Release 5.0.14.RELEASE

Fixes gh-7934

.travis.yml

@@ -1,7 +1,7 @@
 language: java
 
 jdk:
-  - oraclejdk8
+  - openjdk8
 
 os:
   - linux

Jenkinsfile

@@ -14,7 +14,9 @@ try {
 			node {
 				checkout scm
 				try {
-					sh "./gradlew clean check  --refresh-dependencies --no-daemon --stacktrace"
+					withEnv(["JAVA_HOME=${ tool 'jdk8' }"]) {
+						sh "./gradlew clean check  --refresh-dependencies --no-daemon --stacktrace"
+					}
 				} catch(Exception e) {
 					currentBuild.result = 'FAILED: check'
 					throw e
@@ -30,10 +32,12 @@ try {
 				checkout scm
 				withCredentials([string(credentialsId: 'spring-sonar.login', variable: 'SONAR_LOGIN')]) {
 					try {
-						if ("master" == env.BRANCH_NAME) {
+						withEnv(["JAVA_HOME=${ tool 'jdk8' }"]) {
-							sh "./gradlew sonarqube -PexcludeProjects='**/samples/**' -Dsonar.host.url=$SPRING_SONAR_HOST_URL -Dsonar.login=$SONAR_LOGIN --refresh-dependencies --no-daemon --stacktrace"
+							if ("master" == env.BRANCH_NAME) {
-						} else {
+								sh "./gradlew sonarqube -PexcludeProjects='**/samples/**' -Dsonar.host.url=$SPRING_SONAR_HOST_URL -Dsonar.login=$SONAR_LOGIN --refresh-dependencies --no-daemon --stacktrace"
-							sh "./gradlew sonarqube -PexcludeProjects='**/samples/**' -Dsonar.projectKey='spring-security-${env.BRANCH_NAME}' -Dsonar.projectName='spring-security-${env.BRANCH_NAME}' -Dsonar.host.url=$SPRING_SONAR_HOST_URL -Dsonar.login=$SONAR_LOGIN --refresh-dependencies --no-daemon --stacktrace"
+							} else {
+								sh "./gradlew sonarqube -PexcludeProjects='**/samples/**' -Dsonar.projectKey='spring-security-${env.BRANCH_NAME}' -Dsonar.projectName='spring-security-${env.BRANCH_NAME}' -Dsonar.host.url=$SPRING_SONAR_HOST_URL -Dsonar.login=$SONAR_LOGIN --refresh-dependencies --no-daemon --stacktrace"
+							}
 						}
 					} catch(Exception e) {
 						currentBuild.result = 'FAILED: sonar'
@@ -53,7 +57,9 @@ try {
 						withCredentials([string(credentialsId: 'spring-gpg-passphrase', variable: 'SIGNING_PASSWORD')]) {
 							withCredentials([usernamePassword(credentialsId: 'oss-token', passwordVariable: 'OSSRH_PASSWORD', usernameVariable: 'OSSRH_USERNAME')]) {
 								withCredentials([usernamePassword(credentialsId: '02bd1690-b54f-4c9f-819d-a77cb7a9822c', usernameVariable: 'ARTIFACTORY_USERNAME', passwordVariable: 'ARTIFACTORY_PASSWORD')]) {
-									sh "./gradlew deployArtifacts finalizeDeployArtifacts -Psigning.secretKeyRingFile=$SIGNING_KEYRING_FILE -Psigning.keyId=$SPRING_SIGNING_KEYID -Psigning.password='$SIGNING_PASSWORD' -PossrhUsername=$OSSRH_USERNAME -PossrhPassword=$OSSRH_PASSWORD -PartifactoryUsername=$ARTIFACTORY_USERNAME -PartifactoryPassword=$ARTIFACTORY_PASSWORD --refresh-dependencies --no-daemon --stacktrace"
+									withEnv(["JAVA_HOME=${ tool 'jdk8' }"]) {
+										sh "./gradlew deployArtifacts finalizeDeployArtifacts -Psigning.secretKeyRingFile=$SIGNING_KEYRING_FILE -Psigning.keyId=$SPRING_SIGNING_KEYID -Psigning.password='$SIGNING_PASSWORD' -PossrhUsername=$OSSRH_USERNAME -PossrhPassword=$OSSRH_PASSWORD -PartifactoryUsername=$ARTIFACTORY_USERNAME -PartifactoryPassword=$ARTIFACTORY_PASSWORD --refresh-dependencies --no-daemon --stacktrace"
+									}
 								}
 							}
 						}
@@ -66,7 +72,9 @@ try {
 				node {
 					checkout scm
 					withCredentials([file(credentialsId: 'docs.spring.io-jenkins_private_ssh_key', variable: 'DEPLOY_SSH_KEY')]) {
-						sh "./gradlew deployDocs -PdeployDocsSshKeyPath=$DEPLOY_SSH_KEY -PdeployDocsSshUsername=$SPRING_DOCS_USERNAME --refresh-dependencies --no-daemon --stacktrace"
+						withEnv(["JAVA_HOME=${ tool 'jdk8' }"]) {
+							sh "./gradlew deployDocs -PdeployDocsSshKeyPath=$DEPLOY_SSH_KEY -PdeployDocsSshUsername=$SPRING_DOCS_USERNAME --refresh-dependencies --no-daemon --stacktrace"
+						}
 					}
 				}
 			}
@@ -76,7 +84,9 @@ try {
 				node {
 					checkout scm
 					withCredentials([file(credentialsId: 'docs.spring.io-jenkins_private_ssh_key', variable: 'DEPLOY_SSH_KEY')]) {
-						sh "./gradlew deploySchema -PdeployDocsSshKeyPath=$DEPLOY_SSH_KEY -PdeployDocsSshUsername=$SPRING_DOCS_USERNAME --refresh-dependencies --no-daemon --stacktrace"
+						withEnv(["JAVA_HOME=${ tool 'jdk8' }"]) {
+							sh "./gradlew deploySchema -PdeployDocsSshKeyPath=$DEPLOY_SSH_KEY -PdeployDocsSshUsername=$SPRING_DOCS_USERNAME --refresh-dependencies --no-daemon --stacktrace"
+						}
 					}
 				}
 			}

core/src/main/java/org/springframework/security/core/session/SessionRegistryImpl.java

@@ -132,13 +132,18 @@ public class SessionRegistryImpl implements SessionRegistry,
 		sessionIds.put(sessionId,
 				new SessionInformation(principal, sessionId, new Date()));
 
-		Set<String> sessionsUsedByPrincipal = principals.computeIfAbsent(principal, key -> new CopyOnWriteArraySet<>());
+		principals.compute(principal, (key, sessionsUsedByPrincipal) -> {
-		sessionsUsedByPrincipal.add(sessionId);
+			if (sessionsUsedByPrincipal == null) {
+				sessionsUsedByPrincipal = new CopyOnWriteArraySet<>();
+			}
+			sessionsUsedByPrincipal.add(sessionId);
 
-		if (logger.isTraceEnabled()) {
+			if (logger.isTraceEnabled()) {
-			logger.trace("Sessions used by '" + principal + "' : "
+				logger.trace("Sessions used by '" + principal + "' : "
-					+ sessionsUsedByPrincipal);
+						+ sessionsUsedByPrincipal);
-		}
+			}
+			return sessionsUsedByPrincipal;
+		});
 	}
 
 	public void removeSessionInformation(String sessionId) {
@@ -157,32 +162,29 @@ public class SessionRegistryImpl implements SessionRegistry,
 
 		sessionIds.remove(sessionId);
 
-		Set<String> sessionsUsedByPrincipal = principals.get(info.getPrincipal());
+		principals.computeIfPresent(info.getPrincipal(), (key, sessionsUsedByPrincipal) -> {
-
-		if (sessionsUsedByPrincipal == null) {
-			return;
-		}
-
-		if (logger.isDebugEnabled()) {
-			logger.debug("Removing session " + sessionId
-					+ " from principal's set of registered sessions");
-		}
-
-		sessionsUsedByPrincipal.remove(sessionId);
-
-		if (sessionsUsedByPrincipal.isEmpty()) {
-			// No need to keep object in principals Map anymore
 			if (logger.isDebugEnabled()) {
-				logger.debug("Removing principal " + info.getPrincipal()
+				logger.debug("Removing session " + sessionId
-						+ " from registry");
+						+ " from principal's set of registered sessions");
 			}
-			principals.remove(info.getPrincipal());
-		}
 
-		if (logger.isTraceEnabled()) {
+			sessionsUsedByPrincipal.remove(sessionId);
-			logger.trace("Sessions used by '" + info.getPrincipal() + "' : "
+
-					+ sessionsUsedByPrincipal);
+			if (sessionsUsedByPrincipal.isEmpty()) {
-		}
+				// No need to keep object in principals Map anymore
+				if (logger.isDebugEnabled()) {
+					logger.debug("Removing principal " + info.getPrincipal()
+							+ " from registry");
+				}
+				sessionsUsedByPrincipal = null;
+			}
+
+			if (logger.isTraceEnabled()) {
+				logger.trace("Sessions used by '" + info.getPrincipal() + "' : "
+						+ sessionsUsedByPrincipal);
+			}
+			return sessionsUsedByPrincipal;
+		});
 	}
 
 }

gradle.properties

@@ -1,3 +1,3 @@
-gaeVersion=1.9.68
+gaeVersion=1.9.76
-springBootVersion=2.0.8.RELEASE
+springBootVersion=2.0.9.RELEASE
-version=5.0.12.RELEASE
+version=5.0.14.RELEASE

gradle/dependency-management.gradle

@@ -1,21 +1,21 @@
 dependencyManagement {
 	imports {
 		mavenBom 'io.projectreactor:reactor-bom:Bismuth-SR17'
-		mavenBom 'org.springframework:spring-framework-bom:5.0.13.RELEASE'
+		mavenBom 'org.springframework:spring-framework-bom:5.0.16.RELEASE'
 		mavenBom 'org.springframework.data:spring-data-releasetrain:Kay-SR14'
 	}
 	dependencies {
-		dependency 'cglib:cglib-nodep:3.2.10'
+		dependency 'cglib:cglib-nodep:3.2.12'
-		dependency 'com.squareup.okhttp3:mockwebserver:3.12.2'
+		dependency 'com.squareup.okhttp3:mockwebserver:3.12.8'
 		dependency 'opensymphony:sitemesh:2.4.2'
 		dependency 'org.gebish:geb-spock:0.10.0'
 		dependency 'org.jasig.cas:cas-server-webapp:4.2.7'
-		dependency 'org.powermock:powermock-api-mockito2:2.0.0'
+		dependency 'org.powermock:powermock-api-mockito2:2.0.5'
-		dependency 'org.powermock:powermock-api-support:2.0.0'
+		dependency 'org.powermock:powermock-api-support:2.0.5'
-		dependency 'org.powermock:powermock-core:2.0.0'
+		dependency 'org.powermock:powermock-core:2.0.5'
-		dependency 'org.powermock:powermock-module-junit4-common:2.0.0'
+		dependency 'org.powermock:powermock-module-junit4-common:2.0.5'
-		dependency 'org.powermock:powermock-module-junit4:2.0.0'
+		dependency 'org.powermock:powermock-module-junit4:2.0.5'
-		dependency 'org.powermock:powermock-reflect:2.0.0'
+		dependency 'org.powermock:powermock-reflect:2.0.5'
 		dependency 'org.python:jython:2.5.0'
 		dependency 'org.spockframework:spock-core:1.0-groovy-2.4'
 		dependency 'org.spockframework:spock-spring:1.0-groovy-2.4'
@@ -28,27 +28,27 @@ dependencyManagement {
 		dependency 'asm:asm:3.1'
 		dependency 'ch.qos.logback:logback-classic:1.2.3'
 		dependency 'ch.qos.logback:logback-core:1.2.3'
-		dependency 'com.fasterxml.jackson.core:jackson-annotations:2.9.8'
+		dependency 'com.fasterxml.jackson.core:jackson-annotations:2.9.10'
-		dependency 'com.fasterxml.jackson.core:jackson-core:2.9.8'
+		dependency 'com.fasterxml.jackson.core:jackson-core:2.9.10'
-		dependency 'com.fasterxml.jackson.core:jackson-databind:2.9.8'
+		dependency 'com.fasterxml.jackson.core:jackson-databind:2.9.10.2'
 		dependency 'com.fasterxml:classmate:1.3.4'
 		dependency 'com.github.stephenc.jcip:jcip-annotations:1.0-1'
-		dependency 'com.google.appengine:appengine-api-1.0-sdk:1.9.64'
+		dependency 'com.google.appengine:appengine-api-1.0-sdk:1.9.76'
-		dependency 'com.google.appengine:appengine-api-labs:1.9.64'
+		dependency 'com.google.appengine:appengine-api-labs:1.9.76'
-		dependency 'com.google.appengine:appengine-api-stubs:1.9.64'
+		dependency 'com.google.appengine:appengine-api-stubs:1.9.76'
-		dependency 'com.google.appengine:appengine-testing:1.9.64'
+		dependency 'com.google.appengine:appengine-testing:1.9.76'
-		dependency 'com.google.appengine:appengine:1.9.63'
+		dependency 'com.google.appengine:appengine:1.9.76'
 		dependency 'com.google.code.gson:gson:2.8.2'
 		dependency 'com.google.guava:guava:20.0'
 		dependency 'com.google.inject:guice:3.0'
 		dependency 'com.nimbusds:lang-tag:1.4.3'
 		dependency 'com.nimbusds:nimbus-jose-jwt:5.14'
 		dependency 'com.nimbusds:oauth2-oidc-sdk:5.64.4'
-		dependency 'com.squareup.okhttp3:okhttp:3.12.2'
+		dependency 'com.squareup.okhttp3:okhttp:3.12.8'
 		dependency 'com.squareup.okio:okio:1.13.0'
 		dependency 'com.sun.xml.bind:jaxb-core:2.3.0.1'
 		dependency 'com.sun.xml.bind:jaxb-impl:2.3.0.1'
-		dependency 'com.unboundid:unboundid-ldapsdk:4.0.10'
+		dependency 'com.unboundid:unboundid-ldapsdk:4.0.11'
 		dependency 'com.vaadin.external.google:android-json:0.0.20131108.vaadin1'
 		dependency 'commons-cli:commons-cli:1.4'
 		dependency 'commons-codec:commons-codec:1.12'
@@ -115,7 +115,7 @@ dependencyManagement {
 		dependency 'org.apache.directory.shared:shared-cursor:0.9.15'
 		dependency 'org.apache.directory.shared:shared-ldap-constants:0.9.15'
 		dependency 'org.apache.directory.shared:shared-ldap:0.9.15'
-		dependency 'org.apache.httpcomponents:httpclient:4.5.7'
+		dependency 'org.apache.httpcomponents:httpclient:4.5.11'
 		dependency 'org.apache.httpcomponents:httpcore:4.4.8'
 		dependency 'org.apache.httpcomponents:httpmime:4.5.3'
 		dependency 'org.apache.mina:mina-core:2.0.0-M6'
@@ -128,13 +128,13 @@ dependencyManagement {
 		dependency 'org.apache.tomcat.embed:tomcat-embed-logging-log4j:8.0.44'
 		dependency 'org.apache.tomcat.embed:tomcat-embed-websocket:8.5.23'
 		dependency 'org.apache.tomcat:tomcat-annotations-api:8.5.23'
-		dependency 'org.aspectj:aspectjrt:1.9.2'
+		dependency 'org.aspectj:aspectjrt:1.9.5'
-		dependency 'org.aspectj:aspectjtools:1.9.2'
+		dependency 'org.aspectj:aspectjtools:1.9.5'
-		dependency 'org.aspectj:aspectjweaver:1.9.2'
+		dependency 'org.aspectj:aspectjweaver:1.9.5'
 		dependency 'org.assertj:assertj-core:3.11.1'
 		dependency 'org.attoparser:attoparser:2.0.4.RELEASE'
-		dependency 'org.bouncycastle:bcpkix-jdk15on:1.61'
+		dependency 'org.bouncycastle:bcpkix-jdk15on:1.64'
-		dependency 'org.bouncycastle:bcprov-jdk15on:1.61'
+		dependency 'org.bouncycastle:bcprov-jdk15on:1.64'
 		dependency 'org.codehaus.groovy:groovy-all:2.4.14'
 		dependency 'org.codehaus.groovy:groovy-json:2.4.14'
 		dependency 'org.codehaus.groovy:groovy:2.4.14'
@@ -160,7 +160,7 @@ dependencyManagement {
 		dependency 'org.hibernate.javax.persistence:hibernate-jpa-2.1-api:1.0.0.Final'
 		dependency 'org.hibernate:hibernate-core:5.2.17.Final'
 		dependency 'org.hibernate:hibernate-entitymanager:5.2.18.Final'
-		dependency 'org.hibernate:hibernate-validator:6.0.16.Final'
+		dependency 'org.hibernate:hibernate-validator:6.0.18.Final'
 		dependency 'org.hsqldb:hsqldb:2.4.1'
 		dependency 'org.jasig.cas.client:cas-client-core:3.5.1'
 		dependency 'org.javassist:javassist:3.22.0-CR2'
@@ -177,11 +177,11 @@ dependencyManagement {
 		dependency 'org.seleniumhq.selenium:selenium-java:3.141.59'
 		dependency 'org.seleniumhq.selenium:selenium-support:3.141.59'
 		dependency 'org.skyscreamer:jsonassert:1.5.0'
-		dependency 'org.slf4j:jcl-over-slf4j:1.7.26'
+		dependency 'org.slf4j:jcl-over-slf4j:1.7.30'
-		dependency 'org.slf4j:jul-to-slf4j:1.7.26'
+		dependency 'org.slf4j:jul-to-slf4j:1.7.30'
-		dependency 'org.slf4j:log4j-over-slf4j:1.7.26'
+		dependency 'org.slf4j:log4j-over-slf4j:1.7.30'
-		dependency 'org.slf4j:slf4j-api:1.7.26'
+		dependency 'org.slf4j:slf4j-api:1.7.30'
-		dependency 'org.slf4j:slf4j-nop:1.7.26'
+		dependency 'org.slf4j:slf4j-nop:1.7.30'
 		dependency 'org.sonatype.sisu.inject:cglib:2.2.1-v20090111'
 		dependency 'org.springframework.ldap:spring-ldap-core:2.3.2.RELEASE'
 		dependency 'org.thymeleaf:thymeleaf-spring5:3.0.11.RELEASE'

ldap/src/integration-test/java/org/springframework/security/ldap/server/UnboundIdContainerLdifTests.java

@@ -0,0 +1,144 @@
+/*
+ * Copyright 2002-2020 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.springframework.security.ldap.server;
+
+import org.junit.After;
+import org.junit.Test;
+import org.springframework.context.annotation.AnnotationConfigApplicationContext;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.ldap.core.ContextSource;
+import org.springframework.security.ldap.DefaultSpringSecurityContextSource;
+import org.springframework.security.ldap.SpringSecurityLdapTemplate;
+
+import javax.annotation.PreDestroy;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assertions.failBecauseExceptionWasNotThrown;
+
+/**
+ * Tests for {@link UnboundIdContainer}, specifically relating to LDIF file detection.
+ *
+ * @author Eleftheria Stein
+ */
+public class UnboundIdContainerLdifTests {
+
+	AnnotationConfigApplicationContext appCtx;
+
+	@After
+	public void closeAppContext() {
+		if (appCtx != null) {
+			appCtx.close();
+			appCtx = null;
+		}
+	}
+
+	@Test
+	public void unboundIdContainerWhenCustomLdifNameThenLdifLoaded() {
+		appCtx = new AnnotationConfigApplicationContext(CustomLdifConfig.class);
+
+		DefaultSpringSecurityContextSource contextSource = (DefaultSpringSecurityContextSource) appCtx
+				.getBean(ContextSource.class);
+
+		SpringSecurityLdapTemplate template = new SpringSecurityLdapTemplate(contextSource);
+		assertThat(template.compare("uid=bob,ou=people", "uid", "bob")).isTrue();
+	}
+
+	@Configuration
+	static class CustomLdifConfig {
+		private UnboundIdContainer container = new UnboundIdContainer("dc=springframework,dc=org",
+				"classpath:test-server.ldif");
+
+		@Bean
+		UnboundIdContainer ldapContainer() {
+			this.container.setPort(0);
+			return this.container;
+		}
+
+		@Bean
+		ContextSource contextSource(UnboundIdContainer container) {
+			return new DefaultSpringSecurityContextSource("ldap://127.0.0.1:"
+					+ container.getPort() + "/dc=springframework,dc=org");
+		}
+
+		@PreDestroy
+		void shutdown() {
+			this.container.stop();
+		}
+	}
+
+	@Test
+	public void unboundIdContainerWhenWildcardLdifNameThenLdifLoaded() {
+		appCtx = new AnnotationConfigApplicationContext(WildcardLdifConfig.class);
+
+		DefaultSpringSecurityContextSource contextSource = (DefaultSpringSecurityContextSource) appCtx
+				.getBean(ContextSource.class);
+
+		SpringSecurityLdapTemplate template = new SpringSecurityLdapTemplate(contextSource);
+		assertThat(template.compare("uid=bob,ou=people", "uid", "bob")).isTrue();
+	}
+
+	@Configuration
+	static class WildcardLdifConfig {
+		private UnboundIdContainer container = new UnboundIdContainer("dc=springframework,dc=org",
+				"classpath*:test-server.ldif");
+
+		@Bean
+		UnboundIdContainer ldapContainer() {
+			this.container.setPort(0);
+			return this.container;
+		}
+
+		@Bean
+		ContextSource contextSource(UnboundIdContainer container) {
+			return new DefaultSpringSecurityContextSource("ldap://127.0.0.1:"
+					+ container.getPort() + "/dc=springframework,dc=org");
+		}
+
+		@PreDestroy
+		void shutdown() {
+			this.container.stop();
+		}
+	}
+
+	@Test
+	public void unboundIdContainerWhenMalformedLdifThenException() {
+		try {
+			appCtx = new AnnotationConfigApplicationContext(MalformedLdifConfig.class);
+			failBecauseExceptionWasNotThrown(IllegalStateException.class);
+		} catch (Exception e) {
+			assertThat(e.getCause()).isInstanceOf(IllegalStateException.class);
+			assertThat(e.getMessage()).contains("Unable to load LDIF classpath:test-server-malformed.txt");
+		}
+	}
+
+	@Configuration
+	static class MalformedLdifConfig {
+		private UnboundIdContainer container = new UnboundIdContainer("dc=springframework,dc=org",
+				"classpath:test-server-malformed.txt");
+
+		@Bean
+		UnboundIdContainer ldapContainer() {
+			this.container.setPort(0);
+			return this.container;
+		}
+
+		@PreDestroy
+		void shutdown() {
+			this.container.stop();
+		}
+	}
+}

ldap/src/integration-test/resources/test-server-malformed.txt

@@ -0,0 +1,9 @@
+dn: ou=groups,dc=springframework,dc=org
+objectclass: top
+objectclass: organizationalUnit
+ou: groups
+
+dn ou=subgroups,ou=groups,dc=springframework,dc=org
+objectclass: top
+objectclass: organizationalUnit
+ou: subgroups

ldap/src/main/java/org/springframework/security/ldap/server/UnboundIdContainer.java

@@ -114,10 +114,10 @@ public class UnboundIdContainer implements InitializingBean, DisposableBean, Lif
 
 	private void importLdif(InMemoryDirectoryServer directoryServer) {
 		if (StringUtils.hasText(this.ldif)) {
-			Resource resource = this.context.getResource(this.ldif);
 			try {
-				if (resource.exists()) {
+				Resource[] resources = this.context.getResources(this.ldif);
-					try (InputStream inputStream = resource.getInputStream()) {
+				if (resources.length > 0 && resources[0].exists()) {
+					try (InputStream inputStream = resources[0].getInputStream()) {
 						directoryServer.importFromLDIF(false, new LDIFReader(inputStream));
 					}
 				}

scripts/release/wait-for-done

@@ -0,0 +1,4 @@
+#!/bin/bash
+
+VERSION=$1
+until http -h --check-status --ignore-stdin https://repo1.maven.org/maven2/org/springframework/security/spring-security-core/$VERSION/; do sleep 10; clear; done; spd-say "It is now uploaded"

web/src/main/java/org/springframework/security/web/server/header/CompositeServerHttpHeadersWriter.java

@@ -15,14 +15,12 @@
  */
 package  org.springframework.security.web.server.header;
 
+import org.springframework.web.server.ServerWebExchange;
+import reactor.core.publisher.Flux;
+import reactor.core.publisher.Mono;
+
 import java.util.Arrays;
 import java.util.List;
-import java.util.stream.Collectors;
-import java.util.stream.Stream;
-
-import org.springframework.web.server.ServerWebExchange;
-
-import reactor.core.publisher.Mono;
 
 /**
  * Combines multiple {@link ServerHttpHeadersWriter} instances into a single instance.
@@ -43,8 +41,9 @@ public class CompositeServerHttpHeadersWriter implements ServerHttpHeadersWriter
 
 	@Override
 	public Mono<Void> writeHttpHeaders(ServerWebExchange exchange) {
-		Stream<Mono<Void>> results = writers.stream().map( writer -> writer.writeHttpHeaders(exchange));
+		return Flux.fromIterable(this.writers)
-		return Mono.when(results.collect(Collectors.toList()));
+				.concatMap(w -> w.writeHttpHeaders(exchange))
+				.then();
 	}
 
 }

web/src/test/java/org/springframework/security/web/server/header/CompositeServerHttpHeadersWriterTests.java

@@ -15,11 +15,6 @@
  */
 package org.springframework.security.web.server.header;
 
-import static org.mockito.Mockito.verify;
-import static org.mockito.Mockito.when;
-
-import java.util.Arrays;
-
 import org.junit.Before;
 import org.junit.Test;
 import org.junit.runner.RunWith;
@@ -28,10 +23,19 @@ import org.mockito.junit.MockitoJUnitRunner;
 import org.springframework.mock.http.server.reactive.MockServerHttpRequest;
 import org.springframework.mock.web.server.MockServerWebExchange;
 import org.springframework.web.server.ServerWebExchange;
-
 import reactor.core.publisher.Mono;
 import reactor.test.StepVerifier;
 
+import java.time.Duration;
+import java.util.Arrays;
+import java.util.concurrent.CountDownLatch;
+import java.util.concurrent.TimeUnit;
+import java.util.concurrent.atomic.AtomicBoolean;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
 /**
  *
  * @author Rob Winch
@@ -55,7 +59,6 @@ public class CompositeServerHttpHeadersWriterTests {
 	@Test
 	public void writeHttpHeadersWhenErrorNoErrorThenError() {
 		when(writer1.writeHttpHeaders(exchange)).thenReturn(Mono.error(new RuntimeException()));
-		when(writer2.writeHttpHeaders(exchange)).thenReturn(Mono.empty());
 
 		Mono<Void> result = writer.writeHttpHeaders(exchange);
 
@@ -64,13 +67,11 @@ public class CompositeServerHttpHeadersWriterTests {
 			.verify();
 
 		verify(writer1).writeHttpHeaders(exchange);
-		verify(writer2).writeHttpHeaders(exchange);
 	}
 
 	@Test
 	public void writeHttpHeadersWhenErrorErrorThenError() {
 		when(writer1.writeHttpHeaders(exchange)).thenReturn(Mono.error(new RuntimeException()));
-		when(writer2.writeHttpHeaders(exchange)).thenReturn(Mono.error(new RuntimeException()));
 
 		Mono<Void> result = writer.writeHttpHeaders(exchange);
 
@@ -79,7 +80,6 @@ public class CompositeServerHttpHeadersWriterTests {
 			.verify();
 
 		verify(writer1).writeHttpHeaders(exchange);
-		verify(writer2).writeHttpHeaders(exchange);
 	}
 
 	@Test
@@ -96,4 +96,26 @@ public class CompositeServerHttpHeadersWriterTests {
 		verify(writer1).writeHttpHeaders(exchange);
 		verify(writer2).writeHttpHeaders(exchange);
 	}
+
+	@Test
+	public void writeHttpHeadersSequential() throws Exception {
+		AtomicBoolean slowDone = new AtomicBoolean();
+		CountDownLatch latch = new CountDownLatch(1);
+		ServerHttpHeadersWriter slow = exchange ->
+				Mono.delay(Duration.ofMillis(100))
+						.doOnSuccess(__ -> slowDone.set(true))
+						.then();
+		ServerHttpHeadersWriter second = exchange ->
+				Mono.fromRunnable(() -> {
+					latch.countDown();
+					assertThat(slowDone.get())
+							.describedAs("ServerLogoutHandler should be executed sequentially")
+							.isTrue();
+				});
+		CompositeServerHttpHeadersWriter writer = new CompositeServerHttpHeadersWriter(slow, second);
+
+		writer.writeHttpHeaders(this.exchange).block();
+
+		assertThat(latch.await(3, TimeUnit.SECONDS)).isTrue();
+	}
 }