admin/spring-projects-spring-framework
1
0
Fork 0
mirror of https://github.com/spring-projects/spring-framework synced 2026-06-08 17:33:33 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update Principal check in TransportHandlingSockJsService

Browse Source 
Closes gh-35753
This commit is contained in:
rstoyanchev
2025-11-05 10:12:00 +00:00
parent 585b4e08e8
commit cd67010518
1 changed files with 9 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
spring-websocket/src/main/java/org/springframework/web/socket/sockjs/transport/TransportHandlingSockJsService.java
+9 -4
View File
@@ -303,10 +303,15 @@ public class TransportHandlingSockJsService extends AbstractSockJsService implem
}
else {
Principal principal = session.getPrincipal();
if (principal != null && !principal.equals(request.getPrincipal())) {
logger.debug("The user for the session does not match the user for the request.");
response.setStatusCode(HttpStatus.NOT_FOUND);
return;
if (principal != null) {
// Compare usernames, not full equality (different login timestamps)
Principal currentPrincipal = request.getPrincipal();
if (!principal.equals(currentPrincipal) &&
(currentPrincipal == null || !principal.getName().equals(currentPrincipal.getName()))) {
logger.debug("The user for the session does not match the user for the request.");
response.setStatusCode(HttpStatus.NOT_FOUND);
return;
}
}
if (!transportHandler.checkSessionType(session)) {
logger.debug("Session type does not match the transport type for the request.");