-
Notifications
You must be signed in to change notification settings - Fork 48
Open
Description
Describe the bug
the correct site is localhost:7001/xxx/home.html, but in private window(chrome) The first page visit will fail, it turns into localhost:7001/home.html. But the second visit will be successful(In the same private windows not open new private one).

Intuitive reason
Failed to parse configuration. mine is org.owasp.csrfguard.NewTokenLandingPage=%servletContext%/home.html
I suspect it's because the session is null, so go to the this.handleNoSession().
private void doFilter(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, FilterChain filterChain, CsrfGuard csrfGuard) throws IOException, ServletException {
InterceptRedirectResponse interceptRedirectResponse = new InterceptRedirectResponse(httpServletResponse, httpServletRequest, csrfGuard);
LogicalSessionExtractor sessionKeyExtractor = csrfGuard.getLogicalSessionExtractor();
LogicalSession logicalSession = sessionKeyExtractor.extract(httpServletRequest);
if (logicalSession == null) {
if (csrfGuard.isUseNewTokenLandingPage()) {
LogicalSession createdLogicalSession = sessionKeyExtractor.extractOrCreate(httpServletRequest);
csrfGuard.writeLandingPage(interceptRedirectResponse, createdLogicalSession.getKey());
} else {
this.handleNoSession(httpServletRequest, httpServletResponse, interceptRedirectResponse, filterChain, csrfGuard);
}
} else {
this.handleSession(httpServletRequest, interceptRedirectResponse, filterChain, logicalSession, csrfGuard);
}
}
Current Solution
I can't hard code NewTokenLandingPage to %servletContext%/xxx/home.html in some reason.
Add a filter before CsrfGuardFilter
@Override
public void doFilter(ServletRequest request, ServletResponse response, FilterChain filterChain) throws IOException, ServletException {
HttpServletRequest httpRequest = (HttpServletRequest) request;
// Force session initialization to ensure that CSRFGuard can get the session correctly.
httpRequest.getSession(true);
filterChain.doFilter(request, response);
}
Is there another way to solve this problem? Adding another filter before CsrfGuardFilter just feels off.
Metadata
Metadata
Assignees
Labels
No labels