Cwikius-Spring/spring-security
1
0
Fork 0
mirror of synced 2026-08-04 09:17:02 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fix CSRF / DefaultLoginPageGeneratingFilter package tangle

Browse Source 
Issue: gh-4636
This commit is contained in:
Rob Winch
2017-10-13 15:11:08 -05:00
parent 7fd1cff3ce
commit a74f7c6faa
3 changed files with 46 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
web/src/main/java/org/springframework/security/web/authentication/ui/DefaultLoginPageGeneratingFilter.java
+20 -6
View File
@@ -20,7 +20,7 @@ import org.springframework.security.web.WebAttributes;
import org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter;
import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
import org.springframework.security.web.authentication.rememberme.AbstractRememberMeServices;
import org.springframework.security.web.csrf.CsrfToken;
import org.springframework.util.Assert;
import org.springframework.web.filter.GenericFilterBean;
import javax.servlet.FilterChain;
@@ -31,7 +31,9 @@ import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;
import java.io.IOException;
import java.util.Collections;
import java.util.Map;
import java.util.function.Function;
/**
* For internal use with namespace configuration in the case where a user doesn't
@@ -60,6 +62,8 @@ public class DefaultLoginPageGeneratingFilter extends GenericFilterBean {
private String openIDusernameParameter;
private String openIDrememberMeParameter;
private Map<String, String> oauth2AuthenticationUrlToClientName;
private Function<HttpServletRequest,Map<String,String>> resolveHiddenInputs = request -> Collections
.emptyMap();
public DefaultLoginPageGeneratingFilter() {
@@ -107,6 +111,18 @@ public class DefaultLoginPageGeneratingFilter extends GenericFilterBean {
}
}
/**
* Sets a Function used to resolve a Map of the hidden inputs where the key is the
* name of the input and the value is the value of the input. Typically this is used
* to resolve the CSRF token.
* @param resolveHiddenInputs the function to resolve the inputs
*/
public void setResolveHiddenInputs(
Function<HttpServletRequest, Map<String, String>> resolveHiddenInputs) {
Assert.notNull(resolveHiddenInputs, "resolveHiddenInputs cannot be null");
this.resolveHiddenInputs = resolveHiddenInputs;
}
public boolean isEnabled() {
return formLoginEnabled || openIdEnabled || oauth2LoginEnabled;
}
@@ -282,11 +298,9 @@ public class DefaultLoginPageGeneratingFilter extends GenericFilterBean {
}
private void renderHiddenInputs(StringBuilder sb, HttpServletRequest request) {
CsrfToken token = (CsrfToken) request.getAttribute(CsrfToken.class.getName());
if (token != null) {
sb.append(" <input name=\"" + token.getParameterName()
+ "\" type=\"hidden\" value=\"" + token.getToken() + "\" />\n");
for(Map.Entry<String,String> input : this.resolveHiddenInputs.apply(request).entrySet()) {
sb.append(" <input name=\"" + input.getKey()
+ "\" type=\"hidden\" value=\"" + input.getValue() + "\" />\n");
}
}