Spring/spring-security
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Automatically add CsrfServerLogoutHandler if csrf enabled

Browse Source 
The configuration DSL should automatically add CsrfServerLogoutHandler if csrf is enabled

Fixes gh-5337
This commit is contained in:
Eric Deandrea
2018-05-24 14:16:04 -04:00
committed by Rob Winch
parent 725b3b5482
commit b060ec050a
5 changed files with 205 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
web/src/main/java/org/springframework/security/web/server/authentication/logout/DelegatingServerLogoutHandler.java
View File

@@ -18,16 +18,17 @@ package org.springframework.security.web.server.authentication.logout;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Collection;
import java.util.List;
import java.util.Objects;
import java.util.stream.Collectors;
import java.util.stream.Stream;
import reactor.core.publisher.Mono;
import org.springframework.security.core.Authentication;
import org.springframework.security.web.server.WebFilterExchange;
import org.springframework.util.Assert;
import reactor.core.publisher.Mono;
/**
* Delegates to a collection of {@link ServerLogoutHandler} implementations.
*
@@ -35,21 +36,24 @@ import reactor.core.publisher.Mono;
* @since 5.1
*/
public class DelegatingServerLogoutHandler implements ServerLogoutHandler {
private final List<ServerLogoutHandler> delegates;
private final List<ServerLogoutHandler> delegates = new ArrayList<>();
public DelegatingServerLogoutHandler(ServerLogoutHandler... delegates) {
Assert.notEmpty(delegates, "delegates cannot be null or empty");
this.delegates = Arrays.asList(delegates);
this.delegates.addAll(Arrays.asList(delegates));
}
public DelegatingServerLogoutHandler(List<ServerLogoutHandler> delegates) {
public DelegatingServerLogoutHandler(Collection<ServerLogoutHandler> delegates) {
Assert.notEmpty(delegates, "delegates cannot be null or empty");
this.delegates = new ArrayList<>(delegates);
this.delegates.addAll(delegates);
}
@Override
public Mono<Void> logout(WebFilterExchange exchange, Authentication authentication) {
Stream<Mono<Void>> results = this.delegates.stream().map(delegate -> delegate.logout(exchange, authentication));
return Mono.when(results.collect(Collectors.toList()));
return Mono.when(this.delegates.stream()
.filter(Objects::nonNull)
.map(delegate -> delegate.logout(exchange, authentication))
.collect(Collectors.toList())
);
}
}

10
web/src/main/java/org/springframework/security/web/server/authentication/logout/LogoutWebFilter.java
View File

@@ -16,17 +16,17 @@
package org.springframework.security.web.server.authentication.logout;
import org.springframework.http.HttpMethod;
import org.springframework.security.core.context.ReactiveSecurityContextHolder;
import org.springframework.util.Assert;
import reactor.core.publisher.Mono;
import org.springframework.http.HttpMethod;
import org.springframework.security.authentication.AnonymousAuthenticationToken;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.authority.AuthorityUtils;
import org.springframework.security.core.context.ReactiveSecurityContextHolder;
import org.springframework.security.web.server.WebFilterExchange;
import org.springframework.security.web.server.util.matcher.ServerWebExchangeMatcher;
import org.springframework.security.web.server.util.matcher.ServerWebExchangeMatchers;
import org.springframework.util.Assert;
import org.springframework.web.server.ServerWebExchange;
import org.springframework.web.server.WebFilter;
import org.springframework.web.server.WebFilterChain;
@@ -85,6 +85,10 @@ public class LogoutWebFilter implements WebFilter {
this.logoutSuccessHandler = logoutSuccessHandler;
}
/**
* Sets the {@link ServerLogoutHandler}. The default is {@link SecurityContextServerLogoutHandler}.
* @param logoutHandler The handler to use
*/
public void setLogoutHandler(ServerLogoutHandler logoutHandler) {
Assert.notNull(logoutHandler, "logoutHandler must not be null");
this.logoutHandler = logoutHandler;