@Test public void cookieNotSetIfNotInAttributes() { WebFilterChain filterChain = (filterExchange) -> { try { assertThat(filterExchange.getResponse().getCookies().getFirst(CSRF_COOKIE_NAME)).isNull();; } catch (AssertionError ex) { return Mono.error(ex); } return Mono.empty(); }; MockServerWebExchange exchange = MockServerWebExchange.from( MockServerHttpRequest.post(TEST_URL) ); this.filter.filter(exchange, filterChain).block(); }
@Override public Mono<Void> filter(ServerWebExchange exchange, WebFilterChain chain) { if (exchange.getRequest().getCookies().get(CSRF_COOKIE_NAME) != null) { return chain.filter(exchange); } return Mono.just(exchange) .publishOn(Schedulers.boundedElastic()) .flatMap(it -> it.getAttributeOrDefault(CsrfToken.class.getName(), Mono.<CsrfToken>empty())) .doOnNext(token -> { ResponseCookie cookie = ResponseCookie.from(CSRF_COOKIE_NAME, token.getToken()) .maxAge(-1) .httpOnly(false) .path(getRequestContext(exchange.getRequest())) .secure(Optional.ofNullable(exchange.getRequest().getSslInfo()).isPresent()) .build(); exchange.getResponse().getCookies().add(CSRF_COOKIE_NAME, cookie); }) .then(Mono.defer(() -> chain.filter(exchange))); }
CookieCsrfFilter implements WebFilter { @Override public Mono<Void> filter(ServerWebExchange exchange, WebFilterChain chain) { if (exchange.getRequest().getCookies().get(CSRF_COOKIE_NAME) != null) { return chain.filter(exchange); } return Mono.just(exchange) .publishOn(Schedulers.boundedElastic()) .flatMap(it -> it.getAttributeOrDefault(CsrfToken.class.getName(), Mono.<CsrfToken>empty())) .doOnNext(token -> { ResponseCookie cookie = ResponseCookie.from(CSRF_COOKIE_NAME, token.getToken()) .maxAge(-1) .httpOnly(false) .path(getRequestContext(exchange.getRequest())) .secure(Optional.ofNullable(exchange.getRequest().getSslInfo()).isPresent()) .build(); exchange.getResponse().getCookies().add(CSRF_COOKIE_NAME, cookie); }) .then(Mono.defer(() -> chain.filter(exchange))); } }
CookieCsrfFilter implements WebFilter { @Override public Mono<Void> filter(ServerWebExchange exchange, WebFilterChain chain) { if (exchange.getRequest().getCookies().get(CSRF_COOKIE_NAME) != null) { return chain.filter(exchange); } return Mono.just(exchange) .publishOn(Schedulers.boundedElastic()) .flatMap(it -> it.getAttributeOrDefault(CsrfToken.class.getName(), Mono.<CsrfToken>empty())) .doOnNext(token -> { ResponseCookie cookie = ResponseCookie.from(CSRF_COOKIE_NAME, token.getToken()) .maxAge(-1) .httpOnly(false) .path(getRequestContext(exchange.getRequest())) .secure(Optional.ofNullable(exchange.getRequest().getSslInfo()).isPresent()) .build(); exchange.getResponse().getCookies().add(CSRF_COOKIE_NAME, cookie); }) .then(Mono.defer(() -> chain.filter(exchange))); }  }
CookieCsrfFilter implements WebFilter { @Override public Mono<Void> filter(ServerWebExchange exchange, WebFilterChain chain) { if (exchange.getRequest().getCookies().get(CSRF_COOKIE_NAME) != null) { return chain.filter(exchange); } return Mono.just(exchange) .publishOn(Schedulers.boundedElastic()) .flatMap(it -> it.getAttributeOrDefault(CsrfToken.class.getName(), Mono.<CsrfToken>empty())) .doOnNext(token -> { ResponseCookie cookie = ResponseCookie.from(CSRF_COOKIE_NAME, token.getToken()) .maxAge(-1) .httpOnly(false) .path(getRequestContext(exchange.getRequest())) .secure(Optional.ofNullable(exchange.getRequest().getSslInfo()).isPresent()) .build(); exchange.getResponse().getCookies().add(CSRF_COOKIE_NAME, cookie); }) .then(Mono.defer(() -> chain.filter(exchange))); }  @Override Mono<Void> filter(ServerWebExchange exchange, WebFilterChain chain); }
CookieCsrfFilter implements WebFilter { @Override public Mono<Void> filter(ServerWebExchange exchange, WebFilterChain chain) { if (exchange.getRequest().getCookies().get(CSRF_COOKIE_NAME) != null) { return chain.filter(exchange); } return Mono.just(exchange) .publishOn(Schedulers.boundedElastic()) .flatMap(it -> it.getAttributeOrDefault(CsrfToken.class.getName(), Mono.<CsrfToken>empty())) .doOnNext(token -> { ResponseCookie cookie = ResponseCookie.from(CSRF_COOKIE_NAME, token.getToken()) .maxAge(-1) .httpOnly(false) .path(getRequestContext(exchange.getRequest())) .secure(Optional.ofNullable(exchange.getRequest().getSslInfo()).isPresent()) .build(); exchange.getResponse().getCookies().add(CSRF_COOKIE_NAME, cookie); }) .then(Mono.defer(() -> chain.filter(exchange))); }  @Override Mono<Void> filter(ServerWebExchange exchange, WebFilterChain chain);  }