Cwikius-Spring/spring-security
1
0
Fork 0
mirror of https://github.com/spring-projects/spring-security.git synced 2025-07-02 00:32:15 +00:00
Code Issues Packages Projects Releases Wiki Activity

SEC-1827: If use-secure-cookie is set to false explicitly set useSecureCookie to false on AbstractRememberMeServices

Browse Source
This commit is contained in:
Rob Winch 2011-11-21 09:11:17 -06:00
parent 53483df1f5
commit 999adbc6ee
2 changed files with 15 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
config/src/main/java/org/springframework/security/config/http/RememberMeBeanDefinitionParser.java
View File

@ -98,8 +98,9 @@ class RememberMeBeanDefinitionParser implements BeanDefinitionParser {
services.getPropertyValues().addPropertyValue("userDetailsService", uds); services.getPropertyValues().addPropertyValue("userDetailsService", uds);
if ("true".equals(element.getAttribute(ATT_SECURE_COOKIE))) { String useSecureCookie = element.getAttribute(ATT_SECURE_COOKIE);
services.getPropertyValues().addPropertyValue("useSecureCookie", true); if (StringUtils.hasText(useSecureCookie)) {
services.getPropertyValues().addPropertyValue("useSecureCookie", Boolean.valueOf(useSecureCookie));
} }
if (tokenValiditySet) { if (tokenValiditySet) {

13
config/src/test/groovy/org/springframework/security/config/http/RememberMeConfigTests.groovy
View File

@ -31,7 +31,7 @@ class RememberMeConfigTests extends AbstractHttpConfigTests {
expect: expect:
rememberMeServices() instanceof PersistentTokenBasedRememberMeServices rememberMeServices() instanceof PersistentTokenBasedRememberMeServices
!FieldUtils.getFieldValue(rememberMeServices(), "useSecureCookie") FieldUtils.getFieldValue(rememberMeServices(), "useSecureCookie") == null
} }
def rememberMeServiceWorksWithDataSourceRef() { def rememberMeServiceWorksWithDataSourceRef() {
@ -112,6 +112,17 @@ class RememberMeConfigTests extends AbstractHttpConfigTests {
FieldUtils.getFieldValue(rememberMeServices(), "useSecureCookie") FieldUtils.getFieldValue(rememberMeServices(), "useSecureCookie")
} }
// SEC-1827
def rememberMeSecureCookieAttributeFalse() {
httpAutoConfig () {
'remember-me'('key': 'ourkey', 'use-secure-cookie':'false')
}
createAppContext(AUTH_PROVIDER_XML)
expect: 'useSecureCookie is false'
FieldUtils.getFieldValue(rememberMeServices(), "useSecureCookie") == Boolean.FALSE
}
def 'Negative token-validity is rejected with persistent implementation'() { def 'Negative token-validity is rejected with persistent implementation'() {
when: when:
httpAutoConfig () { httpAutoConfig () {