) {
loginPageFilter.addConstructorArgReference(formFilterId);
@@ -831,4 +835,16 @@ final class AuthenticationConfigBuilder {
return providers;
}
private static class CsrfTokenHiddenInputFunction implements
Function<HttpServletRequest,Map<String,String>> {
@Override
public Map<String, String> apply(HttpServletRequest request) {
CsrfToken token = (CsrfToken) request.getAttribute(CsrfToken.class.getName());
if(token == null) {
return Collections.emptyMap();
}
return Collections.singletonMap(token.getParameterName(), token.getToken());
}
}
}