Browse Source

Fix CsrfWebFilter error message when expected CSRF not found

Closes gh-9337
pull/9355/head
Rob Winch 5 years ago
parent
commit
61b75bb2d6
  1. 2
      web/src/main/java/org/springframework/security/web/server/csrf/CsrfWebFilter.java
  2. 4
      web/src/test/java/org/springframework/security/web/server/csrf/CsrfWebFilterTests.java

2
web/src/main/java/org/springframework/security/web/server/csrf/CsrfWebFilter.java

@ -130,7 +130,7 @@ public class CsrfWebFilter implements WebFilter { @@ -130,7 +130,7 @@ public class CsrfWebFilter implements WebFilter {
private Mono<Void> validateToken(ServerWebExchange exchange) {
return this.csrfTokenRepository.loadToken(exchange)
.switchIfEmpty(Mono
.defer(() -> Mono.error(new CsrfException("CSRF Token has been associated to this client"))))
.defer(() -> Mono.error(new CsrfException("An expected CSRF token cannot be found"))))
.filterWhen((expected) -> containsValidCsrfToken(exchange, expected))
.switchIfEmpty(Mono.defer(() -> Mono.error(new CsrfException("Invalid CSRF Token")))).then();
}

4
web/src/test/java/org/springframework/security/web/server/csrf/CsrfWebFilterTests.java

@ -64,7 +64,7 @@ public class CsrfWebFilterTests { @@ -64,7 +64,7 @@ public class CsrfWebFilterTests {
private MockServerWebExchange get = MockServerWebExchange.from(MockServerHttpRequest.get("/"));
private ServerWebExchange post = MockServerWebExchange.from(MockServerHttpRequest.post("/"));
private MockServerWebExchange post = MockServerWebExchange.from(MockServerHttpRequest.post("/"));
@Test
public void filterWhenGetThenSessionNotCreatedAndChainContinues() {
@ -91,6 +91,8 @@ public class CsrfWebFilterTests { @@ -91,6 +91,8 @@ public class CsrfWebFilterTests {
Mono<Void> result = this.csrfFilter.filter(this.post, this.chain);
StepVerifier.create(result).verifyComplete();
assertThat(this.post.getResponse().getStatusCode()).isEqualTo(HttpStatus.FORBIDDEN);
StepVerifier.create(this.post.getResponse().getBodyAsString())
.assertNext(b -> assertThat(b).contains("An expected CSRF token cannot be found"));
}
@Test

Loading…
Cancel
Save