Cwikius-Spring
/
spring-security
mirror of https://github.com/spring-projects/spring-security.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Cache Mono that generate the CSRF token 

Closes gh-9113
This commit is contained in:
Tomoki Tsubaki 2021-05-15 11:31:38 +09:00 committed by Josh Cummings
parent 52b8202268
commit 0c8b6df82a
No known key found for this signature in database
GPG Key ID: 49EF60DD7FF83443
2 changed files with 24 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
web/src/main/java/org/springframework/security/web/server/csrf/CsrfWebFilter.java
View File

@ -191,7 +191,7 @@ public class CsrfWebFilter implements WebFilter {
private Mono<CsrfToken> generateToken(ServerWebExchange exchange) { private Mono<CsrfToken> generateToken(ServerWebExchange exchange) {
return this.csrfTokenRepository.generateToken(exchange) return this.csrfTokenRepository.generateToken(exchange)
.delayUntil((token) -> this.csrfTokenRepository.saveToken(exchange, token)); .delayUntil((token) -> this.csrfTokenRepository.saveToken(exchange, token)).cache();
} }
private static class DefaultRequireCsrfProtectionMatcher implements ServerWebExchangeMatcher { private static class DefaultRequireCsrfProtectionMatcher implements ServerWebExchangeMatcher {

23
web/src/test/java/org/springframework/security/web/server/csrf/CsrfWebFilterTests.java
View File

@ -16,6 +16,9 @@
package org.springframework.security.web.server.csrf; package org.springframework.security.web.server.csrf;
import java.util.concurrent.atomic.AtomicInteger;
import java.util.concurrent.atomic.AtomicReference;
import org.junit.Test; import org.junit.Test;
import org.junit.runner.RunWith; import org.junit.runner.RunWith;
import org.mockito.Mock; import org.mockito.Mock;
@ -227,6 +230,26 @@ public class CsrfWebFilterTests {
.isForbidden(); .isForbidden();
} }
// gh-9113
@Test
public void filterWhenSubscribingCsrfTokenMultipleTimesThenGenerateOnlyOnce() {
this.csrfFilter.setCsrfTokenRepository(this.repository);
given(this.repository.loadToken(any())).willReturn(Mono.empty());
AtomicInteger count = new AtomicInteger();
given(this.repository.generateToken(any())).willReturn(Mono.fromCallable(() -> {
count.incrementAndGet();
return this.token;
}));
given(this.repository.saveToken(any(), any())).willReturn(Mono.empty());
AtomicReference<Mono<CsrfToken>> tokenFromExchange = new AtomicReference<>();
given(this.chain.filter(any())).willReturn(
Mono.fromRunnable(() -> tokenFromExchange.set(this.get.getAttribute(CsrfToken.class.getName()))));
this.csrfFilter.filter(this.get, this.chain).block();
tokenFromExchange.get().block();
tokenFromExchange.get().block();
assertThat(count).hasValue(1);
}
@RestController @RestController
static class OkController { static class OkController {