Cwikius-Spring/spring-security
1
0
Fork 0
mirror of synced 2026-08-23 02:27:44 +00:00
Code Issues Packages Projects Releases Wiki Activity

Disable Lowercase HTTP Method Firewall Test

Browse Source 
Spring Framework's HttpMethod#valueOf now normalizes casing, so
StrictServerWebExchangeFirewall no longer detects a non-canonical-case
HTTP method as distinct from its canonical form.

Closes gh-19541

Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
This commit is contained in:
Josh Cummings
2026-08-13 11:51:30 -06:00
parent 94d36e603b
commit 8876c30b00
2 changed files with 11 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/modules/ROOT/pages/whats-new.adoc
+4
View File
@@ -4,3 +4,7 @@
== Authentication
* https://github.com/spring-projects/spring-security/issues/17655[gh-17655] - Make One-Time Token xref:servlet/authentication/onetimetoken.adoc#validating-account-status[account status checks opt-in]
== Web
* Since Spring Framework's `HttpMethod#valueOf` now normalizes casing, `StrictServerWebExchangeFirewall` no longer detects a non-canonical-case HTTP method (for example, `get` instead of `GET`) as a distinct value; such requests are processed as the canonical method instead of being rejected. Applications with a customized `ServerExchangeRejectedHandler` should be aware it is no longer invoked for this case.
web/src/test/java/org/springframework/security/web/server/firewall/StrictServerWebExchangeFirewallTests.java
+7 -1
View File
@@ -20,6 +20,7 @@ import java.net.URI;
import java.util.Arrays;
import java.util.List;
import org.junit.jupiter.api.Disabled;
import org.junit.jupiter.api.Test;
import org.springframework.http.HttpHeaders;
@@ -127,8 +128,13 @@ class StrictServerWebExchangeFirewallTests {
assertThatExceptionOfType(ServerExchangeRejectedException.class).isThrownBy(() -> getFirewalledExchange());
}
// FIXME: since Spring Framework's HttpMethod#valueOf now normalizes casing,
// HttpMethod.valueOf("get") is HttpMethod.GET, so the request is no longer
// distinguishable as non-canonical case by the time it reaches the firewall.
// The request is still processed as an ordinary GET (not "served" as lowercase),
// but a customized ServerExchangeRejectedHandler will no longer be invoked for it.
@Test
// HTTP methods are case sensitive
@Disabled("HTTP method case is normalized by Spring Framework before reaching the firewall")
void getFirewalledExchangeWhenLowercaseGetThenThrowsServerExchangeRejectedException() {
this.request = MockServerHttpRequest.method(HttpMethod.valueOf("get"), "/");
assertThatExceptionOfType(ServerExchangeRejectedException.class).isThrownBy(() -> getFirewalledExchange());