From 3f18881493b9060c05d55249fcec869a62b58ed4 Mon Sep 17 00:00:00 2001 From: Rob Winch Date: Tue, 7 Nov 2017 21:03:09 -0600 Subject: [PATCH] Remove additional attribute name from CsrfWebFilter Fixes gh-4799 --- .../security/config/web/server/ServerHttpSecurity.java | 6 ------ .../security/web/server/csrf/CsrfWebFilter.java | 8 -------- 2 files changed, 14 deletions(-) diff --git a/config/src/main/java/org/springframework/security/config/web/server/ServerHttpSecurity.java b/config/src/main/java/org/springframework/security/config/web/server/ServerHttpSecurity.java index df8344f10a..5cd4a4d581 100644 --- a/config/src/main/java/org/springframework/security/config/web/server/ServerHttpSecurity.java +++ b/config/src/main/java/org/springframework/security/config/web/server/ServerHttpSecurity.java @@ -387,12 +387,6 @@ public class ServerHttpSecurity { return this; } - public CsrfBuilder csrfTokenAttributeName(String csrfTokenAttributeName) { - Assert.notNull(csrfTokenAttributeName, "csrfTokenAttributeName cannot be null"); - this.filter.setCsrfTokenAttributeName(csrfTokenAttributeName); - return this; - } - public CsrfBuilder serverCsrfTokenRepository( ServerCsrfTokenRepository serverCsrfTokenRepository) { this.filter.setServerCsrfTokenRepository(serverCsrfTokenRepository); diff --git a/web/src/main/java/org/springframework/security/web/server/csrf/CsrfWebFilter.java b/web/src/main/java/org/springframework/security/web/server/csrf/CsrfWebFilter.java index e0a7613425..38616fa4c4 100644 --- a/web/src/main/java/org/springframework/security/web/server/csrf/CsrfWebFilter.java +++ b/web/src/main/java/org/springframework/security/web/server/csrf/CsrfWebFilter.java @@ -59,19 +59,12 @@ public class CsrfWebFilter implements WebFilter { private ServerAccessDeniedHandler serverAccessDeniedHandler = new HttpStatusServerAccessDeniedHandler(HttpStatus.FORBIDDEN); - private String csrfTokenAttributeName = "csrf"; - public void setServerAccessDeniedHandler( ServerAccessDeniedHandler serverAccessDeniedHandler) { Assert.notNull(serverAccessDeniedHandler, "serverAccessDeniedHandler"); this.serverAccessDeniedHandler = serverAccessDeniedHandler; } - public void setCsrfTokenAttributeName(String csrfTokenAttributeName) { - Assert.notNull(csrfTokenAttributeName, "csrfTokenAttributeName cannot be null"); - this.csrfTokenAttributeName = csrfTokenAttributeName; - } - public void setServerCsrfTokenRepository( ServerCsrfTokenRepository serverCsrfTokenRepository) { Assert.notNull(serverCsrfTokenRepository, "serverCsrfTokenRepository cannot be null"); @@ -113,7 +106,6 @@ public class CsrfWebFilter implements WebFilter { private Mono continueFilterChain(ServerWebExchange exchange, WebFilterChain chain) { return csrfToken(exchange) .doOnSuccess(csrfToken -> exchange.getAttributes().put(CsrfToken.class.getName(), csrfToken)) - .doOnSuccess(csrfToken -> exchange.getAttributes().put(this.csrfTokenAttributeName, csrfToken)) .flatMap( t -> chain.filter(exchange)) .then(); }