浏览代码

SEC-2832: Update request attributes with new CsrfToken

Stillglade 10 年之前
父节点
当前提交
aa0a5b96ab

+ 3 - 1
web/src/main/java/org/springframework/security/web/csrf/CsrfAuthenticationStrategy.java

@@ -56,6 +56,8 @@ public final class CsrfAuthenticationStrategy implements
             CsrfToken newToken = this.csrfTokenRepository.generateToken(request);
             this.csrfTokenRepository.saveToken(null, request, response);
             this.csrfTokenRepository.saveToken(newToken, request, response);
+            request.setAttribute(CsrfToken.class.getName(), newToken);
+            request.setAttribute(newToken.getParameterName(), newToken);
         }
     }
-}
+}