Skip to content

Commit 475b3bb

Browse files
author
Steve Riesenberg
committed
Add deferred CsrfTokenRepository.loadDeferredToken
* Move DeferredCsrfToken to top-level and implement Supplier<CsrfToken> * Move RepositoryDeferredCsrfToken to top-level and make package-private * Add CsrfTokenRepository.loadToken(HttpServletRequest, HttpServletResponse) * Update CsrfFilter * Rename CsrfTokenRepositoryRequestHandler to CsrfTokenRequestAttributeHandler Issue gh-11892 Closes gh-11918
1 parent 0e215a2 commit 475b3bb

File tree

31 files changed

+533
-350
lines changed

31 files changed

+533
-350
lines changed

‎config/src/main/java/org/springframework/security/config/annotation/web/configurers/CsrfConfigurer.java‎

Lines changed: 4 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,6 @@
3636
import org.springframework.security.web.csrf.CsrfFilter;
3737
import org.springframework.security.web.csrf.CsrfLogoutHandler;
3838
import org.springframework.security.web.csrf.CsrfTokenRepository;
39-
import org.springframework.security.web.csrf.CsrfTokenRepositoryRequestHandler;
4039
import org.springframework.security.web.csrf.CsrfTokenRequestHandler;
4140
import org.springframework.security.web.csrf.HttpSessionCsrfTokenRepository;
4241
import org.springframework.security.web.csrf.LazyCsrfTokenRepository;
@@ -249,13 +248,7 @@ public CsrfConfigurer<H> sessionAuthenticationStrategy(
249248
@SuppressWarnings("unchecked")
250249
@Override
251250
public void configure(H http) {
252-
CsrfFilter filter;
253-
if (this.requestHandler != null) {
254-
filter = new CsrfFilter(this.requestHandler);
255-
}
256-
else {
257-
filter = new CsrfFilter(new CsrfTokenRepositoryRequestHandler(this.csrfTokenRepository));
258-
}
251+
CsrfFilter filter = new CsrfFilter(this.csrfTokenRepository);
259252
RequestMatcher requireCsrfProtectionMatcher = getRequireCsrfProtectionMatcher();
260253
if (requireCsrfProtectionMatcher != null) {
261254
filter.setRequireCsrfProtectionMatcher(requireCsrfProtectionMatcher);
@@ -272,6 +265,9 @@ public void configure(H http) {
272265
if (sessionConfigurer != null) {
273266
sessionConfigurer.addSessionAuthenticationStrategy(getSessionAuthenticationStrategy());
274267
}
268+
if (this.requestHandler != null) {
269+
filter.setRequestHandler(this.requestHandler);
270+
}
275271
filter = postProcess(filter);
276272
http.addFilter(filter);
277273
}

‎config/src/main/java/org/springframework/security/config/http/CsrfBeanDefinitionParser.java‎

Lines changed: 5 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2020 the original author or authors.
2+
* Copyright 2002-2022 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -41,7 +41,6 @@
4141
import org.springframework.security.web.csrf.CsrfAuthenticationStrategy;
4242
import org.springframework.security.web.csrf.CsrfFilter;
4343
import org.springframework.security.web.csrf.CsrfLogoutHandler;
44-
import org.springframework.security.web.csrf.CsrfTokenRepositoryRequestHandler;
4544
import org.springframework.security.web.csrf.HttpSessionCsrfTokenRepository;
4645
import org.springframework.security.web.csrf.LazyCsrfTokenRepository;
4746
import org.springframework.security.web.csrf.MissingCsrfTokenException;
@@ -112,18 +111,13 @@ public BeanDefinition parse(Element element, ParserContext pc) {
112111
new BeanComponentDefinition(lazyTokenRepository.getBeanDefinition(), this.csrfRepositoryRef));
113112
}
114113
BeanDefinitionBuilder builder = BeanDefinitionBuilder.rootBeanDefinition(CsrfFilter.class);
115-
if (!StringUtils.hasText(this.requestHandlerRef)) {
116-
BeanDefinition csrfTokenRequestHandler = BeanDefinitionBuilder
117-
.rootBeanDefinition(CsrfTokenRepositoryRequestHandler.class)
118-
.addConstructorArgReference(this.csrfRepositoryRef).getBeanDefinition();
119-
builder.addConstructorArgValue(csrfTokenRequestHandler);
120-
}
121-
else {
122-
builder.addConstructorArgReference(this.requestHandlerRef);
123-
}
114+
builder.addConstructorArgReference(this.csrfRepositoryRef);
124115
if (StringUtils.hasText(this.requestMatcherRef)) {
125116
builder.addPropertyReference("requireCsrfProtectionMatcher", this.requestMatcherRef);
126117
}
118+
if (StringUtils.hasText(this.requestHandlerRef)) {
119+
builder.addPropertyReference("requestHandler", this.requestHandlerRef);
120+
}
127121
this.csrfFilter = builder.getBeanDefinition();
128122
return this.csrfFilter;
129123
}

‎config/src/main/resources/org/springframework/security/config/spring-security-5.8.rnc‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1152,7 +1152,7 @@ csrf-options.attlist &=
11521152
## The CsrfTokenRepository to use. The default is HttpSessionCsrfTokenRepository wrapped by LazyCsrfTokenRepository.
11531153
attribute token-repository-ref { xsd:token }?
11541154
csrf-options.attlist &=
1155-
## The CsrfTokenRequestHandler to use. The default is CsrfTokenRepositoryRequestHandler.
1155+
## The CsrfTokenRequestHandler to use. The default is CsrfTokenRequestAttributeHandler.
11561156
attribute request-handler-ref { xsd:token }?
11571157

11581158
headers =

‎config/src/main/resources/org/springframework/security/config/spring-security-5.8.xsd‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3258,7 +3258,7 @@
32583258
</xs:attribute>
32593259
<xs:attribute name="request-handler-ref" type="xs:token">
32603260
<xs:annotation>
3261-
<xs:documentation>The CsrfTokenRequestHandler to use. The default is CsrfTokenRepositoryRequestHandler.
3261+
<xs:documentation>The CsrfTokenRequestHandler to use. The default is CsrfTokenRequestAttributeHandler.
32623262
</xs:documentation>
32633263
</xs:annotation>
32643264
</xs:attribute>

‎config/src/test/java/org/springframework/security/config/annotation/web/configuration/DeferHttpSessionJavaConfigTests.java‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@
3333
import org.springframework.security.config.test.SpringTestContextExtension;
3434
import org.springframework.security.web.DefaultSecurityFilterChain;
3535
import org.springframework.security.web.FilterChainProxy;
36-
import org.springframework.security.web.csrf.CsrfTokenRepositoryRequestHandler;
36+
import org.springframework.security.web.csrf.CsrfTokenRequestAttributeHandler;
3737
import org.springframework.security.web.csrf.HttpSessionCsrfTokenRepository;
3838
import org.springframework.security.web.csrf.LazyCsrfTokenRepository;
3939
import org.springframework.security.web.savedrequest.HttpSessionRequestCache;
@@ -85,7 +85,7 @@ DefaultSecurityFilterChain springSecurity(HttpSecurity http) throws Exception {
8585
csrfRepository.setDeferLoadToken(true);
8686
HttpSessionRequestCache requestCache = new HttpSessionRequestCache();
8787
requestCache.setMatchingRequestParameterName("continue");
88-
CsrfTokenRepositoryRequestHandler requestHandler = new CsrfTokenRepositoryRequestHandler();
88+
CsrfTokenRequestAttributeHandler requestHandler = new CsrfTokenRequestAttributeHandler();
8989
requestHandler.setCsrfRequestAttributeName("_csrf");
9090
// @formatter:off
9191
http

‎config/src/test/java/org/springframework/security/config/annotation/web/configurers/CsrfConfigurerTests.java‎

Lines changed: 64 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -44,8 +44,10 @@
4444
import org.springframework.security.web.authentication.session.SessionAuthenticationStrategy;
4545
import org.springframework.security.web.csrf.CsrfToken;
4646
import org.springframework.security.web.csrf.CsrfTokenRepository;
47-
import org.springframework.security.web.csrf.CsrfTokenRepositoryRequestHandler;
47+
import org.springframework.security.web.csrf.CsrfTokenRequestAttributeHandler;
48+
import org.springframework.security.web.csrf.CsrfTokenRequestHandler;
4849
import org.springframework.security.web.csrf.DefaultCsrfToken;
50+
import org.springframework.security.web.csrf.DeferredCsrfToken;
4951
import org.springframework.security.web.firewall.StrictHttpFirewall;
5052
import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
5153
import org.springframework.security.web.util.matcher.RequestMatcher;
@@ -61,7 +63,6 @@
6163
import static org.assertj.core.api.Assertions.assertThatExceptionOfType;
6264
import static org.hamcrest.Matchers.containsString;
6365
import static org.mockito.ArgumentMatchers.any;
64-
import static org.mockito.ArgumentMatchers.eq;
6566
import static org.mockito.ArgumentMatchers.isNull;
6667
import static org.mockito.BDDMockito.given;
6768
import static org.mockito.Mockito.atLeastOnce;
@@ -207,30 +208,30 @@ public void loginWhenCsrfDisabledThenRedirectsToPreviousPostRequest() throws Exc
207208
public void loginWhenCsrfEnabledThenDoesNotRedirectToPreviousPostRequest() throws Exception {
208209
CsrfDisablesPostRequestFromRequestCacheConfig.REPO = mock(CsrfTokenRepository.class);
209210
DefaultCsrfToken csrfToken = new DefaultCsrfToken("X-CSRF-TOKEN", "_csrf", "token");
210-
given(CsrfDisablesPostRequestFromRequestCacheConfig.REPO.loadToken(any())).willReturn(csrfToken);
211-
given(CsrfDisablesPostRequestFromRequestCacheConfig.REPO.generateToken(any())).willReturn(csrfToken);
211+
given(CsrfDisablesPostRequestFromRequestCacheConfig.REPO.loadDeferredToken(any(HttpServletRequest.class),
212+
any(HttpServletResponse.class))).willReturn(new TestDeferredCsrfToken(csrfToken));
212213
this.spring.register(CsrfDisablesPostRequestFromRequestCacheConfig.class).autowire();
213214
MvcResult mvcResult = this.mvc.perform(post("/some-url")).andReturn();
214215
this.mvc.perform(post("/login").param("username", "user").param("password", "password").with(csrf())
215216
.session((MockHttpSession) mvcResult.getRequest().getSession())).andExpect(status().isFound())
216217
.andExpect(redirectedUrl("/"));
217218
verify(CsrfDisablesPostRequestFromRequestCacheConfig.REPO, atLeastOnce())
218-
.loadToken(any(HttpServletRequest.class));
219+
.loadDeferredToken(any(HttpServletRequest.class), any(HttpServletResponse.class));
219220
}
220221

221222
@Test
222223
public void loginWhenCsrfEnabledThenRedirectsToPreviousGetRequest() throws Exception {
223224
CsrfDisablesPostRequestFromRequestCacheConfig.REPO = mock(CsrfTokenRepository.class);
224225
DefaultCsrfToken csrfToken = new DefaultCsrfToken("X-CSRF-TOKEN", "_csrf", "token");
225-
given(CsrfDisablesPostRequestFromRequestCacheConfig.REPO.loadToken(any())).willReturn(csrfToken);
226-
given(CsrfDisablesPostRequestFromRequestCacheConfig.REPO.generateToken(any())).willReturn(csrfToken);
226+
given(CsrfDisablesPostRequestFromRequestCacheConfig.REPO.loadDeferredToken(any(HttpServletRequest.class),
227+
any(HttpServletResponse.class))).willReturn(new TestDeferredCsrfToken(csrfToken));
227228
this.spring.register(CsrfDisablesPostRequestFromRequestCacheConfig.class).autowire();
228229
MvcResult mvcResult = this.mvc.perform(get("/some-url")).andReturn();
229230
this.mvc.perform(post("/login").param("username", "user").param("password", "password").with(csrf())
230231
.session((MockHttpSession) mvcResult.getRequest().getSession())).andExpect(status().isFound())
231232
.andExpect(redirectedUrl("http://localhost/some-url"));
232233
verify(CsrfDisablesPostRequestFromRequestCacheConfig.REPO, atLeastOnce())
233-
.loadToken(any(HttpServletRequest.class));
234+
.loadDeferredToken(any(HttpServletRequest.class), any(HttpServletResponse.class));
234235
}
235236

236237
// SEC-2422
@@ -277,11 +278,13 @@ public void requireCsrfProtectionMatcherInLambdaWhenRequestMatchesThenRespondsWi
277278
@Test
278279
public void getWhenCustomCsrfTokenRepositoryThenRepositoryIsUsed() throws Exception {
279280
CsrfTokenRepositoryConfig.REPO = mock(CsrfTokenRepository.class);
280-
given(CsrfTokenRepositoryConfig.REPO.loadToken(any()))
281-
.willReturn(new DefaultCsrfToken("X-CSRF-TOKEN", "_csrf", "token"));
281+
given(CsrfTokenRepositoryConfig.REPO.loadDeferredToken(any(HttpServletRequest.class),
282+
any(HttpServletResponse.class)))
283+
.willReturn(new TestDeferredCsrfToken(new DefaultCsrfToken("X-CSRF-TOKEN", "_csrf", "token")));
282284
this.spring.register(CsrfTokenRepositoryConfig.class, BasicController.class).autowire();
283285
this.mvc.perform(get("/")).andExpect(status().isOk());
284-
verify(CsrfTokenRepositoryConfig.REPO).loadToken(any(HttpServletRequest.class));
286+
verify(CsrfTokenRepositoryConfig.REPO).loadDeferredToken(any(HttpServletRequest.class),
287+
any(HttpServletResponse.class));
285288
}
286289

287290
@Test
@@ -297,8 +300,8 @@ public void logoutWhenCustomCsrfTokenRepositoryThenCsrfTokenIsCleared() throws E
297300
public void loginWhenCustomCsrfTokenRepositoryThenCsrfTokenIsCleared() throws Exception {
298301
CsrfTokenRepositoryConfig.REPO = mock(CsrfTokenRepository.class);
299302
DefaultCsrfToken csrfToken = new DefaultCsrfToken("X-CSRF-TOKEN", "_csrf", "token");
300-
given(CsrfTokenRepositoryConfig.REPO.loadToken(any())).willReturn(csrfToken);
301-
given(CsrfTokenRepositoryConfig.REPO.generateToken(any())).willReturn(csrfToken);
303+
given(CsrfTokenRepositoryConfig.REPO.loadDeferredToken(any(HttpServletRequest.class),
304+
any(HttpServletResponse.class))).willReturn(new TestDeferredCsrfToken(csrfToken));
302305
this.spring.register(CsrfTokenRepositoryConfig.class, BasicController.class).autowire();
303306
// @formatter:off
304307
MockHttpServletRequestBuilder loginRequest = post("/login")
@@ -314,11 +317,13 @@ public void loginWhenCustomCsrfTokenRepositoryThenCsrfTokenIsCleared() throws Ex
314317
@Test
315318
public void getWhenCustomCsrfTokenRepositoryInLambdaThenRepositoryIsUsed() throws Exception {
316319
CsrfTokenRepositoryInLambdaConfig.REPO = mock(CsrfTokenRepository.class);
317-
given(CsrfTokenRepositoryInLambdaConfig.REPO.loadToken(any()))
318-
.willReturn(new DefaultCsrfToken("X-CSRF-TOKEN", "_csrf", "token"));
320+
given(CsrfTokenRepositoryInLambdaConfig.REPO.loadDeferredToken(any(HttpServletRequest.class),
321+
any(HttpServletResponse.class)))
322+
.willReturn(new TestDeferredCsrfToken(new DefaultCsrfToken("X-CSRF-TOKEN", "_csrf", "token")));
319323
this.spring.register(CsrfTokenRepositoryInLambdaConfig.class, BasicController.class).autowire();
320324
this.mvc.perform(get("/")).andExpect(status().isOk());
321-
verify(CsrfTokenRepositoryInLambdaConfig.REPO).loadToken(any(HttpServletRequest.class));
325+
verify(CsrfTokenRepositoryInLambdaConfig.REPO).loadDeferredToken(any(HttpServletRequest.class),
326+
any(HttpServletResponse.class));
322327
}
323328

324329
@Test
@@ -418,40 +423,39 @@ public void csrfAuthenticationStrategyConfiguredThenStrategyUsed() throws Except
418423
}
419424

420425
@Test
421-
public void getLoginWhenCsrfTokenRequestProcessorSetThenRespondsWithNormalCsrfToken() throws Exception {
426+
public void getLoginWhenCsrfTokenRequestHandlerSetThenRespondsWithNormalCsrfToken() throws Exception {
422427
CsrfTokenRepository csrfTokenRepository = mock(CsrfTokenRepository.class);
423428
CsrfToken csrfToken = new DefaultCsrfToken("X-CSRF-TOKEN", "_csrf", "token");
424-
given(csrfTokenRepository.generateToken(any(HttpServletRequest.class))).willReturn(csrfToken);
425-
CsrfTokenRequestProcessorConfig.HANDLER = new CsrfTokenRepositoryRequestHandler(csrfTokenRepository);
426-
this.spring.register(CsrfTokenRequestProcessorConfig.class, BasicController.class).autowire();
429+
given(csrfTokenRepository.loadDeferredToken(any(HttpServletRequest.class), any(HttpServletResponse.class)))
430+
.willReturn(new TestDeferredCsrfToken(csrfToken));
431+
CsrfTokenRequestHandlerConfig.REPO = csrfTokenRepository;
432+
CsrfTokenRequestHandlerConfig.HANDLER = new CsrfTokenRequestAttributeHandler();
433+
this.spring.register(CsrfTokenRequestHandlerConfig.class, BasicController.class).autowire();
427434
this.mvc.perform(get("/login")).andExpect(status().isOk())
428435
.andExpect(content().string(containsString(csrfToken.getToken())));
429-
verify(csrfTokenRepository).loadToken(any(HttpServletRequest.class));
430-
verify(csrfTokenRepository).generateToken(any(HttpServletRequest.class));
431-
verify(csrfTokenRepository).saveToken(eq(csrfToken), any(HttpServletRequest.class),
432-
any(HttpServletResponse.class));
436+
verify(csrfTokenRepository).loadDeferredToken(any(HttpServletRequest.class), any(HttpServletResponse.class));
433437
verifyNoMoreInteractions(csrfTokenRepository);
434438
}
435439

436440
@Test
437-
public void loginWhenCsrfTokenRequestProcessorSetAndNormalCsrfTokenThenSuccess() throws Exception {
441+
public void loginWhenCsrfTokenRequestHandlerSetAndNormalCsrfTokenThenSuccess() throws Exception {
438442
CsrfToken csrfToken = new DefaultCsrfToken("X-CSRF-TOKEN", "_csrf", "token");
439443
CsrfTokenRepository csrfTokenRepository = mock(CsrfTokenRepository.class);
440-
given(csrfTokenRepository.loadToken(any(HttpServletRequest.class))).willReturn(null, csrfToken);
441-
given(csrfTokenRepository.generateToken(any(HttpServletRequest.class))).willReturn(csrfToken);
442-
CsrfTokenRequestProcessorConfig.HANDLER = new CsrfTokenRepositoryRequestHandler(csrfTokenRepository);
444+
given(csrfTokenRepository.loadDeferredToken(any(HttpServletRequest.class), any(HttpServletResponse.class)))
445+
.willReturn(new TestDeferredCsrfToken(csrfToken));
446+
CsrfTokenRequestHandlerConfig.REPO = csrfTokenRepository;
447+
CsrfTokenRequestHandlerConfig.HANDLER = new CsrfTokenRequestAttributeHandler();
448+
this.spring.register(CsrfTokenRequestHandlerConfig.class, BasicController.class).autowire();
443449

444-
this.spring.register(CsrfTokenRequestProcessorConfig.class, BasicController.class).autowire();
445450
// @formatter:off
446451
MockHttpServletRequestBuilder loginRequest = post("/login")
447452
.header(csrfToken.getHeaderName(), csrfToken.getToken())
448453
.param("username", "user")
449454
.param("password", "password");
450455
// @formatter:on
451456
this.mvc.perform(loginRequest).andExpect(redirectedUrl("/"));
452-
verify(csrfTokenRepository, times(2)).loadToken(any(HttpServletRequest.class));
453-
verify(csrfTokenRepository).generateToken(any(HttpServletRequest.class));
454-
verify(csrfTokenRepository).saveToken(eq(csrfToken), any(HttpServletRequest.class),
457+
verify(csrfTokenRepository).saveToken(isNull(), any(HttpServletRequest.class), any(HttpServletResponse.class));
458+
verify(csrfTokenRepository, times(2)).loadDeferredToken(any(HttpServletRequest.class),
455459
any(HttpServletResponse.class));
456460
verifyNoMoreInteractions(csrfTokenRepository);
457461
}
@@ -799,9 +803,11 @@ protected void configure(AuthenticationManagerBuilder auth) throws Exception {
799803

800804
@Configuration
801805
@EnableWebSecurity
802-
static class CsrfTokenRequestProcessorConfig {
806+
static class CsrfTokenRequestHandlerConfig {
807+
808+
static CsrfTokenRepository REPO;
803809

804-
static CsrfTokenRepositoryRequestHandler HANDLER;
810+
static CsrfTokenRequestHandler HANDLER;
805811

806812
@Bean
807813
SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
@@ -811,7 +817,10 @@ SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
811817
.anyRequest().authenticated()
812818
)
813819
.formLogin(Customizer.withDefaults())
814-
.csrf((csrf) -> csrf.csrfTokenRequestHandler(HANDLER));
820+
.csrf((csrf) -> csrf
821+
.csrfTokenRepository(REPO)
822+
.csrfTokenRequestHandler(HANDLER)
823+
);
815824
// @formatter:on
816825

817826
return http.build();
@@ -841,4 +850,24 @@ void rootPost() {
841850

842851
}
843852

853+
private static final class TestDeferredCsrfToken implements DeferredCsrfToken {
854+
855+
private final CsrfToken csrfToken;
856+
857+
private TestDeferredCsrfToken(CsrfToken csrfToken) {
858+
this.csrfToken = csrfToken;
859+
}
860+
861+
@Override
862+
public CsrfToken get() {
863+
return this.csrfToken;
864+
}
865+
866+
@Override
867+
public boolean isGenerated() {
868+
return false;
869+
}
870+
871+
}
872+
844873
}

‎config/src/test/java/org/springframework/security/config/http/CsrfConfigTests.java‎

Lines changed: 3 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,6 @@
3030
import org.springframework.beans.factory.annotation.Autowired;
3131
import org.springframework.http.HttpMethod;
3232
import org.springframework.mock.web.MockHttpServletRequest;
33-
import org.springframework.mock.web.MockHttpServletResponse;
3433
import org.springframework.mock.web.MockHttpSession;
3534
import org.springframework.security.access.AccessDeniedException;
3635
import org.springframework.security.config.test.SpringTestContext;
@@ -42,7 +41,6 @@
4241
import org.springframework.security.web.access.AccessDeniedHandler;
4342
import org.springframework.security.web.csrf.CsrfFilter;
4443
import org.springframework.security.web.csrf.CsrfToken;
45-
import org.springframework.security.web.csrf.DeferredCsrfToken;
4644
import org.springframework.security.web.util.matcher.RequestMatcher;
4745
import org.springframework.stereotype.Controller;
4846
import org.springframework.test.context.junit.jupiter.SpringExtension;
@@ -546,9 +544,8 @@ static class CsrfCreatedResultMatcher implements ResultMatcher {
546544
@Override
547545
public void match(MvcResult result) {
548546
MockHttpServletRequest request = result.getRequest();
549-
MockHttpServletResponse response = result.getResponse();
550-
DeferredCsrfToken token = WebTestUtils.getCsrfTokenRequestHandler(request).handle(request, response);
551-
assertThat(token.isGenerated()).isFalse();
547+
CsrfToken token = WebTestUtils.getCsrfTokenRepository(request).loadToken(request);
548+
assertThat(token).isNotNull();
552549
}
553550

554551
}
@@ -564,8 +561,7 @@ static class CsrfReturnedResultMatcher implements ResultMatcher {
564561
@Override
565562
public void match(MvcResult result) throws Exception {
566563
MockHttpServletRequest request = result.getRequest();
567-
MockHttpServletResponse response = result.getResponse();
568-
CsrfToken token = WebTestUtils.getCsrfTokenRequestHandler(request).handle(request, response).get();
564+
CsrfToken token = WebTestUtils.getCsrfTokenRepository(request).loadToken(request);
569565
assertThat(token).isNotNull();
570566
assertThat(token.getToken()).isEqualTo(this.token.apply(result));
571567
}

‎config/src/test/resources/org/springframework/security/config/http/CsrfConfigTests-WithRequestAttrName.xml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@
2626
<csrf request-handler-ref="requestHandler"/>
2727
</http>
2828

29-
<b:bean id="requestHandler" class="org.springframework.security.web.csrf.CsrfTokenRepositoryRequestHandler"
29+
<b:bean id="requestHandler" class="org.springframework.security.web.csrf.CsrfTokenRequestAttributeHandler"
3030
p:csrfRequestAttributeName="csrf-attribute-name"/>
3131
<b:import resource="CsrfConfigTests-shared-userservice.xml"/>
3232
</b:beans>

‎config/src/test/resources/org/springframework/security/config/http/DeferHttpSessionTests-Explicit.xml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,7 @@
4242
<b:bean id="csrfRepository" class="org.springframework.security.web.csrf.LazyCsrfTokenRepository"
4343
c:delegate-ref="httpSessionCsrfRepository"
4444
p:deferLoadToken="true"/>
45-
<b:bean id="requestHandler" class="org.springframework.security.web.csrf.CsrfTokenRepositoryRequestHandler"
45+
<b:bean id="requestHandler" class="org.springframework.security.web.csrf.CsrfTokenRequestAttributeHandler"
4646
p:csrfRequestAttributeName="_csrf"/>
4747
<b:import resource="CsrfConfigTests-shared-userservice.xml"/>
4848
</b:beans>

0 commit comments

Comments
 (0)