Cwikius-Spring
/
spring-security
mirror of https://github.com/spring-projects/spring-security.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Fix CsrfWebFilter error message when expected CSRF not found 

Closes gh-9337
This commit is contained in:
Rob Winch 2021-01-12 11:30:12 -06:00
parent 0fc80a6a65
commit b08075a721
2 changed files with 4 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
web/src/main/java/org/springframework/security/web/server/csrf/CsrfWebFilter.java
View File

@ -133,7 +133,7 @@ public class CsrfWebFilter implements WebFilter {
private Mono<Void> validateToken(ServerWebExchange exchange) { private Mono<Void> validateToken(ServerWebExchange exchange) {
return this.csrfTokenRepository.loadToken(exchange) return this.csrfTokenRepository.loadToken(exchange)
.switchIfEmpty(Mono.defer(() -> Mono.error(new CsrfException("CSRF Token has been associated to this client")))) .switchIfEmpty(Mono.defer(() -> Mono.error(new CsrfException("An expected CSRF token cannot be found"))))
.filterWhen(expected -> containsValidCsrfToken(exchange, expected)) .filterWhen(expected -> containsValidCsrfToken(exchange, expected))
.switchIfEmpty(Mono.defer(() -> Mono.error(new CsrfException("Invalid CSRF Token")))) .switchIfEmpty(Mono.defer(() -> Mono.error(new CsrfException("Invalid CSRF Token"))))
.then(); .then();

5
web/src/test/java/org/springframework/security/web/server/csrf/CsrfWebFilterTests.java
View File

@ -65,8 +65,7 @@ public class CsrfWebFilterTests {
private MockServerWebExchange get = from( private MockServerWebExchange get = from(
MockServerHttpRequest.get("/")); MockServerHttpRequest.get("/"));
private ServerWebExchange post = from( private MockServerWebExchange post = MockServerWebExchange.from(MockServerHttpRequest.post("/"));
MockServerHttpRequest.post("/"));
@Test @Test
public void filterWhenGetThenSessionNotCreatedAndChainContinues() { public void filterWhenGetThenSessionNotCreatedAndChainContinues() {
@ -110,6 +109,8 @@ public class CsrfWebFilterTests {
.verifyComplete(); .verifyComplete();
assertThat(this.post.getResponse().getStatusCode()).isEqualTo(HttpStatus.FORBIDDEN); assertThat(this.post.getResponse().getStatusCode()).isEqualTo(HttpStatus.FORBIDDEN);
StepVerifier.create(this.post.getResponse().getBodyAsString())
.assertNext(b -> assertThat(b).contains("An expected CSRF token cannot be found"));
} }
@Test @Test