From 5bce912446eec508bb2c2fca1fb139b34809c86e Mon Sep 17 00:00:00 2001 From: Tomoki Tsubaki Date: Wed, 16 Sep 2020 21:52:26 +0900 Subject: [PATCH] Create the CSRF token on the bounded elactic scheduler The CSRF token is generated by UUID.randomUUID() which is I/O blocking operation. This commit changes the subscriber thread to the bounded elactic scheduler. Closes gh-9018 --- .../web/server/csrf/CookieServerCsrfTokenRepository.java | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/web/src/main/java/org/springframework/security/web/server/csrf/CookieServerCsrfTokenRepository.java b/web/src/main/java/org/springframework/security/web/server/csrf/CookieServerCsrfTokenRepository.java index 9ccedc8666..1c8a8dd868 100644 --- a/web/src/main/java/org/springframework/security/web/server/csrf/CookieServerCsrfTokenRepository.java +++ b/web/src/main/java/org/springframework/security/web/server/csrf/CookieServerCsrfTokenRepository.java @@ -27,6 +27,7 @@ import org.springframework.util.StringUtils; import org.springframework.web.server.ServerWebExchange; import reactor.core.publisher.Mono; +import reactor.core.scheduler.Schedulers; /** * A {@link ServerCsrfTokenRepository} that persists the CSRF token in a cookie named "XSRF-TOKEN" and @@ -63,7 +64,7 @@ public final class CookieServerCsrfTokenRepository implements ServerCsrfTokenRep @Override public Mono generateToken(ServerWebExchange exchange) { - return Mono.fromCallable(this::createCsrfToken); + return Mono.fromCallable(this::createCsrfToken).subscribeOn(Schedulers.boundedElastic()); } @Override