From e44471331bbe1689cd65b6b2f3d2c91cb44aa3e3 Mon Sep 17 00:00:00 2001 From: Tomoki Tsubaki Date: Wed, 16 Sep 2020 21:52:26 +0900 Subject: [PATCH] Create the CSRF token on the bounded elactic scheduler The CSRF token is generated by UUID.randomUUID() which is I/O blocking operation. This commit changes the subscriber thread to the bounded elactic scheduler. Closes gh-9018 --- .../web/server/csrf/CookieServerCsrfTokenRepository.java | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/web/src/main/java/org/springframework/security/web/server/csrf/CookieServerCsrfTokenRepository.java b/web/src/main/java/org/springframework/security/web/server/csrf/CookieServerCsrfTokenRepository.java index f1ed61ee17..04328e228f 100644 --- a/web/src/main/java/org/springframework/security/web/server/csrf/CookieServerCsrfTokenRepository.java +++ b/web/src/main/java/org/springframework/security/web/server/csrf/CookieServerCsrfTokenRepository.java @@ -26,6 +26,7 @@ import org.springframework.util.StringUtils; import org.springframework.web.server.ServerWebExchange; import reactor.core.publisher.Mono; +import reactor.core.scheduler.Schedulers; /** * A {@link ServerCsrfTokenRepository} that persists the CSRF token in a cookie named "XSRF-TOKEN" and @@ -62,7 +63,7 @@ public final class CookieServerCsrfTokenRepository implements ServerCsrfTokenRep @Override public Mono generateToken(ServerWebExchange exchange) { - return Mono.fromCallable(this::createCsrfToken); + return Mono.fromCallable(this::createCsrfToken).subscribeOn(Schedulers.boundedElastic()); } @Override