2
0
Эх сурвалжийг харах

Fix CsrfWebFilter error message when expected CSRF not found

Closes gh-9337
Rob Winch 4 жил өмнө
parent
commit
a1083d9a5c

+ 1 - 1
web/src/main/java/org/springframework/security/web/server/csrf/CsrfWebFilter.java

@@ -132,7 +132,7 @@ public class CsrfWebFilter implements WebFilter {
 	private Mono<Void> validateToken(ServerWebExchange exchange) {
 	private Mono<Void> validateToken(ServerWebExchange exchange) {
 		return this.csrfTokenRepository.loadToken(exchange)
 		return this.csrfTokenRepository.loadToken(exchange)
 				.switchIfEmpty(Mono
 				.switchIfEmpty(Mono
-						.defer(() -> Mono.error(new CsrfException("CSRF Token has been associated to this client"))))
+						.defer(() -> Mono.error(new CsrfException("An expected CSRF token cannot be found"))))
 				.filterWhen((expected) -> containsValidCsrfToken(exchange, expected))
 				.filterWhen((expected) -> containsValidCsrfToken(exchange, expected))
 				.switchIfEmpty(Mono.defer(() -> Mono.error(new CsrfException("Invalid CSRF Token")))).then();
 				.switchIfEmpty(Mono.defer(() -> Mono.error(new CsrfException("Invalid CSRF Token")))).then();
 	}
 	}

+ 3 - 1
web/src/test/java/org/springframework/security/web/server/csrf/CsrfWebFilterTests.java

@@ -64,7 +64,7 @@ public class CsrfWebFilterTests {
 
 
 	private MockServerWebExchange get = MockServerWebExchange.from(MockServerHttpRequest.get("/"));
 	private MockServerWebExchange get = MockServerWebExchange.from(MockServerHttpRequest.get("/"));
 
 
-	private ServerWebExchange post = MockServerWebExchange.from(MockServerHttpRequest.post("/"));
+	private MockServerWebExchange post = MockServerWebExchange.from(MockServerHttpRequest.post("/"));
 
 
 	@Test
 	@Test
 	public void filterWhenGetThenSessionNotCreatedAndChainContinues() {
 	public void filterWhenGetThenSessionNotCreatedAndChainContinues() {
@@ -91,6 +91,8 @@ public class CsrfWebFilterTests {
 		Mono<Void> result = this.csrfFilter.filter(this.post, this.chain);
 		Mono<Void> result = this.csrfFilter.filter(this.post, this.chain);
 		StepVerifier.create(result).verifyComplete();
 		StepVerifier.create(result).verifyComplete();
 		assertThat(this.post.getResponse().getStatusCode()).isEqualTo(HttpStatus.FORBIDDEN);
 		assertThat(this.post.getResponse().getStatusCode()).isEqualTo(HttpStatus.FORBIDDEN);
+		StepVerifier.create(this.post.getResponse().getBodyAsString())
+				.assertNext(b -> assertThat(b).contains("An expected CSRF token cannot be found"));
 	}
 	}
 
 
 	@Test
 	@Test