Cwikius-Spring
/
spring-security
mirror of https://github.com/spring-projects/spring-security.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

WebSessionServerCsrfTokenRepository session fixation protection 

Issue: gh-4842
This commit is contained in:
Rob Winch 2017-11-16 11:22:33 -06:00
parent 75a7c5268a
commit b19e14330f
2 changed files with 9 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
web/src/main/java/org/springframework/security/web/server/csrf/WebSessionServerCsrfTokenRepository.java
View File

@ -61,6 +61,7 @@ public class WebSessionServerCsrfTokenRepository
} }
return exchange.getSession() return exchange.getSession()
.doOnSuccess(session -> putToken(session.getAttributes(), token)) .doOnSuccess(session -> putToken(session.getAttributes(), token))
.flatMap(session -> session.changeSessionId())
.flatMap(r -> Mono.justOrEmpty(token)); .flatMap(r -> Mono.justOrEmpty(token));
} }

8
web/src/test/java/org/springframework/security/web/server/csrf/WebSessionServerCsrfTokenRepositoryTests.java
View File

@ -102,4 +102,12 @@ public class WebSessionServerCsrfTokenRepositoryTests {
load = this.repository.loadToken(this.exchange).block(); load = this.repository.loadToken(this.exchange).block();
assertThat(load).isNull(); assertThat(load).isNull();
} }
@Test
public void saveTokenChangeSessionId() {
String originalSessionId = this.exchange.getSession().block().getId();
this.repository.saveToken(this.exchange, null).block();
WebSession session = this.exchange.getSession().block();
assertThat(session.getId()).isNotEqualTo(originalSessionId);
}
} }