-
Notifications
You must be signed in to change notification settings - Fork 5.9k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
CookieServerCsrfTokenRepository#createNewToken should use Schedulers.boundedElastic #9018
Labels
in: web
An issue in web modules (web, webmvc)
status: backported
An issue that has been backported to maintenance branches
type: bug
A general bug
Milestone
Comments
tt4g
added
status: waiting-for-triage
An issue we've not yet triaged
type: bug
A general bug
labels
Sep 15, 2020
Hi, @tt4g, thanks for the report. I believe that it makes sense to change the token generation to use Mono.fromCallable(this::createCsrfToken).subscribeOn(Schedulers.boundedElastic()); since Would you be able to submit a PR to update the class? |
jzheaux
added
in: web
An issue in web modules (web, webmvc)
and removed
status: waiting-for-triage
An issue we've not yet triaged
labels
Sep 16, 2020
I will submit PR in a few days. |
@jzheaux PR has been sent. Could you please confirm? |
tt4g
added a commit
to tt4g/spring-security
that referenced
this issue
Sep 16, 2020
The CSRF token is generated by UUID.randomUUID() which is I/O blocking operation. This commit changes the subscriber thread to the bounded elactic scheduler. Closes spring-projectsgh-9018
jzheaux
pushed a commit
that referenced
this issue
Sep 16, 2020
The CSRF token is generated by UUID.randomUUID() which is I/O blocking operation. This commit changes the subscriber thread to the bounded elactic scheduler. Closes gh-9018
jzheaux
changed the title
[Question} Why CookieServerCsrfTokenRepository does not use Schedulers.boundedElastic()?
CookieServerCsrfTokenRepository#createNewToken should use Schedulers.boundedElastic
Sep 16, 2020
jzheaux
pushed a commit
that referenced
this issue
Sep 16, 2020
The CSRF token is generated by UUID.randomUUID() which is I/O blocking operation. This commit changes the subscriber thread to the bounded elactic scheduler. Closes gh-9018
spring-projects-issues
added
the
status: backported
An issue that has been backported to maintenance branches
label
Sep 16, 2020
jzheaux
pushed a commit
that referenced
this issue
Sep 16, 2020
The CSRF token is generated by UUID.randomUUID() which is I/O blocking operation. This commit changes the subscriber thread to the bounded elactic scheduler. Closes gh-9018
jzheaux
pushed a commit
that referenced
this issue
Sep 24, 2020
The CSRF token is generated by UUID.randomUUID() which is I/O blocking operation. This commit changes the subscriber thread to the bounded elactic scheduler. Closes gh-9018
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Labels
in: web
An issue in web modules (web, webmvc)
status: backported
An issue that has been backported to maintenance branches
type: bug
A general bug
Describe the bug
Call
UUID#randomUUID()
inCookieServerCsrfTokenRepository#createNewToken()
andUUID#randomUUID()
is blocking I/O operation (reports #8128).However,
CookieServerCsrfTokenRepository#generateToken(ServerWebExchange)
is not change Scheduler.spring-security/web/src/main/java/org/springframework/security/web/server/csrf/CookieServerCsrfTokenRepository.java
Lines 68 to 71 in 57c5ec2
spring-security/web/src/main/java/org/springframework/security/web/server/csrf/CookieServerCsrfTokenRepository.java
Lines 148 to 150 in 57c5ec2
spring-security/web/src/main/java/org/springframework/security/web/server/csrf/CookieServerCsrfTokenRepository.java
Lines 156 to 158 in 57c5ec2
To Reproduce
CookieServerCsrfTokenRepository#generateToken(ServerWebExchange)
Expected behavior
Use
Schedulers.boundedElastic()
.Sample
N/A
Is it the design of not using the
Schedulers.boundedElastic()
?The text was updated successfully, but these errors were encountered: