Cwikius-Spring
/
spring-security
mirror of https://github.com/spring-projects/spring-security.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Fix CsrfWebFilter error message when expected CSRF not found 

Closes gh-9337
This commit is contained in:
Rob Winch 2021-01-12 11:18:29 -06:00
parent 160a4a3676
commit a1083d9a5c
2 changed files with 4 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
web/src/main/java/org/springframework/security/web/server/csrf/CsrfWebFilter.java
View File

@ -132,7 +132,7 @@ public class CsrfWebFilter implements WebFilter {
private Mono<Void> validateToken(ServerWebExchange exchange) {
return this.csrfTokenRepository.loadToken(exchange)
.switchIfEmpty(Mono
.defer(() -> Mono.error(new CsrfException("CSRF Token has been associated to this client"))))
.defer(() -> Mono.error(new CsrfException("An expected CSRF token cannot be found"))))
.filterWhen((expected) -> containsValidCsrfToken(exchange, expected))
.switchIfEmpty(Mono.defer(() -> Mono.error(new CsrfException("Invalid CSRF Token")))).then();
}

4
web/src/test/java/org/springframework/security/web/server/csrf/CsrfWebFilterTests.java
View File

@ -64,7 +64,7 @@ public class CsrfWebFilterTests {
private MockServerWebExchange get = MockServerWebExchange.from(MockServerHttpRequest.get("/"));
private ServerWebExchange post = MockServerWebExchange.from(MockServerHttpRequest.post("/"));
private MockServerWebExchange post = MockServerWebExchange.from(MockServerHttpRequest.post("/"));
@Test
public void filterWhenGetThenSessionNotCreatedAndChainContinues() {
@ -91,6 +91,8 @@ public class CsrfWebFilterTests {
Mono<Void> result = this.csrfFilter.filter(this.post, this.chain);
StepVerifier.create(result).verifyComplete();
assertThat(this.post.getResponse().getStatusCode()).isEqualTo(HttpStatus.FORBIDDEN);
StepVerifier.create(this.post.getResponse().getBodyAsString())
.assertNext(b -> assertThat(b).contains("An expected CSRF token cannot be found"));
}
@Test