diff --git a/web/src/main/java/org/springframework/security/web/server/ui/LogoutPageGeneratingWebFilter.java b/web/src/main/java/org/springframework/security/web/server/ui/LogoutPageGeneratingWebFilter.java index 983ddb015b..135b5f097f 100644 --- a/web/src/main/java/org/springframework/security/web/server/ui/LogoutPageGeneratingWebFilter.java +++ b/web/src/main/java/org/springframework/security/web/server/ui/LogoutPageGeneratingWebFilter.java @@ -1,5 +1,5 @@ /* - * Copyright 2002-2017 the original author or authors. + * Copyright 2002-2022 the original author or authors. * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -58,14 +58,15 @@ public class LogoutPageGeneratingWebFilter implements WebFilter { private Mono createBuffer(ServerWebExchange exchange) { Mono token = exchange.getAttributeOrDefault(CsrfToken.class.getName(), Mono.empty()); + String contextPath = exchange.getRequest().getPath().contextPath().value(); return token.map(LogoutPageGeneratingWebFilter::csrfToken).defaultIfEmpty("").map((csrfTokenHtmlInput) -> { - byte[] bytes = createPage(csrfTokenHtmlInput); + byte[] bytes = createPage(csrfTokenHtmlInput, contextPath); DataBufferFactory bufferFactory = exchange.getResponse().bufferFactory(); return bufferFactory.wrap(bytes); }); } - private static byte[] createPage(String csrfTokenHtmlInput) { + private static byte[] createPage(String csrfTokenHtmlInput, String contextPath) { StringBuilder page = new StringBuilder(); page.append("\n"); page.append("\n"); @@ -82,7 +83,7 @@ public class LogoutPageGeneratingWebFilter implements WebFilter { page.append(" \n"); page.append(" \n"); page.append("
\n"); - page.append("
\n"); + page.append(" \n"); page.append(" \n"); page.append(csrfTokenHtmlInput); page.append(" \n"); diff --git a/web/src/test/java/org/springframework/security/web/server/ui/LogoutPageGeneratingWebFilterTests.java b/web/src/test/java/org/springframework/security/web/server/ui/LogoutPageGeneratingWebFilterTests.java new file mode 100644 index 0000000000..431d18a5a6 --- /dev/null +++ b/web/src/test/java/org/springframework/security/web/server/ui/LogoutPageGeneratingWebFilterTests.java @@ -0,0 +1,46 @@ +/* + * Copyright 2002-2022 the original author or authors. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * https://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package org.springframework.security.web.server.ui; + +import org.junit.jupiter.api.Test; +import reactor.core.publisher.Mono; + +import org.springframework.mock.http.server.reactive.MockServerHttpRequest; +import org.springframework.mock.web.server.MockServerWebExchange; + +import static org.assertj.core.api.Assertions.assertThat; + +public class LogoutPageGeneratingWebFilterTests { + + @Test + public void filterWhenLogoutWithContextPathThenActionContainsContextPath() throws Exception { + LogoutPageGeneratingWebFilter filter = new LogoutPageGeneratingWebFilter(); + MockServerWebExchange exchange = MockServerWebExchange + .from(MockServerHttpRequest.get("/test/logout").contextPath("/test")); + filter.filter(exchange, (e) -> Mono.empty()).block(); + assertThat(exchange.getResponse().getBodyAsString().block()).contains("action=\"/test/logout\""); + } + + @Test + public void filterWhenLogoutWithNoContextPathThenActionDoesNotContainsContextPath() throws Exception { + LogoutPageGeneratingWebFilter filter = new LogoutPageGeneratingWebFilter(); + MockServerWebExchange exchange = MockServerWebExchange.from(MockServerHttpRequest.get("/logout")); + filter.filter(exchange, (e) -> Mono.empty()).block(); + assertThat(exchange.getResponse().getBodyAsString().block()).contains("action=\"/logout\""); + } + +}