[java-identity-provider] branch maint-5.1 updated: IDP-2339 - CSRF failure from Edge on iOS
Phil Smart
philip.smart at jisc.ac.uk
Tue Mar 18 16:42:57 UTC 2025
This is an automated email from the git hooks/post-receive script.
philsmart pushed a commit to branch maint-5.1
in repository java-identity-provider.
View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=c96cd193e30b2386f3f58bdab8cbd9333d41bdcd
The following commit(s) were added to refs/heads/maint-5.1 by this push:
new c96cd193e IDP-2339 - CSRF failure from Edge on iOS
c96cd193e is described below
commit c96cd193e30b2386f3f58bdab8cbd9333d41bdcd
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Thu Mar 13 19:28:13 2025 +0000
IDP-2339 - CSRF failure from Edge on iOS
- Add optional per flow token creation
- Add property (idp.csrf.token.perFlow) to enable/disable per flow token
creation. Defaults to disabled to retain existing behaviour.
https://shibboleth.atlassian.net/browse/IDP-2339
---
.../net/shibboleth/idp/conf/webflow-config.xml | 1 +
.../net/shibboleth/idp/module/conf/idp.properties | 4 +-
.../net/shibboleth/idp/module/conf/idp.properties | 6 +-
.../csrf/impl/CSRFTokenFlowExecutionListener.java | 61 ++++-
.../impl/CSRFTokenFlowExecutionListenerTest.java | 252 +++++++++++++--------
5 files changed, 216 insertions(+), 108 deletions(-)
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/webflow-config.xml b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/webflow-config.xml
index 925ddd429..912c6530f 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/webflow-config.xml
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/conf/webflow-config.xml
@@ -213,6 +213,7 @@
<bean id="csrfTokenFlowExecutionListener" init-method="initialize" destroy-method="destroy"
class="net.shibboleth.idp.ui.csrf.impl.CSRFTokenFlowExecutionListener" p:csrfTokenManager-ref="shibboleth.CSRFTokenManager"
p:enabled="%{idp.csrf.enabled:false}"
+ p:tokenPerFlow="%{idp.csrf.token.perFlow:false}"
p:viewRequiresCSRFTokenPredicate-ref="shibboleth.DefaultViewRequiresCSRFTokenPredicate"
p:eventRequiresCSRFTokenValidationPredicate-ref="shibboleth.DefaultEventRequiresCSRFTokenValidationPredicate"/>
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/idp.properties b/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/idp.properties
index a01684ae5..834390abd 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/idp.properties
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/conf/idp.properties
@@ -36,8 +36,10 @@ idp.scope = example.org
#idp.cookie.sameSite = None
#idp.cookie.sameSiteCondition = shibboleth.Conditions.FALSE
-# Enable cross-site request forgery mitigation for views.
+# Enable cross-site request forgery (CSRF) mitigation for views.
idp.csrf.enabled = true
+# Enable a new CSRF token per-flow. Otherwise, it is generated per-view.
+#idp.csrf.token.perFlow = false
# Name of the HTTP parameter that stores the CSRF token.
#idp.csrf.token.parameter = csrf_token
diff --git a/idp-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/idp.properties b/idp-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/idp.properties
index 017aebe4b..fb1be0cf3 100644
--- a/idp-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/idp.properties
+++ b/idp-conf-impl/src/test/resources/net/shibboleth/idp/module/conf/idp.properties
@@ -31,8 +31,10 @@ idp.scope = example.org
#idp.cookie.sameSite = None
#idp.cookie.sameSiteCondition = shibboleth.Conditions.FALSE
-# Enable cross-site request forgery mitigation for views.
+# Enable cross-site request forgery (CSRF) mitigation for views.
idp.csrf.enabled = true
+# Enable a new CSRF token per-flow. Otherwise, it is generated per-view.
+#idp.csrf.token.perFlow = false
# Name of the HTTP parameter that stores the CSRF token.
#idp.csrf.token.parameter = csrf_token
@@ -220,4 +222,4 @@ idp.ui.fallbackLanguages=en,fr,de
#idp.fticks.logport = 514
# Set false if you want SAML bindings "spelled out" in audit log
-idp.audit.shortenBindings = true
\ No newline at end of file
+idp.audit.shortenBindings = true
diff --git a/idp-ui/src/main/java/net/shibboleth/idp/ui/csrf/impl/CSRFTokenFlowExecutionListener.java b/idp-ui/src/main/java/net/shibboleth/idp/ui/csrf/impl/CSRFTokenFlowExecutionListener.java
index d8413e281..d774ecaa9 100644
--- a/idp-ui/src/main/java/net/shibboleth/idp/ui/csrf/impl/CSRFTokenFlowExecutionListener.java
+++ b/idp-ui/src/main/java/net/shibboleth/idp/ui/csrf/impl/CSRFTokenFlowExecutionListener.java
@@ -21,10 +21,11 @@ import javax.annotation.Nonnull;
import javax.annotation.Nullable;
import org.slf4j.Logger;
-import net.shibboleth.shared.primitive.LoggerFactory;
+import org.springframework.webflow.core.collection.MutableAttributeMap;
import org.springframework.webflow.definition.StateDefinition;
import org.springframework.webflow.execution.Event;
import org.springframework.webflow.execution.FlowExecutionListener;
+import org.springframework.webflow.execution.FlowSession;
import org.springframework.webflow.execution.RequestContext;
import org.springframework.webflow.execution.View;
@@ -35,31 +36,38 @@ import net.shibboleth.shared.annotation.constraint.NonnullAfterInit;
import net.shibboleth.shared.component.AbstractInitializableComponent;
import net.shibboleth.shared.component.ComponentInitializationException;
import net.shibboleth.shared.logic.Constraint;
+import net.shibboleth.shared.primitive.LoggerFactory;
/**
* A flow execution lifecycle listener that, if enabled:
- * <ul>
- * <li>Sets an anti-CSRF token into the view-scope map on rendering of a suitable view-state</li>
+ * <ol>
+ * <li>Sets an anti-CSRF token into the flow-scope map when a flow session starts and a token per-flow is
+ * enabled.</li>
+ * <li>Sets an anti-CSRF token into the view-scope map when rendering a suitable view-state. This token is
+ * either retrieved from the flow-scope, if available from step 1, or generated anew.</li>
* <li>Checks the CSRF token in a HTTP request matches that stored in the view-scope map when a suitable
* view-state event occurs.</li>
- * </ul>
+ * </ol>
*/
public class CSRFTokenFlowExecutionListener extends AbstractInitializableComponent implements FlowExecutionListener {
/** The name of the view scope parameter that holds the CSRF token. */
@Nonnull public static final String CSRF_TOKEN_VIEWSCOPE_NAME = "csrfToken";
-
+
/** Class logger. */
@Nonnull private final Logger log = LoggerFactory.getLogger(CSRFTokenFlowExecutionListener.class);
/** Should the request context and event be checked for a valid (matching) CSRF token? */
@NonnullAfterInit private BiPredicate<RequestContext,Event> eventRequiresCSRFTokenValidationPredicate;
-
+
/** Does the view being rendered require a CSRF token to be set.*/
@NonnullAfterInit private Predicate<RequestContext> viewRequiresCSRFTokenPredicate;
-
+
/** Is this listener enabled? */
private boolean enabled;
+
+ /** Should a new token should be created for each flow session and not for each view? */
+ private boolean tokenPerFlow;
/** The CSRF token manager for getting and validating tokens. */
@NonnullAfterInit private CSRFTokenManager csrfTokenManager;
@@ -68,6 +76,7 @@ public class CSRFTokenFlowExecutionListener extends AbstractInitializableCompone
/** Constructor. */
public CSRFTokenFlowExecutionListener() {
enabled = false;
+ tokenPerFlow = false;
}
/**
@@ -80,6 +89,16 @@ public class CSRFTokenFlowExecutionListener extends AbstractInitializableCompone
enabled = enable;
}
+ /**
+ * Sets whether a new token should be created for each flow session and not for each view.
+ *
+ * @param flag enable or disable the token per flow pattern
+ */
+ public void setTokenPerFlow(final boolean flag) {
+ checkSetterPreconditions();
+ tokenPerFlow = flag;
+ }
+
/**
* Sets the request context condition to determine if a CSRF token should be added to the view-scope.
*
@@ -102,7 +121,6 @@ public class CSRFTokenFlowExecutionListener extends AbstractInitializableCompone
eventRequiresCSRFTokenValidationPredicate = Constraint.isNotNull(condition,
"Validate CSRF token condition cannot be null");
}
-
/**
* Sets the CSRF token manager.
@@ -113,8 +131,22 @@ public class CSRFTokenFlowExecutionListener extends AbstractInitializableCompone
checkSetterPreconditions();
csrfTokenManager = Constraint.isNotNull(tokenManager, "CSRF Token manager can not be null");
}
+
+ /**
+ * {@inheritDoc}
+ *
+ * <p>If per flow-session tokens are enabled, creates a CSRF token and adds it to the request context flow scope
+ * for extraction into the view scope later on.</p>
+ */
+ @Override
+ public void sessionStarting(final RequestContext context, final FlowSession session,
+ final MutableAttributeMap<?> input) {
-
+ if (enabled && tokenPerFlow) {
+ context.getFlowScope().put(CSRF_TOKEN_VIEWSCOPE_NAME, csrfTokenManager.generateCSRFToken());
+ }
+ }
+
/**
* Generates a CSRF token and adds it to the request context view scope, overwriting any existing token.
*
@@ -126,9 +158,13 @@ public class CSRFTokenFlowExecutionListener extends AbstractInitializableCompone
//state here should always be a view-state, but guard anyway.
if (enabled && viewState.isViewState() && viewRequiresCSRFTokenPredicate.test(context)) {
- context.getViewScope().put(CSRF_TOKEN_VIEWSCOPE_NAME, csrfTokenManager.generateCSRFToken());
+ final Object flowScopedCsrfTokenObject = context.getFlowScope().get(CSRF_TOKEN_VIEWSCOPE_NAME);
+ if (flowScopedCsrfTokenObject instanceof final CSRFToken token) {
+ context.getViewScope().put(CSRF_TOKEN_VIEWSCOPE_NAME, token);
+ } else {
+ context.getViewScope().put(CSRF_TOKEN_VIEWSCOPE_NAME, csrfTokenManager.generateCSRFToken());
+ }
}
-
}
/**
@@ -192,6 +228,7 @@ public class CSRFTokenFlowExecutionListener extends AbstractInitializableCompone
/** {@inheritDoc} */
+ @Override
public void doInitialize() throws ComponentInitializationException {
super.doInitialize();
@@ -208,4 +245,4 @@ public class CSRFTokenFlowExecutionListener extends AbstractInitializableCompone
}
-}
\ No newline at end of file
+}
diff --git a/idp-ui/src/test/java/net/shibboleth/idp/ui/csrf/impl/CSRFTokenFlowExecutionListenerTest.java b/idp-ui/src/test/java/net/shibboleth/idp/ui/csrf/impl/CSRFTokenFlowExecutionListenerTest.java
index 95f785306..fe29fd7f5 100644
--- a/idp-ui/src/test/java/net/shibboleth/idp/ui/csrf/impl/CSRFTokenFlowExecutionListenerTest.java
+++ b/idp-ui/src/test/java/net/shibboleth/idp/ui/csrf/impl/CSRFTokenFlowExecutionListenerTest.java
@@ -58,7 +58,7 @@ public class CSRFTokenFlowExecutionListenerTest extends BaseCSRFTest{
@BeforeMethod public void setup() throws ComponentInitializationException {
- CSRFTokenManager manager = new CSRFTokenManager();
+ final CSRFTokenManager manager = new CSRFTokenManager();
manager.setCsrfParameterName(CSRF_PARAM_NAME);
manager.initialize();
listener = new CSRFTokenFlowExecutionListener();
@@ -66,6 +66,7 @@ public class CSRFTokenFlowExecutionListenerTest extends BaseCSRFTest{
listener.setEnabled(true);
listener.setViewRequiresCSRFTokenPredicate(new DefaultViewRequiresCSRFTokenPredicate());
listener.setEventRequiresCSRFTokenValidationPredicate(new DefaultEventRequiresCSRFTokenValidationPredicate());
+ listener.setTokenPerFlow(false);
//specifically do not init here, so things can be changed, test init later on.
//listener.initialize();
}
@@ -78,20 +79,82 @@ public class CSRFTokenFlowExecutionListenerTest extends BaseCSRFTest{
@Test public void testAddingCsrfTokenToViewScopeOnRendering() throws ComponentInitializationException {
listener.initialize();
- MockFlowSession flowSession = new MockFlowSession();
- MockViewState currentState = new MockViewState("testFlow", "a-view-state");
+ final MockFlowSession flowSession = new MockFlowSession();
+ final MockViewState currentState = new MockViewState("testFlow", "a-view-state");
flowSession.setState(currentState);
- MockFlowExecutionContext context = new MockFlowExecutionContext(flowSession);
- MockRequestContext src = new MockRequestContext(context);
+ final MockFlowExecutionContext context = new MockFlowExecutionContext(flowSession);
+ final MockRequestContext src = new MockRequestContext(context);
listener.viewRendering(src, new MockView("login",src), currentState);
- Object csrfTokenValueObject = src.getViewScope().get(CSRFTokenFlowExecutionListener.CSRF_TOKEN_VIEWSCOPE_NAME);
+ final Object csrfTokenValueObject = src.getViewScope().get(CSRFTokenFlowExecutionListener.CSRF_TOKEN_VIEWSCOPE_NAME);
Assert.assertNotNull(csrfTokenValueObject);
Assert.assertTrue(csrfTokenValueObject instanceof CSRFToken);
Assert.assertFalse(((CSRFToken) csrfTokenValueObject).getToken().isEmpty());
}
+ @Test public void testAddingCsrfTokenToViewScopeOnRendering_NewTokenOnEachRequest()
+ throws ComponentInitializationException {
+
+ listener.initialize();
+ final MockFlowSession flowSession = new MockFlowSession();
+ final MockViewState currentState = new MockViewState("testFlow", "a-view-state");
+ flowSession.setState(currentState);
+ final MockFlowExecutionContext context = new MockFlowExecutionContext(flowSession);
+ final MockRequestContext src = new MockRequestContext(context);
+
+ listener.viewRendering(src, new MockView("login",src), currentState);
+ final Object csrfTokenValueObject = src.getViewScope().get(CSRFTokenFlowExecutionListener.CSRF_TOKEN_VIEWSCOPE_NAME);
+ Assert.assertNotNull(csrfTokenValueObject);
+ Assert.assertTrue(csrfTokenValueObject instanceof CSRFToken);
+ Assert.assertFalse(((CSRFToken) csrfTokenValueObject).getToken().isEmpty());
+
+ listener.viewRendering(src, new MockView("login",src), currentState);
+ final Object csrfTokenValueObjectSecond =
+ src.getViewScope().get(CSRFTokenFlowExecutionListener.CSRF_TOKEN_VIEWSCOPE_NAME);
+
+ Assert.assertNotNull(csrfTokenValueObjectSecond);
+ Assert.assertTrue(csrfTokenValueObjectSecond instanceof CSRFToken);
+ Assert.assertFalse(((CSRFToken) csrfTokenValueObjectSecond).getToken().isEmpty());
+
+ Assert.assertNotEquals(((CSRFToken)csrfTokenValueObject).getToken(),
+ ((CSRFToken)csrfTokenValueObjectSecond).getToken());
+
+ }
+
+ @Test public void testAddingCsrfTokenToFlowScope_SameTokenForEachRequest()
+ throws ComponentInitializationException {
+ listener.setTokenPerFlow(true);
+ listener.initialize();
+ final MockFlowSession flowSession = new MockFlowSession();
+ final MockViewState currentState = new MockViewState("testFlow", "a-view-state");
+ flowSession.setState(currentState);
+ final MockFlowExecutionContext context = new MockFlowExecutionContext(flowSession);
+ final MockRequestContext src = new MockRequestContext(context);
+
+ listener.sessionStarting(src, flowSession, null);
+
+ listener.viewRendering(src, new MockView("login",src), currentState);
+ final Object csrfTokenValueObject =
+ src.getViewScope().get(CSRFTokenFlowExecutionListener.CSRF_TOKEN_VIEWSCOPE_NAME);
+ Assert.assertNotNull(csrfTokenValueObject);
+ Assert.assertTrue(csrfTokenValueObject instanceof CSRFToken);
+ Assert.assertFalse(((CSRFToken) csrfTokenValueObject).getToken().isEmpty());
+
+ // Now try the listener again, it should give the same token value
+ listener.viewRendering(src, new MockView("login",src), currentState);
+ final Object csrfTokenValueObjectSecond =
+ src.getViewScope().get(CSRFTokenFlowExecutionListener.CSRF_TOKEN_VIEWSCOPE_NAME);
+
+ Assert.assertNotNull(csrfTokenValueObjectSecond);
+ Assert.assertTrue(csrfTokenValueObjectSecond instanceof CSRFToken);
+ Assert.assertFalse(((CSRFToken) csrfTokenValueObjectSecond).getToken().isEmpty());
+
+ Assert.assertEquals(((CSRFToken)csrfTokenValueObject).getToken(),
+ ((CSRFToken)csrfTokenValueObjectSecond).getToken());
+
+ }
+
/**
* Test the listener throws an {@link InvalidCSRFTokenException} if the viewScope and request token do not match.
* View is not excluded.
@@ -101,23 +164,23 @@ public class CSRFTokenFlowExecutionListenerTest extends BaseCSRFTest{
@Test(expectedExceptions=InvalidCSRFTokenException.class) public void testInvalidToken() throws ComponentInitializationException {
listener.initialize();
- MockFlowSession flowSession = new MockFlowSession();
- MockViewState currentState = new MockViewState("testFlow", "a-view-state");
+ final MockFlowSession flowSession = new MockFlowSession();
+ final MockViewState currentState = new MockViewState("testFlow", "a-view-state");
flowSession.setState(currentState);
-
+
@SuppressWarnings("null")
+ final
CSRFToken viewScopeToken = new SimpleCSRFToken(UUID.randomUUID().toString(), CSRF_PARAM_NAME);
flowSession.getViewScope().put(CSRFTokenFlowExecutionListener.CSRF_TOKEN_VIEWSCOPE_NAME, viewScopeToken);
-
-
- MockFlowExecutionContext context = new MockFlowExecutionContext(flowSession);
- MockParameterMap map = new MockParameterMap();
+
+ final MockFlowExecutionContext context = new MockFlowExecutionContext(flowSession);
+ final MockParameterMap map = new MockParameterMap();
map.put(CSRF_PARAM_NAME, "will-fail");
- MockExternalContext extContext = new MockExternalContext(map);
- MockRequestContext src = new MockRequestContext(context);
+ final MockExternalContext extContext = new MockExternalContext(map);
+ final MockRequestContext src = new MockRequestContext(context);
src.setExternalContext(extContext);
-
- listener.eventSignaled(src, new Event(this,"proceed"));
+
+ listener.eventSignaled(src, new Event(this,"proceed"));
}
@@ -129,23 +192,24 @@ public class CSRFTokenFlowExecutionListenerTest extends BaseCSRFTest{
@Test public void testValidToken() throws ComponentInitializationException {
listener.initialize();
- MockFlowSession flowSession = new MockFlowSession();
- MockViewState currentState = new MockViewState("testFlow", "a-view-state");
+ final MockFlowSession flowSession = new MockFlowSession();
+ final MockViewState currentState = new MockViewState("testFlow", "a-view-state");
flowSession.setState(currentState);
-
+
@SuppressWarnings("null")
+ final
CSRFToken viewScopeToken = new SimpleCSRFToken(UUID.randomUUID().toString(), CSRF_PARAM_NAME);
flowSession.getViewScope().put(CSRFTokenFlowExecutionListener.CSRF_TOKEN_VIEWSCOPE_NAME, viewScopeToken);
-
-
- MockFlowExecutionContext context = new MockFlowExecutionContext(flowSession);
- MockParameterMap map = new MockParameterMap();
+
+
+ final MockFlowExecutionContext context = new MockFlowExecutionContext(flowSession);
+ final MockParameterMap map = new MockParameterMap();
map.put(CSRF_PARAM_NAME, viewScopeToken.getToken());
- MockExternalContext extContext = new MockExternalContext(map);
- MockRequestContext src = new MockRequestContext(context);
+ final MockExternalContext extContext = new MockExternalContext(map);
+ final MockRequestContext src = new MockRequestContext(context);
src.setExternalContext(extContext);
-
- listener.eventSignaled(src, new Event(this,"proceed"));
+
+ listener.eventSignaled(src, new Event(this,"proceed"));
}
@@ -159,24 +223,24 @@ public class CSRFTokenFlowExecutionListenerTest extends BaseCSRFTest{
@Test public void testViewExcluded() throws ComponentInitializationException {
listener.initialize();
- MockFlowSession flowSession = new MockFlowSession();
- MockViewState currentState = new MockViewState("testFlow", "a-view-state");
+ final MockFlowSession flowSession = new MockFlowSession();
+ final MockViewState currentState = new MockViewState("testFlow", "a-view-state");
currentState.getAttributes().put(BaseCSRFTokenPredicate.CSRF_EXCLUDED_ATTRIBUTE_NAME, true);
flowSession.setState(currentState);
-
+
@SuppressWarnings("null")
+ final
CSRFToken viewScopeToken = new SimpleCSRFToken(UUID.randomUUID().toString(), CSRF_PARAM_NAME);
flowSession.getViewScope().put(CSRFTokenFlowExecutionListener.CSRF_TOKEN_VIEWSCOPE_NAME, viewScopeToken);
-
-
- MockFlowExecutionContext context = new MockFlowExecutionContext(flowSession);
- MockParameterMap map = new MockParameterMap();
+
+ final MockFlowExecutionContext context = new MockFlowExecutionContext(flowSession);
+ final MockParameterMap map = new MockParameterMap();
map.put(CSRF_PARAM_NAME, "would-fail-but-is-excluded");
- MockExternalContext extContext = new MockExternalContext(map);
- MockRequestContext src = new MockRequestContext(context);
- src.setExternalContext(extContext);
-
- listener.eventSignaled(src, new Event(this,"proceed"));
+ final MockExternalContext extContext = new MockExternalContext(map);
+ final MockRequestContext src = new MockRequestContext(context);
+ src.setExternalContext(extContext);
+
+ listener.eventSignaled(src, new Event(this,"proceed"));
}
@@ -188,26 +252,26 @@ public class CSRFTokenFlowExecutionListenerTest extends BaseCSRFTest{
* @throws ComponentInitializationException ...
*/
@Test public void testDisabled() throws ComponentInitializationException {
-
+
//set enabled to false.
listener.setEnabled(false);
listener.initialize();
- MockFlowSession flowSession = new MockFlowSession();
- MockViewState currentState = new MockViewState("testFlow", "a-view-state");
+ final MockFlowSession flowSession = new MockFlowSession();
+ final MockViewState currentState = new MockViewState("testFlow", "a-view-state");
flowSession.setState(currentState);
-
+
@SuppressWarnings("null")
+ final
CSRFToken viewScopeToken = new SimpleCSRFToken(UUID.randomUUID().toString(), CSRF_PARAM_NAME);
flowSession.getViewScope().put(CSRFTokenFlowExecutionListener.CSRF_TOKEN_VIEWSCOPE_NAME, viewScopeToken);
-
-
- MockFlowExecutionContext context = new MockFlowExecutionContext(flowSession);
- MockParameterMap map = new MockParameterMap();
+
+ final MockFlowExecutionContext context = new MockFlowExecutionContext(flowSession);
+ final MockParameterMap map = new MockParameterMap();
map.put(CSRF_PARAM_NAME, "should-fail-but-disabled");
- MockExternalContext extContext = new MockExternalContext(map);
- MockRequestContext src = new MockRequestContext(context);
- src.setExternalContext(extContext);
-
+ final MockExternalContext extContext = new MockExternalContext(map);
+ final MockRequestContext src = new MockRequestContext(context);
+ src.setExternalContext(extContext);
+
listener.eventSignaled(src, new Event(this,"proceed"));
}
@@ -221,11 +285,11 @@ public class CSRFTokenFlowExecutionListenerTest extends BaseCSRFTest{
@Test public void testDoesNotAddTokenToNonViewState() throws ComponentInitializationException {
listener.initialize();
- MockFlowSession flowSession = new MockFlowSession();
- ActionState currentState = new ActionState(new Flow("testFlow"), "action-state");
+ final MockFlowSession flowSession = new MockFlowSession();
+ final ActionState currentState = new ActionState(new Flow("testFlow"), "action-state");
flowSession.setState(currentState);
- MockFlowExecutionContext context = new MockFlowExecutionContext(flowSession);
- MockRequestContext src = new MockRequestContext(context);
+ final MockFlowExecutionContext context = new MockFlowExecutionContext(flowSession);
+ final MockRequestContext src = new MockRequestContext(context);
listener.viewRendering(src, new MockView("login",src), currentState);
}
@@ -240,13 +304,13 @@ public class CSRFTokenFlowExecutionListenerTest extends BaseCSRFTest{
@Test public void testDoesNotTestTokenInNonViewState() throws ComponentInitializationException {
listener.initialize();
- MockFlowSession flowSession = new MockFlowSession();
- ActionState currentState = new ActionState(new Flow("testFlow"), "action-state");
+ final MockFlowSession flowSession = new MockFlowSession();
+ final ActionState currentState = new ActionState(new Flow("testFlow"), "action-state");
flowSession.setState(currentState);
- MockFlowExecutionContext context = new MockFlowExecutionContext(flowSession);
- MockRequestContext src = new MockRequestContext(context);
+ final MockFlowExecutionContext context = new MockFlowExecutionContext(flowSession);
+ final MockRequestContext src = new MockRequestContext(context);
- listener.eventSignaled(src, new Event(this,"proceed"));
+ listener.eventSignaled(src, new Event(this,"proceed"));
}
@@ -260,18 +324,19 @@ public class CSRFTokenFlowExecutionListenerTest extends BaseCSRFTest{
throws ComponentInitializationException {
listener.initialize();
- MockFlowSession flowSession = new MockFlowSession();
- MockViewState currentState = new MockViewState("testFlow", "a-view-state");
+ final MockFlowSession flowSession = new MockFlowSession();
+ final MockViewState currentState = new MockViewState("testFlow", "a-view-state");
flowSession.setState(currentState);
@SuppressWarnings("null")
+ final
CSRFToken viewScopeToken = new SimpleCSRFToken(UUID.randomUUID().toString(), "csrf_token");
flowSession.getViewScope().put(CSRFTokenFlowExecutionListener.CSRF_TOKEN_VIEWSCOPE_NAME, viewScopeToken);
- MockFlowExecutionContext context = new MockFlowExecutionContext(flowSession);
- MockRequestContext src = new MockRequestContext(context);
+ final MockFlowExecutionContext context = new MockFlowExecutionContext(flowSession);
+ final MockRequestContext src = new MockRequestContext(context);
- listener.eventSignaled(src, new Event(this,"proceed"));
+ listener.eventSignaled(src, new Event(this,"proceed"));
}
@@ -286,7 +351,7 @@ public class CSRFTokenFlowExecutionListenerTest extends BaseCSRFTest{
listener.setEventRequiresCSRFTokenValidationPredicate(new BiPredicate<RequestContext, Event>() {
- public boolean test(RequestContext context, Event event) {
+ public boolean test(final RequestContext context, final Event event) {
if (event.getId().equals("new-event-id")) {
return true;
}
@@ -295,20 +360,21 @@ public class CSRFTokenFlowExecutionListenerTest extends BaseCSRFTest{
});
listener.initialize();
- MockFlowSession flowSession = new MockFlowSession();
- MockViewState currentState = new MockViewState("testFlow", "a-view-state");
+ final MockFlowSession flowSession = new MockFlowSession();
+ final MockViewState currentState = new MockViewState("testFlow", "a-view-state");
flowSession.setState(currentState);
@SuppressWarnings("null")
+ final
CSRFToken viewScopeToken = new SimpleCSRFToken(UUID.randomUUID().toString(), CSRF_PARAM_NAME);
flowSession.getViewScope().put(CSRFTokenFlowExecutionListener.CSRF_TOKEN_VIEWSCOPE_NAME, viewScopeToken);
- MockFlowExecutionContext context = new MockFlowExecutionContext(flowSession);
- MockParameterMap map = new MockParameterMap();
+ final MockFlowExecutionContext context = new MockFlowExecutionContext(flowSession);
+ final MockParameterMap map = new MockParameterMap();
map.put(CSRF_PARAM_NAME, "should-fail");
- MockExternalContext extContext = new MockExternalContext(map);
- MockRequestContext src = new MockRequestContext(context);
+ final MockExternalContext extContext = new MockExternalContext(map);
+ final MockRequestContext src = new MockRequestContext(context);
src.setExternalContext(extContext);
listener.eventSignaled(src, new Event(this,"new-event-id"));
@@ -324,12 +390,12 @@ public class CSRFTokenFlowExecutionListenerTest extends BaseCSRFTest{
throws ComponentInitializationException {
listener.initialize();
- MockFlowSession flowSession = new MockFlowSession();
- MockViewState currentState = new MockViewState("testFlow", "a-view-state");
+ final MockFlowSession flowSession = new MockFlowSession();
+ final MockViewState currentState = new MockViewState("testFlow", "a-view-state");
flowSession.setState(currentState);
- MockFlowExecutionContext context = new MockFlowExecutionContext(flowSession);
- MockRequestContext src = new MockRequestContext(context);
- listener.eventSignaled(src, new Event(this,"proceed"));
+ final MockFlowExecutionContext context = new MockFlowExecutionContext(flowSession);
+ final MockRequestContext src = new MockRequestContext(context);
+ listener.eventSignaled(src, new Event(this,"proceed"));
}
@@ -347,7 +413,7 @@ public class CSRFTokenFlowExecutionListenerTest extends BaseCSRFTest{
@Test public void testSetEnabled() {
//create a new instance to test default enabled = false.
- CSRFTokenFlowExecutionListener theListener = new CSRFTokenFlowExecutionListener();
+ final CSRFTokenFlowExecutionListener theListener = new CSRFTokenFlowExecutionListener();
// test default is false.
Object enabledObject = ReflectionTestUtils.getField(theListener, "enabled");
assert enabledObject != null;
@@ -372,14 +438,14 @@ public class CSRFTokenFlowExecutionListenerTest extends BaseCSRFTest{
//set enabled to false.
listener.setEnabled(false);
listener.initialize();
- MockFlowSession flowSession = new MockFlowSession();
- MockViewState currentState = new MockViewState("testFlow", "a-view-state");
+ final MockFlowSession flowSession = new MockFlowSession();
+ final MockViewState currentState = new MockViewState("testFlow", "a-view-state");
flowSession.setState(currentState);
- MockFlowExecutionContext context = new MockFlowExecutionContext(flowSession);
- MockRequestContext src = new MockRequestContext(context);
+ final MockFlowExecutionContext context = new MockFlowExecutionContext(flowSession);
+ final MockRequestContext src = new MockRequestContext(context);
listener.viewRendering(src, new MockView("login",src), currentState);
- Object csrfTokenValueObject = src.getViewScope().get(CSRFTokenFlowExecutionListener.CSRF_TOKEN_VIEWSCOPE_NAME);
+ final Object csrfTokenValueObject = src.getViewScope().get(CSRFTokenFlowExecutionListener.CSRF_TOKEN_VIEWSCOPE_NAME);
Assert.assertNull(csrfTokenValueObject);
@@ -415,19 +481,19 @@ public class CSRFTokenFlowExecutionListenerTest extends BaseCSRFTest{
throws ComponentInitializationException {
listener.initialize();
- MockFlowSession flowSession = new MockFlowSession();
- MockViewState currentState = new MockViewState("testFlow", "a-view-state");
+ final MockFlowSession flowSession = new MockFlowSession();
+ final MockViewState currentState = new MockViewState("testFlow", "a-view-state");
flowSession.setState(currentState);
flowSession.getViewScope().put(CSRFTokenFlowExecutionListener.CSRF_TOKEN_VIEWSCOPE_NAME, "string-token");
- MockFlowExecutionContext context = new MockFlowExecutionContext(flowSession);
- MockParameterMap map = new MockParameterMap();
+ final MockFlowExecutionContext context = new MockFlowExecutionContext(flowSession);
+ final MockParameterMap map = new MockParameterMap();
map.put(CSRF_PARAM_NAME, "string-token");
- MockExternalContext extContext = new MockExternalContext(map);
- MockRequestContext src = new MockRequestContext(context);
+ final MockExternalContext extContext = new MockExternalContext(map);
+ final MockRequestContext src = new MockRequestContext(context);
src.setExternalContext(extContext);
listener.eventSignaled(src, new Event(this,"proceed"));
@@ -441,7 +507,7 @@ public class CSRFTokenFlowExecutionListenerTest extends BaseCSRFTest{
@Test(expectedExceptions=ComponentInitializationException.class) void testUnsetCsrfTokenManager()
throws ComponentInitializationException{
- CSRFTokenFlowExecutionListener theListener = new CSRFTokenFlowExecutionListener();
+ final CSRFTokenFlowExecutionListener theListener = new CSRFTokenFlowExecutionListener();
theListener.setViewRequiresCSRFTokenPredicate(new DefaultViewRequiresCSRFTokenPredicate());
theListener.setEventRequiresCSRFTokenValidationPredicate(new DefaultEventRequiresCSRFTokenValidationPredicate());
theListener.initialize();
@@ -455,7 +521,7 @@ public class CSRFTokenFlowExecutionListenerTest extends BaseCSRFTest{
@Test(expectedExceptions=ComponentInitializationException.class) void testUnsetEventRequiresCSRFValidationPredicate()
throws ComponentInitializationException{
- CSRFTokenFlowExecutionListener theListener = new CSRFTokenFlowExecutionListener();
+ final CSRFTokenFlowExecutionListener theListener = new CSRFTokenFlowExecutionListener();
theListener.setCsrfTokenManager(new CSRFTokenManager());
theListener.setViewRequiresCSRFTokenPredicate(new DefaultViewRequiresCSRFTokenPredicate());
theListener.initialize();
@@ -469,7 +535,7 @@ public class CSRFTokenFlowExecutionListenerTest extends BaseCSRFTest{
@Test(expectedExceptions=ComponentInitializationException.class) void testUnsetViewRequiresCSRFTokenPredicate()
throws ComponentInitializationException{
- CSRFTokenFlowExecutionListener theListener = new CSRFTokenFlowExecutionListener();
+ final CSRFTokenFlowExecutionListener theListener = new CSRFTokenFlowExecutionListener();
theListener.setCsrfTokenManager(new CSRFTokenManager());
theListener.setEventRequiresCSRFTokenValidationPredicate(new DefaultEventRequiresCSRFTokenValidationPredicate());
theListener.initialize();
--
To stop receiving notification emails like this one, please contact
the administrator of this repository.
More information about the commits
mailing list