From 86875e117bd797e6baa1b354765eca3108b1af1d Mon Sep 17 00:00:00 2001
From: Rob Winch <rwinch@users.noreply.github.com>
Date: Thu, 26 Oct 2017 19:46:20 -0500
Subject: [PATCH] Prevent ServerHttpSecurity from being built twice

Issue: gh-4711
---
 .../config/web/server/ServerHttpSecurity.java | 24 +++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/config/src/main/java/org/springframework/security/config/web/server/ServerHttpSecurity.java b/config/src/main/java/org/springframework/security/config/web/server/ServerHttpSecurity.java
index dd9bb4c099..e6f5fa6fd9 100644
--- a/config/src/main/java/org/springframework/security/config/web/server/ServerHttpSecurity.java
+++ b/config/src/main/java/org/springframework/security/config/web/server/ServerHttpSecurity.java
@@ -67,6 +67,9 @@ import org.springframework.web.server.WebFilter;
 import org.springframework.web.server.WebFilterChain;
 import reactor.core.publisher.Mono;
 
+import java.io.IOException;
+import java.io.PrintWriter;
+import java.io.StringWriter;
 import java.time.Duration;
 import java.util.ArrayList;
 import java.util.Arrays;
@@ -102,6 +105,8 @@ public class ServerHttpSecurity {
 
 	private List<WebFilter> webFilters = new ArrayList<>();
 
+	private Throwable built;
+
 	/**
 	 * The ServerExchangeMatcher that determines which requests apply to this HttpSecurity instance.
 	 *
@@ -174,6 +179,10 @@ public class ServerHttpSecurity {
 	}
 
 	public SecurityWebFilterChain build() {
+		if(this.built != null) {
+			throw new IllegalStateException("This has already been built with the following stacktrace. " + buildToString());
+		}
+		this.built = new RuntimeException("First Build Invocation").fillInStackTrace();
 		if(this.headers != null) {
 			this.headers.configure(this);
 		}
@@ -216,6 +225,21 @@ public class ServerHttpSecurity {
 		return new MatcherSecurityWebFilterChain(getSecurityMatcher(), this.webFilters);
 	}
 
+	private String buildToString() {
+		try(StringWriter writer = new StringWriter()) {
+			try(PrintWriter printer = new PrintWriter(writer)) {
+				printer.println();
+				printer.println();
+				this.built.printStackTrace(printer);
+				printer.println();
+				printer.println();
+				return writer.toString();
+			}
+		} catch(IOException e) {
+			throw new RuntimeException(e);
+		}
+	}
+
 	private ServerAuthenticationEntryPoint getServerAuthenticationEntryPoint() {
 		if(this.serverAuthenticationEntryPoint != null || this.defaultEntryPoints.isEmpty()) {
 			return this.serverAuthenticationEntryPoint;