Skip to content

Commit a1083d9

Browse files
committed
Fix CsrfWebFilter error message when expected CSRF not found
Closes gh-9337
1 parent 160a4a3 commit a1083d9

File tree

2 files changed

+4
-2
lines changed

2 files changed

+4
-2
lines changed

web/src/main/java/org/springframework/security/web/server/csrf/CsrfWebFilter.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -132,7 +132,7 @@ public static void skipExchange(ServerWebExchange exchange) {
132132
private Mono<Void> validateToken(ServerWebExchange exchange) {
133133
return this.csrfTokenRepository.loadToken(exchange)
134134
.switchIfEmpty(Mono
135-
.defer(() -> Mono.error(new CsrfException("CSRF Token has been associated to this client"))))
135+
.defer(() -> Mono.error(new CsrfException("An expected CSRF token cannot be found"))))
136136
.filterWhen((expected) -> containsValidCsrfToken(exchange, expected))
137137
.switchIfEmpty(Mono.defer(() -> Mono.error(new CsrfException("Invalid CSRF Token")))).then();
138138
}

web/src/test/java/org/springframework/security/web/server/csrf/CsrfWebFilterTests.java

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -64,7 +64,7 @@ public class CsrfWebFilterTests {
6464

6565
private MockServerWebExchange get = MockServerWebExchange.from(MockServerHttpRequest.get("/"));
6666

67-
private ServerWebExchange post = MockServerWebExchange.from(MockServerHttpRequest.post("/"));
67+
private MockServerWebExchange post = MockServerWebExchange.from(MockServerHttpRequest.post("/"));
6868

6969
@Test
7070
public void filterWhenGetThenSessionNotCreatedAndChainContinues() {
@@ -91,6 +91,8 @@ public void filterWhenPostAndEstablishedCsrfTokenAndRequestMissingTokenThenCsrfE
9191
Mono<Void> result = this.csrfFilter.filter(this.post, this.chain);
9292
StepVerifier.create(result).verifyComplete();
9393
assertThat(this.post.getResponse().getStatusCode()).isEqualTo(HttpStatus.FORBIDDEN);
94+
StepVerifier.create(this.post.getResponse().getBodyAsString())
95+
.assertNext(b -> assertThat(b).contains("An expected CSRF token cannot be found"));
9496
}
9597

9698
@Test

0 commit comments

Comments
 (0)