Skip to content

Commit e2993d9

Browse files
ThomasVitaleeleftherias
ThomasVitale
authored and
eleftherias
committed
Make Csrf cookie secure flag configurable (WebFlux)
Make the XSRF-TOKEN cookie secure flag configurable in CookieServerCsrfTokenRepository. Closes gh-9678
1 parent 006b9b9 commit e2993d9

File tree

2 files changed

+113
-17
lines changed

2 files changed

+113
-17
lines changed

‎web/src/main/java/org/springframework/security/web/server/csrf/CookieServerCsrfTokenRepository.java

Lines changed: 24 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2019 the original author or authors.
2+
* Copyright 2002-2021 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -34,6 +34,7 @@
3434
* AngularJS. When using with AngularJS be sure to use {@link #withHttpOnlyFalse()} .
3535
*
3636
* @author Eric Deandrea
37+
* @author Thomas Vitale
3738
* @since 5.1
3839
*/
3940
public final class CookieServerCsrfTokenRepository implements ServerCsrfTokenRepository {
@@ -54,6 +55,8 @@ public final class CookieServerCsrfTokenRepository implements ServerCsrfTokenRep
5455

5556
private boolean cookieHttpOnly = true;
5657

58+
private Boolean secure;
59+
5760
/**
5861
* Factory method to conveniently create an instance that has
5962
* {@link #setCookieHttpOnly(boolean)} set to false.
@@ -75,11 +78,16 @@ public Mono<CsrfToken> generateToken(ServerWebExchange exchange) {
7578
public Mono<Void> saveToken(ServerWebExchange exchange, CsrfToken token) {
7679
return Mono.fromRunnable(() -> {
7780
String tokenValue = (token != null) ? token.getToken() : "";
78-
int maxAge = !tokenValue.isEmpty() ? -1 : 0;
79-
String path = (this.cookiePath != null) ? this.cookiePath : getRequestContext(exchange.getRequest());
80-
boolean secure = exchange.getRequest().getSslInfo() != null;
81-
ResponseCookie cookie = ResponseCookie.from(this.cookieName, tokenValue).domain(this.cookieDomain)
82-
.httpOnly(this.cookieHttpOnly).maxAge(maxAge).path(path).secure(secure).build();
81+
// @formatter:off
82+
ResponseCookie cookie = ResponseCookie
83+
.from(this.cookieName, tokenValue)
84+
.domain(this.cookieDomain)
85+
.httpOnly(this.cookieHttpOnly)
86+
.maxAge(!tokenValue.isEmpty() ? -1 : 0)
87+
.path((this.cookiePath != null) ? this.cookiePath : getRequestContext(exchange.getRequest()))
88+
.secure((this.secure != null) ? this.secure : (exchange.getRequest().getSslInfo() != null))
89+
.build();
90+
// @formatter:on
8391
exchange.getResponse().addCookie(cookie);
8492
});
8593
}
@@ -146,6 +154,16 @@ public void setCookieDomain(String cookieDomain) {
146154
this.cookieDomain = cookieDomain;
147155
}
148156

157+
/**
158+
* Sets the cookie secure flag. If not set, the value depends on
159+
* {@link ServerHttpRequest#getSslInfo()}.
160+
* @param secure The value for the secure flag
161+
* @since 5.5
162+
*/
163+
public void setSecure(boolean secure) {
164+
this.secure = secure;
165+
}
166+
149167
private CsrfToken createCsrfToken() {
150168
return createCsrfToken(createNewToken());
151169
}

‎web/src/test/java/org/springframework/security/web/server/csrf/CookieServerCsrfTokenRepositoryTests.java

Lines changed: 89 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2018 the original author or authors.
2+
* Copyright 2002-2021 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -16,12 +16,15 @@
1616

1717
package org.springframework.security.web.server.csrf;
1818

19+
import java.security.cert.X509Certificate;
1920
import java.time.Duration;
2021

22+
import org.junit.Before;
2123
import org.junit.Test;
2224

2325
import org.springframework.http.HttpCookie;
2426
import org.springframework.http.ResponseCookie;
27+
import org.springframework.http.server.reactive.SslInfo;
2528
import org.springframework.mock.http.server.reactive.MockServerHttpRequest;
2629
import org.springframework.mock.web.server.MockServerWebExchange;
2730
import org.springframework.util.StringUtils;
@@ -30,13 +33,14 @@
3033

3134
/**
3235
* @author Eric Deandrea
36+
* @author Thomas Vitale
3337
* @since 5.1
3438
*/
3539
public class CookieServerCsrfTokenRepositoryTests {
3640

37-
private MockServerWebExchange exchange = MockServerWebExchange.from(MockServerHttpRequest.get("/someUri"));
41+
private CookieServerCsrfTokenRepository csrfTokenRepository;
3842

39-
private CookieServerCsrfTokenRepository csrfTokenRepository = new CookieServerCsrfTokenRepository();
43+
private MockServerHttpRequest.BaseBuilder<?> request;
4044

4145
private String expectedHeaderName = CookieServerCsrfTokenRepository.DEFAULT_CSRF_HEADER_NAME;
4246

@@ -56,6 +60,12 @@ public class CookieServerCsrfTokenRepositoryTests {
5660

5761
private String expectedCookieValue = "csrfToken";
5862

63+
@Before
64+
public void setUp() {
65+
this.csrfTokenRepository = new CookieServerCsrfTokenRepository();
66+
this.request = MockServerHttpRequest.get("/someUri");
67+
}
68+
5969
@Test
6070
public void generateTokenWhenDefaultThenDefaults() {
6171
generateTokenAndAssertExpectedValues();
@@ -82,8 +92,9 @@ public void generateTokenWhenCustomHeaderAndParameterThenCustomHeaderAndParamete
8292

8393
@Test
8494
public void saveTokenWhenNoSubscriptionThenNotWritten() {
85-
this.csrfTokenRepository.saveToken(this.exchange, createToken());
86-
assertThat(this.exchange.getResponse().getCookies().getFirst(this.expectedCookieName)).isNull();
95+
MockServerWebExchange exchange = MockServerWebExchange.from(this.request);
96+
this.csrfTokenRepository.saveToken(exchange, createToken());
97+
assertThat(exchange.getResponse().getCookies().getFirst(this.expectedCookieName)).isNull();
8798
}
8899

89100
@Test
@@ -112,6 +123,56 @@ public void saveTokenWhenCustomPropertiesThenCustomProperties() {
112123
saveAndAssertExpectedValues(createToken());
113124
}
114125

126+
@Test
127+
public void saveTokenWhenSslInfoPresentThenSecure() {
128+
this.request.sslInfo(new MockSslInfo());
129+
MockServerWebExchange exchange = MockServerWebExchange.from(this.request);
130+
this.csrfTokenRepository.saveToken(exchange, createToken()).block();
131+
ResponseCookie cookie = exchange.getResponse().getCookies().getFirst(this.expectedCookieName);
132+
assertThat(cookie).isNotNull();
133+
assertThat(cookie.isSecure()).isTrue();
134+
}
135+
136+
@Test
137+
public void saveTokenWhenSslInfoNullThenNotSecure() {
138+
MockServerWebExchange exchange = MockServerWebExchange.from(this.request);
139+
this.csrfTokenRepository.saveToken(exchange, createToken()).block();
140+
ResponseCookie cookie = exchange.getResponse().getCookies().getFirst(this.expectedCookieName);
141+
assertThat(cookie).isNotNull();
142+
assertThat(cookie.isSecure()).isFalse();
143+
}
144+
145+
@Test
146+
public void saveTokenWhenSecureFlagTrueThenSecure() {
147+
MockServerWebExchange exchange = MockServerWebExchange.from(this.request);
148+
this.csrfTokenRepository.setSecure(true);
149+
this.csrfTokenRepository.saveToken(exchange, createToken()).block();
150+
ResponseCookie cookie = exchange.getResponse().getCookies().getFirst(this.expectedCookieName);
151+
assertThat(cookie).isNotNull();
152+
assertThat(cookie.isSecure()).isTrue();
153+
}
154+
155+
@Test
156+
public void saveTokenWhenSecureFlagFalseThenNotSecure() {
157+
MockServerWebExchange exchange = MockServerWebExchange.from(this.request);
158+
this.csrfTokenRepository.setSecure(false);
159+
this.csrfTokenRepository.saveToken(exchange, createToken()).block();
160+
ResponseCookie cookie = exchange.getResponse().getCookies().getFirst(this.expectedCookieName);
161+
assertThat(cookie).isNotNull();
162+
assertThat(cookie.isSecure()).isFalse();
163+
}
164+
165+
@Test
166+
public void saveTokenWhenSecureFlagFalseAndSslInfoThenNotSecure() {
167+
MockServerWebExchange exchange = MockServerWebExchange.from(this.request);
168+
this.request.sslInfo(new MockSslInfo());
169+
this.csrfTokenRepository.setSecure(false);
170+
this.csrfTokenRepository.saveToken(exchange, createToken()).block();
171+
ResponseCookie cookie = exchange.getResponse().getCookies().getFirst(this.expectedCookieName);
172+
assertThat(cookie).isNotNull();
173+
assertThat(cookie.isSecure()).isFalse();
174+
}
175+
115176
@Test
116177
public void loadTokenWhenCookieExistThenTokenFound() {
117178
loadAndAssertExpectedValues();
@@ -127,7 +188,8 @@ public void loadTokenWhenCustomThenTokenFound() {
127188

128189
@Test
129190
public void loadTokenWhenNoCookiesThenNullToken() {
130-
CsrfToken csrfToken = this.csrfTokenRepository.loadToken(this.exchange).block();
191+
MockServerWebExchange exchange = MockServerWebExchange.from(this.request);
192+
CsrfToken csrfToken = this.csrfTokenRepository.loadToken(exchange).block();
131193
assertThat(csrfToken).isNull();
132194
}
133195

@@ -180,8 +242,8 @@ private void setExpectedCookieValue(String expectedCookieValue) {
180242
private void loadAndAssertExpectedValues() {
181243
MockServerHttpRequest.BodyBuilder request = MockServerHttpRequest.post("/someUri")
182244
.cookie(new HttpCookie(this.expectedCookieName, this.expectedCookieValue));
183-
this.exchange = MockServerWebExchange.from(request);
184-
CsrfToken csrfToken = this.csrfTokenRepository.loadToken(this.exchange).block();
245+
MockServerWebExchange exchange = MockServerWebExchange.from(request);
246+
CsrfToken csrfToken = this.csrfTokenRepository.loadToken(exchange).block();
185247
if (StringUtils.hasText(this.expectedCookieValue)) {
186248
assertThat(csrfToken).isNotNull();
187249
assertThat(csrfToken.getHeaderName()).isEqualTo(this.expectedHeaderName);
@@ -198,8 +260,9 @@ private void saveAndAssertExpectedValues(CsrfToken token) {
198260
this.expectedMaxAge = Duration.ofSeconds(0);
199261
this.expectedCookieValue = "";
200262
}
201-
this.csrfTokenRepository.saveToken(this.exchange, token).block();
202-
ResponseCookie cookie = this.exchange.getResponse().getCookies().getFirst(this.expectedCookieName);
263+
MockServerWebExchange exchange = MockServerWebExchange.from(this.request);
264+
this.csrfTokenRepository.saveToken(exchange, token).block();
265+
ResponseCookie cookie = exchange.getResponse().getCookies().getFirst(this.expectedCookieName);
203266
assertThat(cookie).isNotNull();
204267
assertThat(cookie.getMaxAge()).isEqualTo(this.expectedMaxAge);
205268
assertThat(cookie.getDomain()).isEqualTo(this.expectedDomain);
@@ -211,7 +274,8 @@ private void saveAndAssertExpectedValues(CsrfToken token) {
211274
}
212275

213276
private void generateTokenAndAssertExpectedValues() {
214-
CsrfToken csrfToken = this.csrfTokenRepository.generateToken(this.exchange).block();
277+
MockServerWebExchange exchange = MockServerWebExchange.from(this.request);
278+
CsrfToken csrfToken = this.csrfTokenRepository.generateToken(exchange).block();
215279
assertThat(csrfToken).isNotNull();
216280
assertThat(csrfToken.getHeaderName()).isEqualTo(this.expectedHeaderName);
217281
assertThat(csrfToken.getParameterName()).isEqualTo(this.expectedParameterName);
@@ -226,4 +290,18 @@ private static CsrfToken createToken(String headerName, String parameterName, St
226290
return new DefaultCsrfToken(headerName, parameterName, tokenValue);
227291
}
228292

293+
static class MockSslInfo implements SslInfo {
294+
295+
@Override
296+
public String getSessionId() {
297+
return "sessionId";
298+
}
299+
300+
@Override
301+
public X509Certificate[] getPeerCertificates() {
302+
return new X509Certificate[] {};
303+
}
304+
305+
}
306+
229307
}

0 commit comments

Comments
 (0)