Cwikius-Spring/spring-security
1
0
Fork 0
mirror of https://github.com/spring-projects/spring-security.git synced 2025-06-24 04:52:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

SEC-2439: HttpSessionCsrfTokenRepository setHeaderName sets header instead of parameter

Browse Source
This commit is contained in:
Rob Winch 2013-12-13 15:36:30 -06:00
parent 4708287ad3
commit ca1080fb96
2 changed files with 18 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
web/src/main/java/org/springframework/security/web/csrf/HttpSessionCsrfTokenRepository.java
View File

@ -91,14 +91,15 @@ public final class HttpSessionCsrfTokenRepository implements CsrfTokenRepository
* Sets the header name that the {@link CsrfToken} is expected to appear on * Sets the header name that the {@link CsrfToken} is expected to appear on
* and the header that the response will contain the {@link CsrfToken}. * and the header that the response will contain the {@link CsrfToken}.
* *
* @param parameterName * @param headerName
* the new parameter name to use * the new header name to use
*/ */
public void setHeaderName(String parameterName) { public void setHeaderName(String headerName) {
Assert.hasLength(parameterName, "parameterName cannot be null or empty"); Assert.hasLength(headerName, "headerName cannot be null or empty");
this.parameterName = parameterName; this.headerName = headerName;
} }
/** /**
* Sets the {@link HttpSession} attribute name that the {@link CsrfToken} is stored in * Sets the {@link HttpSession} attribute name that the {@link CsrfToken} is stored in
* @param sessionAttributeName the new attribute name to use * @param sessionAttributeName the new attribute name to use

13
web/src/test/java/org/springframework/security/web/csrf/HttpSessionCsrfTokenRepositoryTests.java
View File

@ -64,6 +64,17 @@ public class HttpSessionCsrfTokenRepositoryTests {
assertThat(token.getToken()).isNotEmpty(); assertThat(token.getToken()).isNotEmpty();
} }
@Test
public void generateCustomHeader() {
String headerName = "CSRF";
repo.setHeaderName(headerName);
token = repo.generateToken(request);
assertThat(token.getHeaderName()).isEqualTo(headerName);
assertThat(token.getToken()).isNotEmpty();
}
@Test @Test
public void loadTokenNull() { public void loadTokenNull() {
assertThat(repo.loadToken(request)).isNull(); assertThat(repo.loadToken(request)).isNull();
@ -116,7 +127,7 @@ public class HttpSessionCsrfTokenRepositoryTests {
public void saveTokenNullTokenWhenSessionNotExists() { public void saveTokenNullTokenWhenSessionNotExists() {
repo.saveToken(null, request, response); repo.saveToken(null, request, response);
assertThat(request.getSession(false)).isNull(); assertThat(request.getSession(false)).isNull();
} }