Skip to content

Commit

Permalink
fix: update attribute name for fetching spring csrf token (#10820)
Browse files Browse the repository at this point in the history 
* fix: update attribute name for fetching spring csrf token

* differentiate session and meta attribute for spring csrf
  • Loading branch information
@haijian-vaadin
haijian-vaadin committed Apr 27, 2021
1 parent fe1db18 commit 42cd423
Show file tree
Hide file tree
Showing 2 changed files with 10 additions and 13 deletions.
3 changes: 2 additions & 1 deletion flow-server/src/main/java/com/vaadin/flow/server/communication/IndexHtmlRequestHandler.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -63,6 +63,7 @@ public class IndexHtmlRequestHandler extends JavaScriptBootstrapHandler {

private static final String CONTENT_ATTRIBUTE = "content";
private static final String NAME_ATTRIBUTE = "name";
private static final String SPRING_CSRF_TOKEN_ATTRIBUTE_IN_SESSION = "org.springframework.security.web.csrf.CsrfToken";
private static final String SPRING_CSRF_HEADER_PROPERTY = "headerName";
private static final String SPRING_CSRF_PARAMETER_PROPERTY = "parameterName";
private static final String SPRING_CSRF_TOKEN_PROPERTY = "token";
Expand Down Expand Up @@ -189,7 +190,7 @@ private void addInitialFlow(JsonObject initialJson, Document indexDocument,
initialJson.put(CSRF_TOKEN, csrfToken);
}
Object springCsrfToken = request
.getAttribute(SPRING_CSRF_TOKEN_ATTRIBUTE);
.getAttribute(SPRING_CSRF_TOKEN_ATTRIBUTE_IN_SESSION);
if (springCsrfToken != null) {
JsonObject springCsrfTokenJson = JsonUtils
.beanToJson(springCsrfToken);
Expand Down
20 changes: 8 additions & 12 deletions ...erver/src/test/java/com/vaadin/flow/server/communication/IndexHtmlRequestHandlerTest.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,6 @@
import java.lang.reflect.Method;
import java.nio.charset.StandardCharsets;
import java.util.HashMap;
import java.util.List;
import java.util.Map;
import java.util.Optional;
import java.util.UUID;
Expand All @@ -34,8 +33,6 @@
import org.jsoup.Jsoup;
import org.jsoup.internal.StringUtil;
import org.jsoup.nodes.Document;
import org.jsoup.nodes.Element;
import org.jsoup.nodes.Node;
import org.jsoup.select.Elements;
import org.junit.After;
import org.junit.Assert;
Expand All @@ -55,7 +52,6 @@
import com.vaadin.flow.server.AppShellRegistry;
import com.vaadin.flow.server.BootstrapHandler;
import com.vaadin.flow.server.DevModeHandler;
import com.vaadin.flow.server.HandlerHelper;
import com.vaadin.flow.server.MockServletServiceSessionSetup;
import com.vaadin.flow.server.VaadinContext;
import com.vaadin.flow.server.VaadinRequest;
Expand All @@ -71,8 +67,6 @@

import elemental.json.Json;
import elemental.json.JsonObject;
import elemental.json.impl.JreJsonFactory;
import elemental.json.impl.JreJsonObject;

import static com.vaadin.flow.component.internal.JavaScriptBootstrapUI.SERVER_ROUTING;
import static com.vaadin.flow.server.DevModeHandlerTest.createStubWebpackTcpListener;
Expand All @@ -82,6 +76,8 @@
import static org.mockito.Mockito.verify;

public class IndexHtmlRequestHandlerTest {
private static final String SPRING_CSRF_ATTRIBUTE_IN_SESSION = "org.springframework.security.web.csrf.CsrfToken";
private static final String SPRING_CSRF_ATTRIBUTE = "_csrf";
private MockServletServiceSessionSetup mocks;
private MockServletServiceSessionSetup.TestVaadinServletService service;
private VaadinSession session;
Expand Down Expand Up @@ -415,12 +411,12 @@ public void should_include_spring_csrf_token_in_meta_tags_when_return_not_null_s
VaadinRequest request = Mockito.spy(createVaadinRequest("/"));
String springTokenString = UUID.randomUUID().toString();
String springTokenHeaderName = "x-CSRF-TOKEN";
String springTokenParamName = "_csrf";
String springTokenParamName = SPRING_CSRF_ATTRIBUTE_IN_SESSION;
Map<String, String> csrfJsonMap = new HashMap<>();
csrfJsonMap.put("token", springTokenString);
csrfJsonMap.put("headerName", springTokenHeaderName);
csrfJsonMap.put("parameterName", springTokenParamName);
Mockito.when(request.getAttribute("_csrf")).thenReturn(csrfJsonMap);
Mockito.when(request.getAttribute(SPRING_CSRF_ATTRIBUTE_IN_SESSION)).thenReturn(csrfJsonMap);
indexHtmlRequestHandler.synchronizedHandleRequest(session, request,
response);

Expand All @@ -429,7 +425,7 @@ public void should_include_spring_csrf_token_in_meta_tags_when_return_not_null_s
Document document = Jsoup.parse(indexHtml);

Elements csrfMetaEelement = document.head()
.getElementsByAttributeValue("name", "_csrf");
.getElementsByAttributeValue("name", SPRING_CSRF_ATTRIBUTE);
Assert.assertEquals(1, csrfMetaEelement.size());
Assert.assertEquals(springTokenString,
csrfMetaEelement.first().attr("content"));
Expand Down Expand Up @@ -476,7 +472,7 @@ public void should_not_include_spring_csrf_token_in_meta_tags_when_return_null_s
Document document = Jsoup.parse(indexHtml);

Assert.assertEquals(0,
document.head().getElementsByAttribute("_csrf").size());
document.head().getElementsByAttribute(SPRING_CSRF_ATTRIBUTE).size());
Assert.assertEquals(0,
document.head().getElementsByAttribute("_csrf_header").size());
}
Expand Down Expand Up @@ -506,7 +502,7 @@ public void should_not_include_spring_token_in_dom_when_referer_is_service_worke
csrfJsonMap.put("token", springTokenString);
csrfJsonMap.put("headerName", springTokenHeaderName);
Object springCsrfToken = JsonUtils.mapToJson(csrfJsonMap);
Mockito.when(request.getAttribute("_csrf")).thenReturn(springCsrfToken);
Mockito.when(request.getAttribute(SPRING_CSRF_ATTRIBUTE_IN_SESSION)).thenReturn(springCsrfToken);
VaadinServletRequest vaadinRequest = createVaadinRequest("/");
Mockito.when(((HttpServletRequest) vaadinRequest.getRequest())
.getHeader("referer"))
Expand All @@ -517,7 +513,7 @@ public void should_not_include_spring_token_in_dom_when_referer_is_service_worke
.toString(StandardCharsets.UTF_8.name());
Document document = Jsoup.parse(indexHtml);
Assert.assertEquals(0,
document.head().getElementsByAttribute("_csrf").size());
document.head().getElementsByAttribute(SPRING_CSRF_ATTRIBUTE).size());
Assert.assertEquals(0,
document.head().getElementsByAttribute("_csrf_header").size());
}
Expand Down

0 comments on commit 42cd423

Please sign in to comment.