Spring/spring-security
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Make Csrf cookie secure flag configurable (WebFlux)

Browse Source 
Make the XSRF-TOKEN cookie secure flag configurable in CookieServerCsrfTokenRepository.

Closes gh-9678
This commit is contained in:
Thomas Vitale
2021-04-26 18:13:20 +02:00
committed by Eleftheria Stein-Kousathana
parent 006b9b9607
commit e2993d93e1
2 changed files with 113 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files

30
web/src/main/java/org/springframework/security/web/server/csrf/CookieServerCsrfTokenRepository.java
View File

@@ -1,5 +1,5 @@
/*
* Copyright 2002-2019 the original author or authors.
* Copyright 2002-2021 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -34,6 +34,7 @@ import org.springframework.web.server.ServerWebExchange;
* AngularJS. When using with AngularJS be sure to use {@link #withHttpOnlyFalse()} .
*
* @author Eric Deandrea
* @author Thomas Vitale
* @since 5.1
*/
public final class CookieServerCsrfTokenRepository implements ServerCsrfTokenRepository {
@@ -54,6 +55,8 @@ public final class CookieServerCsrfTokenRepository implements ServerCsrfTokenRep
private boolean cookieHttpOnly = true;
private Boolean secure;
/**
* Factory method to conveniently create an instance that has
* {@link #setCookieHttpOnly(boolean)} set to false.
@@ -75,11 +78,16 @@ public final class CookieServerCsrfTokenRepository implements ServerCsrfTokenRep
public Mono<Void> saveToken(ServerWebExchange exchange, CsrfToken token) {
return Mono.fromRunnable(() -> {
String tokenValue = (token != null) ? token.getToken() : "";
int maxAge = !tokenValue.isEmpty() ? -1 : 0;
String path = (this.cookiePath != null) ? this.cookiePath : getRequestContext(exchange.getRequest());
boolean secure = exchange.getRequest().getSslInfo() != null;
ResponseCookie cookie = ResponseCookie.from(this.cookieName, tokenValue).domain(this.cookieDomain)
.httpOnly(this.cookieHttpOnly).maxAge(maxAge).path(path).secure(secure).build();
// @formatter:off
ResponseCookie cookie = ResponseCookie
.from(this.cookieName, tokenValue)
.domain(this.cookieDomain)
.httpOnly(this.cookieHttpOnly)
.maxAge(!tokenValue.isEmpty() ? -1 : 0)
.path((this.cookiePath != null) ? this.cookiePath : getRequestContext(exchange.getRequest()))
.secure((this.secure != null) ? this.secure : (exchange.getRequest().getSslInfo() != null))
.build();
// @formatter:on
exchange.getResponse().addCookie(cookie);
});
}
@@ -146,6 +154,16 @@ public final class CookieServerCsrfTokenRepository implements ServerCsrfTokenRep
this.cookieDomain = cookieDomain;
}
/**
* Sets the cookie secure flag. If not set, the value depends on
* {@link ServerHttpRequest#getSslInfo()}.
* @param secure The value for the secure flag
* @since 5.5
*/
public void setSecure(boolean secure) {
this.secure = secure;
}
private CsrfToken createCsrfToken() {
return createCsrfToken(createNewToken());
}