Skip to content

Commit d94677f

Browse files
rwinchrwinch
committed
CsrfTokenRequestAttributeHandler -> CsrfTokenRequestHandler
This renames CsrfTokenRequestAttributeHandler to CsrfTokenRequestHandler and moves usage from CsrfFilter into CsrfTokenRequestHandler. Closes gh-11892
1 parent c1d2761 commit d94677f

File tree

27 files changed

+406
-310
lines changed

27 files changed

+406
-310
lines changed

‎config/src/main/java/org/springframework/security/config/annotation/web/configurers/CsrfConfigurer.java‎

Lines changed: 11 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,7 @@
3636
import org.springframework.security.web.csrf.CsrfFilter;
3737
import org.springframework.security.web.csrf.CsrfLogoutHandler;
3838
import org.springframework.security.web.csrf.CsrfTokenRepository;
39-
import org.springframework.security.web.csrf.CsrfTokenRequestAttributeHandler;
39+
import org.springframework.security.web.csrf.CsrfTokenRequestHandler;
4040
import org.springframework.security.web.csrf.CsrfTokenRequestResolver;
4141
import org.springframework.security.web.csrf.HttpSessionCsrfTokenRepository;
4242
import org.springframework.security.web.csrf.LazyCsrfTokenRepository;
@@ -91,7 +91,7 @@ public final class CsrfConfigurer<H extends HttpSecurityBuilder<H>>
9191

9292
private SessionAuthenticationStrategy sessionAuthenticationStrategy;
9393

94-
private CsrfTokenRequestAttributeHandler requestAttributeHandler;
94+
private CsrfTokenRequestHandler requestHandler;
9595

9696
private CsrfTokenRequestResolver requestResolver;
9797

@@ -131,14 +131,13 @@ public CsrfConfigurer<H> requireCsrfProtectionMatcher(RequestMatcher requireCsrf
131131
}
132132

133133
/**
134-
* Specify a {@link CsrfTokenRequestAttributeHandler} to use for making the
135-
* {@code CsrfToken} available as a request attribute.
136-
* @param requestAttributeHandler the {@link CsrfTokenRequestAttributeHandler} to use
134+
* Specify a {@link CsrfTokenRequestHandler} to use for making the {@code CsrfToken}
135+
* available as a request attribute.
136+
* @param requestHandler the {@link CsrfTokenRequestHandler} to use
137137
* @return the {@link CsrfConfigurer} for further customizations
138138
*/
139-
public CsrfConfigurer<H> csrfTokenRequestAttributeHandler(
140-
CsrfTokenRequestAttributeHandler requestAttributeHandler) {
141-
this.requestAttributeHandler = requestAttributeHandler;
139+
public CsrfConfigurer<H> csrfTokenRequestHandler(CsrfTokenRequestHandler requestHandler) {
140+
this.requestHandler = requestHandler;
142141
return this;
143142
}
144143

@@ -247,8 +246,8 @@ public void configure(H http) {
247246
if (sessionConfigurer != null) {
248247
sessionConfigurer.addSessionAuthenticationStrategy(getSessionAuthenticationStrategy());
249248
}
250-
if (this.requestAttributeHandler != null) {
251-
filter.setRequestAttributeHandler(this.requestAttributeHandler);
249+
if (this.requestHandler != null) {
250+
filter.setRequestHandler(this.requestHandler);
252251
}
253252
if (this.requestResolver != null) {
254253
filter.setRequestResolver(this.requestResolver);
@@ -343,8 +342,8 @@ private SessionAuthenticationStrategy getSessionAuthenticationStrategy() {
343342
}
344343
CsrfAuthenticationStrategy csrfAuthenticationStrategy = new CsrfAuthenticationStrategy(
345344
this.csrfTokenRepository);
346-
if (this.requestAttributeHandler != null) {
347-
csrfAuthenticationStrategy.setRequestAttributeHandler(this.requestAttributeHandler);
345+
if (this.requestHandler != null) {
346+
csrfAuthenticationStrategy.setRequestHandler(this.requestHandler);
348347
}
349348
return csrfAuthenticationStrategy;
350349
}

‎config/src/main/java/org/springframework/security/config/http/CsrfBeanDefinitionParser.java‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -71,7 +71,7 @@ public class CsrfBeanDefinitionParser implements BeanDefinitionParser {
7171

7272
private static final String ATT_REPOSITORY = "token-repository-ref";
7373

74-
private static final String ATT_REQUEST_ATTRIBUTE_HANDLER = "request-attribute-handler-ref";
74+
private static final String ATT_REQUEST_HANDLER = "request-handler-ref";
7575

7676
private static final String ATT_REQUEST_RESOLVER = "request-resolver-ref";
7777

@@ -81,7 +81,7 @@ public class CsrfBeanDefinitionParser implements BeanDefinitionParser {
8181

8282
private String requestMatcherRef;
8383

84-
private String requestAttributeHandlerRef;
84+
private String requestHandlerRef;
8585

8686
private String requestResolverRef;
8787

@@ -103,7 +103,7 @@ public BeanDefinition parse(Element element, ParserContext pc) {
103103
if (element != null) {
104104
this.csrfRepositoryRef = element.getAttribute(ATT_REPOSITORY);
105105
this.requestMatcherRef = element.getAttribute(ATT_MATCHER);
106-
this.requestAttributeHandlerRef = element.getAttribute(ATT_REQUEST_ATTRIBUTE_HANDLER);
106+
this.requestHandlerRef = element.getAttribute(ATT_REQUEST_HANDLER);
107107
this.requestResolverRef = element.getAttribute(ATT_REQUEST_RESOLVER);
108108
}
109109
if (!StringUtils.hasText(this.csrfRepositoryRef)) {
@@ -120,8 +120,8 @@ public BeanDefinition parse(Element element, ParserContext pc) {
120120
if (StringUtils.hasText(this.requestMatcherRef)) {
121121
builder.addPropertyReference("requireCsrfProtectionMatcher", this.requestMatcherRef);
122122
}
123-
if (StringUtils.hasText(this.requestAttributeHandlerRef)) {
124-
builder.addPropertyReference("requestAttributeHandler", this.requestAttributeHandlerRef);
123+
if (StringUtils.hasText(this.requestHandlerRef)) {
124+
builder.addPropertyReference("requestHandler", this.requestHandlerRef);
125125
}
126126
if (StringUtils.hasText(this.requestResolverRef)) {
127127
builder.addPropertyReference("requestResolver", this.requestResolverRef);

‎config/src/main/resources/org/springframework/security/config/spring-security-5.8.rnc‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1152,8 +1152,8 @@ csrf-options.attlist &=
11521152
## The CsrfTokenRepository to use. The default is HttpSessionCsrfTokenRepository wrapped by LazyCsrfTokenRepository.
11531153
attribute token-repository-ref { xsd:token }?
11541154
csrf-options.attlist &=
1155-
## The CsrfTokenRequestAttributeHandler to use. The default is CsrfTokenRequestProcessor.
1156-
attribute request-attribute-handler-ref { xsd:token }?
1155+
## The CsrfTokenRequestHandler to use. The default is CsrfTokenRequestProcessor.
1156+
attribute request-handler-ref { xsd:token }?
11571157
csrf-options.attlist &=
11581158
## The CsrfTokenRequestResolver to use. The default is CsrfTokenRequestProcessor.
11591159
attribute request-resolver-ref { xsd:token }?

‎config/src/main/resources/org/springframework/security/config/spring-security-5.8.xsd‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3256,9 +3256,9 @@
32563256
</xs:documentation>
32573257
</xs:annotation>
32583258
</xs:attribute>
3259-
<xs:attribute name="request-attribute-handler-ref" type="xs:token">
3259+
<xs:attribute name="request-handler-ref" type="xs:token">
32603260
<xs:annotation>
3261-
<xs:documentation>The CsrfTokenRequestAttributeHandler to use. The default is CsrfTokenRequestProcessor.
3261+
<xs:documentation>The CsrfTokenRequestHandler to use. The default is CsrfTokenRequestProcessor.
32623262
</xs:documentation>
32633263
</xs:annotation>
32643264
</xs:attribute>

‎config/src/test/java/org/springframework/security/config/annotation/web/configuration/DeferHttpSessionJavaConfigTests.java‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -85,8 +85,8 @@ DefaultSecurityFilterChain springSecurity(HttpSecurity http) throws Exception {
8585
csrfRepository.setDeferLoadToken(true);
8686
HttpSessionRequestCache requestCache = new HttpSessionRequestCache();
8787
requestCache.setMatchingRequestParameterName("continue");
88-
CsrfTokenRequestProcessor requestAttributeHandler = new CsrfTokenRequestProcessor();
89-
requestAttributeHandler.setCsrfRequestAttributeName("_csrf");
88+
CsrfTokenRequestProcessor requestHandler = new CsrfTokenRequestProcessor();
89+
requestHandler.setCsrfRequestAttributeName("_csrf");
9090
// @formatter:off
9191
http
9292
.requestCache((cache) -> cache
@@ -102,7 +102,7 @@ DefaultSecurityFilterChain springSecurity(HttpSecurity http) throws Exception {
102102
.requireExplicitAuthenticationStrategy(true)
103103
)
104104
.csrf((csrf) -> csrf
105-
.csrfTokenRequestAttributeHandler(requestAttributeHandler)
105+
.csrfTokenRequestHandler(requestHandler)
106106
.csrfTokenRepository(csrfRepository)
107107
);
108108
// @formatter:on

‎config/src/test/java/org/springframework/security/config/annotation/web/configurers/CsrfConfigurerTests.java‎

Lines changed: 5 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -422,8 +422,8 @@ public void getLoginWhenCsrfTokenRequestProcessorSetThenRespondsWithNormalCsrfTo
422422
CsrfTokenRepository csrfTokenRepository = mock(CsrfTokenRepository.class);
423423
CsrfToken csrfToken = new DefaultCsrfToken("X-CSRF-TOKEN", "_csrf", "token");
424424
given(csrfTokenRepository.generateToken(any(HttpServletRequest.class))).willReturn(csrfToken);
425-
CsrfTokenRequestProcessorConfig.REPO = csrfTokenRepository;
426425
CsrfTokenRequestProcessorConfig.PROCESSOR = new CsrfTokenRequestProcessor();
426+
CsrfTokenRequestProcessorConfig.PROCESSOR.setTokenRepository(csrfTokenRepository);
427427
this.spring.register(CsrfTokenRequestProcessorConfig.class, BasicController.class).autowire();
428428
this.mvc.perform(get("/login")).andExpect(status().isOk())
429429
.andExpect(content().string(containsString(csrfToken.getToken())));
@@ -438,10 +438,11 @@ public void getLoginWhenCsrfTokenRequestProcessorSetThenRespondsWithNormalCsrfTo
438438
public void loginWhenCsrfTokenRequestProcessorSetAndNormalCsrfTokenThenSuccess() throws Exception {
439439
CsrfToken csrfToken = new DefaultCsrfToken("X-CSRF-TOKEN", "_csrf", "token");
440440
CsrfTokenRepository csrfTokenRepository = mock(CsrfTokenRepository.class);
441-
given(csrfTokenRepository.loadToken(any(HttpServletRequest.class))).willReturn(csrfToken);
441+
given(csrfTokenRepository.loadToken(any(HttpServletRequest.class))).willReturn(null, csrfToken);
442442
given(csrfTokenRepository.generateToken(any(HttpServletRequest.class))).willReturn(csrfToken);
443-
CsrfTokenRequestProcessorConfig.REPO = csrfTokenRepository;
444443
CsrfTokenRequestProcessorConfig.PROCESSOR = new CsrfTokenRequestProcessor();
444+
CsrfTokenRequestProcessorConfig.PROCESSOR.setTokenRepository(csrfTokenRepository);
445+
445446
this.spring.register(CsrfTokenRequestProcessorConfig.class, BasicController.class).autowire();
446447
// @formatter:off
447448
MockHttpServletRequestBuilder loginRequest = post("/login")
@@ -451,7 +452,6 @@ public void loginWhenCsrfTokenRequestProcessorSetAndNormalCsrfTokenThenSuccess()
451452
// @formatter:on
452453
this.mvc.perform(loginRequest).andExpect(redirectedUrl("/"));
453454
verify(csrfTokenRepository, times(2)).loadToken(any(HttpServletRequest.class));
454-
verify(csrfTokenRepository).saveToken(isNull(), any(HttpServletRequest.class), any(HttpServletResponse.class));
455455
verify(csrfTokenRepository).generateToken(any(HttpServletRequest.class));
456456
verify(csrfTokenRepository).saveToken(eq(csrfToken), any(HttpServletRequest.class),
457457
any(HttpServletResponse.class));
@@ -803,8 +803,6 @@ protected void configure(AuthenticationManagerBuilder auth) throws Exception {
803803
@EnableWebSecurity
804804
static class CsrfTokenRequestProcessorConfig {
805805

806-
static CsrfTokenRepository REPO;
807-
808806
static CsrfTokenRequestProcessor PROCESSOR;
809807

810808
@Bean
@@ -816,8 +814,7 @@ SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
816814
)
817815
.formLogin(Customizer.withDefaults())
818816
.csrf((csrf) -> csrf
819-
.csrfTokenRepository(REPO)
820-
.csrfTokenRequestAttributeHandler(PROCESSOR)
817+
.csrfTokenRequestHandler(PROCESSOR)
821818
.csrfTokenRequestResolver(PROCESSOR)
822819
);
823820
// @formatter:on

‎config/src/test/java/org/springframework/security/config/http/CsrfConfigTests.java‎

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,7 @@
3030
import org.springframework.beans.factory.annotation.Autowired;
3131
import org.springframework.http.HttpMethod;
3232
import org.springframework.mock.web.MockHttpServletRequest;
33+
import org.springframework.mock.web.MockHttpServletResponse;
3334
import org.springframework.mock.web.MockHttpSession;
3435
import org.springframework.security.access.AccessDeniedException;
3536
import org.springframework.security.config.test.SpringTestContext;
@@ -41,6 +42,7 @@
4142
import org.springframework.security.web.access.AccessDeniedHandler;
4243
import org.springframework.security.web.csrf.CsrfFilter;
4344
import org.springframework.security.web.csrf.CsrfToken;
45+
import org.springframework.security.web.csrf.DeferredCsrfToken;
4446
import org.springframework.security.web.util.matcher.RequestMatcher;
4547
import org.springframework.stereotype.Controller;
4648
import org.springframework.test.context.junit.jupiter.SpringExtension;
@@ -544,8 +546,9 @@ static class CsrfCreatedResultMatcher implements ResultMatcher {
544546
@Override
545547
public void match(MvcResult result) {
546548
MockHttpServletRequest request = result.getRequest();
547-
CsrfToken token = WebTestUtils.getCsrfTokenRepository(request).loadToken(request);
548-
assertThat(token).isNotNull();
549+
MockHttpServletResponse response = result.getResponse();
550+
DeferredCsrfToken token = WebTestUtils.getCsrfTokenRequestHandler(request).handle(request, response);
551+
assertThat(token.isGenerated()).isFalse();
549552
}
550553

551554
}
@@ -561,7 +564,8 @@ static class CsrfReturnedResultMatcher implements ResultMatcher {
561564
@Override
562565
public void match(MvcResult result) throws Exception {
563566
MockHttpServletRequest request = result.getRequest();
564-
CsrfToken token = WebTestUtils.getCsrfTokenRepository(request).loadToken(request);
567+
MockHttpServletResponse response = result.getResponse();
568+
CsrfToken token = WebTestUtils.getCsrfTokenRequestHandler(request).handle(request, response).get();
565569
assertThat(token).isNotNull();
566570
assertThat(token.getToken()).isEqualTo(this.token.apply(result));
567571
}

‎config/src/test/resources/org/springframework/security/config/http/CsrfConfigTests-WithRequestAttrName.xml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -23,10 +23,10 @@
2323
http://www.springframework.org/schema/beans https://www.springframework.org/schema/beans/spring-beans.xsd">
2424

2525
<http auto-config="true">
26-
<csrf request-attribute-handler-ref="requestAttributeHandler"/>
26+
<csrf request-handler-ref="requestHandler"/>
2727
</http>
2828

29-
<b:bean id="requestAttributeHandler" class="org.springframework.security.web.csrf.CsrfTokenRequestProcessor"
29+
<b:bean id="requestHandler" class="org.springframework.security.web.csrf.CsrfTokenRequestProcessor"
3030
p:csrfRequestAttributeName="csrf-attribute-name"/>
3131
<b:import resource="CsrfConfigTests-shared-userservice.xml"/>
3232
</b:beans>

‎config/src/test/resources/org/springframework/security/config/http/DeferHttpSessionTests-Explicit.xml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@
3030
security-context-explicit-save="true"
3131
use-authorization-manager="true">
3232
<intercept-url pattern="/**" access="permitAll"/>
33-
<csrf request-attribute-handler-ref="requestAttributeHandler"
33+
<csrf request-handler-ref="requestHandler"
3434
token-repository-ref="csrfRepository"/>
3535
<request-cache ref="requestCache"/>
3636
<session-management authentication-strategy-explicit-invocation="true"/>
@@ -42,7 +42,7 @@
4242
<b:bean id="csrfRepository" class="org.springframework.security.web.csrf.LazyCsrfTokenRepository"
4343
c:delegate-ref="httpSessionCsrfRepository"
4444
p:deferLoadToken="true"/>
45-
<b:bean id="requestAttributeHandler" class="org.springframework.security.web.csrf.CsrfTokenRequestProcessor"
45+
<b:bean id="requestHandler" class="org.springframework.security.web.csrf.CsrfTokenRequestProcessor"
4646
p:csrfRequestAttributeName="_csrf"/>
4747
<b:import resource="CsrfConfigTests-shared-userservice.xml"/>
4848
</b:beans>

‎docs/modules/ROOT/pages/servlet/appendix/namespace/http.adoc‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -775,9 +775,9 @@ It is highly recommended to leave CSRF protection enabled.
775775
The CsrfTokenRepository to use.
776776
The default is `HttpSessionCsrfTokenRepository`.
777777

778-
[[nsa-csrf-request-attribute-handler-ref]]
779-
* **request-attribute-handler-ref**
780-
The optional `CsrfTokenRequestAttributeHandler` to use. The default is `CsrfTokenRequestProcessor`.
778+
[[nsa-csrf-request-handler-ref]]
779+
* **request-handler-ref**
780+
The optional `CsrfTokenRequestHandler` to use. The default is `CsrfTokenRequestProcessor`.
781781

782782
[[nsa-csrf-request-resolver-ref]]
783783
* **request-resolver-ref**

0 commit comments

Comments
 (0)