From b7529be3d0dd8b9fa46b8168c7aa68a98040924b Mon Sep 17 00:00:00 2001 From: Rob Winch Date: Thu, 16 Nov 2017 13:08:54 -0600 Subject: [PATCH] WebSessionSecurityContextRepository changes session id Fixes: gh-4842 --- ...essionServerSecurityContextRepository.java | 2 +- ...nServerSecurityContextRepositoryTests.java | 67 +++++++++++++++++++ 2 files changed, 68 insertions(+), 1 deletion(-) create mode 100644 web/src/test/java/org/springframework/security/web/server/context/WebSessionServerSecurityContextRepositoryTests.java diff --git a/web/src/main/java/org/springframework/security/web/server/context/WebSessionServerSecurityContextRepository.java b/web/src/main/java/org/springframework/security/web/server/context/WebSessionServerSecurityContextRepository.java index 9104b2c0d3..fa94c076b9 100644 --- a/web/src/main/java/org/springframework/security/web/server/context/WebSessionServerSecurityContextRepository.java +++ b/web/src/main/java/org/springframework/security/web/server/context/WebSessionServerSecurityContextRepository.java @@ -38,7 +38,7 @@ public class WebSessionServerSecurityContextRepository session.getAttributes().put(SESSION_ATTR, context); } }) - .then(); + .flatMap(session -> session.changeSessionId()); } public Mono load(ServerWebExchange exchange) { diff --git a/web/src/test/java/org/springframework/security/web/server/context/WebSessionServerSecurityContextRepositoryTests.java b/web/src/test/java/org/springframework/security/web/server/context/WebSessionServerSecurityContextRepositoryTests.java new file mode 100644 index 0000000000..ac8f45b116 --- /dev/null +++ b/web/src/test/java/org/springframework/security/web/server/context/WebSessionServerSecurityContextRepositoryTests.java @@ -0,0 +1,67 @@ +/* + * Copyright 2002-2017 the original author or authors. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package org.springframework.security.web.server.context; + +import org.junit.Test; +import org.springframework.mock.http.server.reactive.MockServerHttpRequest; +import org.springframework.mock.web.server.MockServerWebExchange; +import org.springframework.security.core.context.SecurityContext; +import org.springframework.security.core.context.SecurityContextImpl; +import org.springframework.web.server.WebSession; + +import static org.assertj.core.api.Assertions.*; + +/** + * @author Rob Winch + * @since 5.0 + */ +public class WebSessionServerSecurityContextRepositoryTests { + + private MockServerWebExchange exchange = MockServerWebExchange.from( + MockServerHttpRequest.get("/")); + + private WebSessionServerSecurityContextRepository repository = new WebSessionServerSecurityContextRepository(); + + @Test + public void saveAndLoadWhenDefaultsThenFound() { + SecurityContext expected = new SecurityContextImpl(); + this.repository.save(this.exchange, new SecurityContextImpl()).block(); + + SecurityContext actual = this.repository.load(this.exchange).block(); + + assertThat(actual).isEqualTo(expected); + } + + @Test + public void saveAndLoadWhenNullThenDeletes() { + SecurityContext context = new SecurityContextImpl(); + this.repository.save(this.exchange, new SecurityContextImpl()).block(); + this.repository.save(this.exchange, null).block(); + + SecurityContext actual = this.repository.load(this.exchange).block(); + + assertThat(actual).isNull(); + } + + @Test + public void saveWhenNewContextThenChangeSessionId() { + String originalSessionId = this.exchange.getSession().block().getId(); + this.repository.save(this.exchange, new SecurityContextImpl()).block(); + WebSession session = this.exchange.getSession().block(); + assertThat(session.getId()).isNotEqualTo(originalSessionId); + } +}