Cwikius-Spring
/
spring-security
mirror of https://github.com/spring-projects/spring-security.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

SEC-1827: If use-secure-cookie is set to false explicitly set useSecureCookie to false on AbstractRememberMeServices

This commit is contained in:
Rob Winch 2011-11-21 09:11:17 -06:00
parent 53483df1f5
commit 999adbc6ee
2 changed files with 15 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
config/src/main/java/org/springframework/security/config/http/RememberMeBeanDefinitionParser.java
View File

@ -98,8 +98,9 @@ class RememberMeBeanDefinitionParser implements BeanDefinitionParser {
services.getPropertyValues().addPropertyValue("userDetailsService", uds);
if ("true".equals(element.getAttribute(ATT_SECURE_COOKIE))) {
services.getPropertyValues().addPropertyValue("useSecureCookie", true);
String useSecureCookie = element.getAttribute(ATT_SECURE_COOKIE);
if (StringUtils.hasText(useSecureCookie)) {
services.getPropertyValues().addPropertyValue("useSecureCookie", Boolean.valueOf(useSecureCookie));
}
if (tokenValiditySet) {

13
config/src/test/groovy/org/springframework/security/config/http/RememberMeConfigTests.groovy
View File

@ -31,7 +31,7 @@ class RememberMeConfigTests extends AbstractHttpConfigTests {
expect:
rememberMeServices() instanceof PersistentTokenBasedRememberMeServices
!FieldUtils.getFieldValue(rememberMeServices(), "useSecureCookie")
FieldUtils.getFieldValue(rememberMeServices(), "useSecureCookie") == null
}
def rememberMeServiceWorksWithDataSourceRef() {
@ -112,6 +112,17 @@ class RememberMeConfigTests extends AbstractHttpConfigTests {
FieldUtils.getFieldValue(rememberMeServices(), "useSecureCookie")
}
// SEC-1827
def rememberMeSecureCookieAttributeFalse() {
httpAutoConfig () {
'remember-me'('key': 'ourkey', 'use-secure-cookie':'false')
}
createAppContext(AUTH_PROVIDER_XML)
expect: 'useSecureCookie is false'
FieldUtils.getFieldValue(rememberMeServices(), "useSecureCookie") == Boolean.FALSE
}
def 'Negative token-validity is rejected with persistent implementation'() {
when:
httpAutoConfig () {