Examples with MissingCsrfTokenException org.springframework.security.web.csrf.MissingCsrfTokenException used on opensource projects

Example 1 with MissingCsrfTokenException

use of org.springframework.security.web.csrf.MissingCsrfTokenException in project spring-security by spring-projects.

the class CsrfChannelInterceptor method preSend.

@Override
public Message<?> preSend(Message<?> message, MessageChannel channel) {
    if (!this.matcher.matches(message)) {
        return message;
    }
    Map<String, Object> sessionAttributes = SimpMessageHeaderAccessor.getSessionAttributes(message.getHeaders());
    CsrfToken expectedToken = (sessionAttributes != null) ? (CsrfToken) sessionAttributes.get(CsrfToken.class.getName()) : null;
    if (expectedToken == null) {
        throw new MissingCsrfTokenException(null);
    }
    String actualTokenValue = SimpMessageHeaderAccessor.wrap(message).getFirstNativeHeader(expectedToken.getHeaderName());
    boolean csrfCheckPassed = expectedToken.getToken().equals(actualTokenValue);
    if (!csrfCheckPassed) {
        throw new InvalidCsrfTokenException(expectedToken, actualTokenValue);
    }
    return message;
}

Example 2 with MissingCsrfTokenException

use of org.springframework.security.web.csrf.MissingCsrfTokenException in project spring-security by spring-projects.

the class DelegatingAccessDeniedHandlerTests method matchesDoesNotInvokeDefault.

@Test
public void matchesDoesNotInvokeDefault() throws Exception {
    this.handlers.put(InvalidCsrfTokenException.class, this.handler1);
    this.handlers.put(MissingCsrfTokenException.class, this.handler2);
    this.handler = new DelegatingAccessDeniedHandler(this.handlers, this.handler3);
    AccessDeniedException accessDeniedException = new MissingCsrfTokenException("123");
    this.handler.handle(this.request, this.response, accessDeniedException);
    verify(this.handler1, never()).handle(any(HttpServletRequest.class), any(HttpServletResponse.class), any(AccessDeniedException.class));
    verify(this.handler2).handle(this.request, this.response, accessDeniedException);
    verify(this.handler3, never()).handle(any(HttpServletRequest.class), any(HttpServletResponse.class), any(AccessDeniedException.class));
}