Cwikius-Spring
/
spring-security
mirror of https://github.com/spring-projects/spring-security.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

AuthorizationWebFilter handles null Authentication 

If the AuthorizationManager used the Authentication and the Authentication
was null the AuthorizationWebFilter would produce a NullPointerException

This commit fixes the test to ensure that Authentication is subscribed to
and ensures that the Authentication is not null

Fixes: gh-4966
This commit is contained in:
Rob Winch 2018-01-22 15:16:32 -06:00
parent e6cac604f3
commit 6a0833165a
2 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
web/src/main/java/org/springframework/security/web/server/authorization/AuthorizationWebFilter.java
View File

@ -40,6 +40,7 @@ public class AuthorizationWebFilter implements WebFilter {
@Override
public Mono<Void> filter(ServerWebExchange exchange, WebFilterChain chain) {
return ReactiveSecurityContextHolder.getContext()
.filter(c -> c.getAuthentication() != null)
.map(SecurityContext::getAuthentication)
.as(authentication -> this.accessDecisionManager.verify(authentication, exchange))
.switchIfEmpty(chain.filter(exchange));

2
web/src/test/java/org/springframework/security/web/server/authorization/AuthorizationWebFilterTests.java
View File

@ -63,7 +63,7 @@ public class AuthorizationWebFilterTests {
@Test
public void filterWhenNoAuthenticationThenThrowsAccessDenied() {
when(this.chain.filter(this.exchange)).thenReturn(this.chainResult.mono());
AuthorizationWebFilter filter = new AuthorizationWebFilter((a, e) -> Mono.error(new AccessDeniedException("Denied")));
AuthorizationWebFilter filter = new AuthorizationWebFilter((a, e) -> a.flatMap(auth -> Mono.error(new AccessDeniedException("Denied"))));
Mono<Void> result = filter
.filter(this.exchange, this.chain)