Spring/spring-security
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Add reactive interfaces for CSRF request handling

Browse Source 
Issue gh-11959
This commit is contained in:
Steve Riesenberg
2022-09-01 15:11:04 -05:00
parent f3321c256c
commit f4ca90e719
10 changed files with 477 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files

51
web/src/main/java/org/springframework/security/web/server/csrf/CsrfWebFilter.java
View File

@@ -1,5 +1,5 @@
/*
* Copyright 2002-2021 the original author or authors.
* Copyright 2002-2022 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -23,12 +23,8 @@ import java.util.Set;
import reactor.core.publisher.Mono;
import org.springframework.http.HttpHeaders;
import org.springframework.http.HttpMethod;
import org.springframework.http.HttpStatus;
import org.springframework.http.MediaType;
import org.springframework.http.codec.multipart.FormFieldPart;
import org.springframework.http.server.reactive.ServerHttpRequest;
import org.springframework.security.crypto.codec.Utf8;
import org.springframework.security.web.server.authorization.HttpStatusServerAccessDeniedHandler;
import org.springframework.security.web.server.authorization.ServerAccessDeniedHandler;
@@ -63,6 +59,7 @@ import org.springframework.web.server.WebFilterChain;
*
* @author Rob Winch
* @author Parikshit Dutta
* @author Steve Riesenberg
* @since 5.0
*/
public class CsrfWebFilter implements WebFilter {
@@ -86,7 +83,7 @@ public class CsrfWebFilter implements WebFilter {
private ServerAccessDeniedHandler accessDeniedHandler = new HttpStatusServerAccessDeniedHandler(
HttpStatus.FORBIDDEN);
private boolean isTokenFromMultipartDataEnabled;
private ServerCsrfTokenRequestHandler requestHandler = new ServerCsrfTokenRequestAttributeHandler();
public void setAccessDeniedHandler(ServerAccessDeniedHandler accessDeniedHandler) {
Assert.notNull(accessDeniedHandler, "accessDeniedHandler");
@@ -103,14 +100,34 @@ public class CsrfWebFilter implements WebFilter {
this.requireCsrfProtectionMatcher = requireCsrfProtectionMatcher;
}
/**
* Specifies a {@link ServerCsrfTokenRequestHandler} that is used to make the
* {@code CsrfToken} available as an exchange attribute.
* <p>
* The default is {@link ServerCsrfTokenRequestAttributeHandler}.
* @param requestHandler the {@link ServerCsrfTokenRequestHandler} to use
* @since 5.8
*/
public void setRequestHandler(ServerCsrfTokenRequestHandler requestHandler) {
Assert.notNull(requestHandler, "requestHandler cannot be null");
this.requestHandler = requestHandler;
}
/**
* Specifies if the {@code CsrfWebFilter} should try to resolve the actual CSRF token
* from the body of multipart data requests.
* @param tokenFromMultipartDataEnabled true if should read from multipart form body,
* else false. Default is false
* @deprecated Use
* {@link ServerCsrfTokenRequestAttributeHandler#setTokenFromMultipartDataEnabled(boolean)}
* instead
*/
@Deprecated
public void setTokenFromMultipartDataEnabled(boolean tokenFromMultipartDataEnabled) {
this.isTokenFromMultipartDataEnabled = tokenFromMultipartDataEnabled;
if (this.requestHandler instanceof ServerCsrfTokenRequestAttributeHandler) {
((ServerCsrfTokenRequestAttributeHandler) this.requestHandler)
.setTokenFromMultipartDataEnabled(tokenFromMultipartDataEnabled);
}
}
@Override
@@ -138,30 +155,14 @@ public class CsrfWebFilter implements WebFilter {
}
private Mono<Boolean> containsValidCsrfToken(ServerWebExchange exchange, CsrfToken expected) {
return exchange.getFormData().flatMap((data) -> Mono.justOrEmpty(data.getFirst(expected.getParameterName())))
.switchIfEmpty(Mono.justOrEmpty(exchange.getRequest().getHeaders().getFirst(expected.getHeaderName())))
.switchIfEmpty(tokenFromMultipartData(exchange, expected))
return this.requestHandler.resolveCsrfTokenValue(exchange, expected)
.map((actual) -> equalsConstantTime(actual, expected.getToken()));
}
private Mono<String> tokenFromMultipartData(ServerWebExchange exchange, CsrfToken expected) {
if (!this.isTokenFromMultipartDataEnabled) {
return Mono.empty();
}
ServerHttpRequest request = exchange.getRequest();
HttpHeaders headers = request.getHeaders();
MediaType contentType = headers.getContentType();
if (!MediaType.MULTIPART_FORM_DATA.isCompatibleWith(contentType)) {
return Mono.empty();
}
return exchange.getMultipartData().map((d) -> d.getFirst(expected.getParameterName())).cast(FormFieldPart.class)
.map(FormFieldPart::value);
}
private Mono<Void> continueFilterChain(ServerWebExchange exchange, WebFilterChain chain) {
return Mono.defer(() -> {
Mono<CsrfToken> csrfToken = csrfToken(exchange);
exchange.getAttributes().put(CsrfToken.class.getName(), csrfToken);
this.requestHandler.handle(exchange, csrfToken);
return chain.filter(exchange);
});
}

77
web/src/main/java/org/springframework/security/web/server/csrf/ServerCsrfTokenRequestAttributeHandler.java Normal file
View File

@@ -0,0 +1,77 @@
/*
* Copyright 2002-2022 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* https://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.springframework.security.web.server.csrf;
import reactor.core.publisher.Mono;
import org.springframework.http.HttpHeaders;
import org.springframework.http.MediaType;
import org.springframework.http.codec.multipart.FormFieldPart;
import org.springframework.http.server.reactive.ServerHttpRequest;
import org.springframework.util.Assert;
import org.springframework.web.server.ServerWebExchange;
/**
* An implementation of the {@link ServerCsrfTokenRequestHandler} interface that is
* capable of making the {@link CsrfToken} available as an exchange attribute and
* resolving the token value as either a form data value or header of the request.
*
* @author Steve Riesenberg
* @since 5.8
*/
public class ServerCsrfTokenRequestAttributeHandler implements ServerCsrfTokenRequestHandler {
private boolean isTokenFromMultipartDataEnabled;
@Override
public void handle(ServerWebExchange exchange, Mono<CsrfToken> csrfToken) {
Assert.notNull(exchange, "exchange cannot be null");
Assert.notNull(csrfToken, "csrfToken cannot be null");
exchange.getAttributes().put(CsrfToken.class.getName(), csrfToken);
}
@Override
public Mono<String> resolveCsrfTokenValue(ServerWebExchange exchange, CsrfToken csrfToken) {
return ServerCsrfTokenRequestHandler.super.resolveCsrfTokenValue(exchange, csrfToken)
.switchIfEmpty(tokenFromMultipartData(exchange, csrfToken));
}
/**
* Specifies if the {@code ServerCsrfTokenRequestResolver} should try to resolve the
* actual CSRF token from the body of multipart data requests.
* @param tokenFromMultipartDataEnabled true if should read from multipart form body,
* else false. Default is false
*/
public void setTokenFromMultipartDataEnabled(boolean tokenFromMultipartDataEnabled) {
this.isTokenFromMultipartDataEnabled = tokenFromMultipartDataEnabled;
}
private Mono<String> tokenFromMultipartData(ServerWebExchange exchange, CsrfToken expected) {
if (!this.isTokenFromMultipartDataEnabled) {
return Mono.empty();
}
ServerHttpRequest request = exchange.getRequest();
HttpHeaders headers = request.getHeaders();
MediaType contentType = headers.getContentType();
if (!MediaType.MULTIPART_FORM_DATA.isCompatibleWith(contentType)) {
return Mono.empty();
}
return exchange.getMultipartData().map((d) -> d.getFirst(expected.getParameterName())).cast(FormFieldPart.class)
.map(FormFieldPart::value);
}
}

54
web/src/main/java/org/springframework/security/web/server/csrf/ServerCsrfTokenRequestHandler.java Normal file
View File

@@ -0,0 +1,54 @@
/*
* Copyright 2002-2022 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* https://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.springframework.security.web.server.csrf;
import reactor.core.publisher.Mono;
import org.springframework.util.Assert;
import org.springframework.web.server.ServerWebExchange;
/**
* A callback interface that is used to make the {@link CsrfToken} created by the
* {@link ServerCsrfTokenRepository} available as an exchange attribute. Implementations
* of this interface may choose to perform additional tasks or customize how the token is
* made available to the application through exchange attributes.
*
* @author Steve Riesenberg
* @since 5.8
* @see ServerCsrfTokenRequestAttributeHandler
*/
@FunctionalInterface
public interface ServerCsrfTokenRequestHandler extends ServerCsrfTokenRequestResolver {
/**
* Handles a request using a {@link CsrfToken}.
* @param exchange the {@code ServerWebExchange} with the request being handled
* @param csrfToken the {@code Mono<CsrfToken>} created by the
* {@link ServerCsrfTokenRepository}
*/
void handle(ServerWebExchange exchange, Mono<CsrfToken> csrfToken);
@Override
default Mono<String> resolveCsrfTokenValue(ServerWebExchange exchange, CsrfToken csrfToken) {
Assert.notNull(exchange, "exchange cannot be null");
Assert.notNull(csrfToken, "csrfToken cannot be null");
return exchange.getFormData().flatMap((data) -> Mono.justOrEmpty(data.getFirst(csrfToken.getParameterName())))
.switchIfEmpty(
Mono.justOrEmpty(exchange.getRequest().getHeaders().getFirst(csrfToken.getHeaderName())));
}
}

45
web/src/main/java/org/springframework/security/web/server/csrf/ServerCsrfTokenRequestResolver.java Normal file
View File

@@ -0,0 +1,45 @@
/*
* Copyright 2002-2022 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* https://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.springframework.security.web.server.csrf;
import reactor.core.publisher.Mono;
import org.springframework.web.server.ServerWebExchange;
/**
* Implementations of this interface are capable of resolving the token value of a
* {@link CsrfToken} from the provided {@code ServerWebExchange}. Used by the
* {@link CsrfWebFilter}.
*
* @author Steve Riesenberg
* @since 5.8
* @see ServerCsrfTokenRequestAttributeHandler
*/
@FunctionalInterface
public interface ServerCsrfTokenRequestResolver {
/**
* Returns the token value resolved from the provided {@code ServerWebExchange} and
* {@link CsrfToken} or {@code Mono.empty()} if not available.
* @param exchange the {@code ServerWebExchange} with the request being processed
* @param csrfToken the {@link CsrfToken} created by the
* {@link ServerCsrfTokenRepository}
* @return the token value resolved from the request
*/
Mono<String> resolveCsrfTokenValue(ServerWebExchange exchange, CsrfToken csrfToken);
}