Browse Source

Update Principal check in TransportHandlingSockJsService

Closes gh-35753
pull/35768/head
rstoyanchev 1 month ago
parent
commit
cd67010518
  1. 13
      spring-websocket/src/main/java/org/springframework/web/socket/sockjs/transport/TransportHandlingSockJsService.java

13
spring-websocket/src/main/java/org/springframework/web/socket/sockjs/transport/TransportHandlingSockJsService.java

@ -303,10 +303,15 @@ public class TransportHandlingSockJsService extends AbstractSockJsService implem @@ -303,10 +303,15 @@ public class TransportHandlingSockJsService extends AbstractSockJsService implem
}
else {
Principal principal = session.getPrincipal();
if (principal != null && !principal.equals(request.getPrincipal())) {
logger.debug("The user for the session does not match the user for the request.");
response.setStatusCode(HttpStatus.NOT_FOUND);
return;
if (principal != null) {
// Compare usernames, not full equality (different login timestamps)
Principal currentPrincipal = request.getPrincipal();
if (!principal.equals(currentPrincipal) &&
(currentPrincipal == null || !principal.getName().equals(currentPrincipal.getName()))) {
logger.debug("The user for the session does not match the user for the request.");
response.setStatusCode(HttpStatus.NOT_FOUND);
return;
}
}
if (!transportHandler.checkSessionType(session)) {
logger.debug("Session type does not match the transport type for the request.");

Loading…
Cancel
Save