This is an automated email from the ASF dual-hosted git repository. rmaucher pushed a commit to branch main in repository https://gitbox.apache.org/repos/asf/tomcat.git
commit a5d2239a703cf84e9c48b5a6ba07caeec6552b64 Author: opencode <[email protected]> AuthorDate: Wed Sep 30 16:35:45 2026 +0200 Synchronise the check for an existing nonce cache with its creation in CsrfPreventionFilter to prevent concurrent requests on the same session discarding a cache containing already-issued nonces, which could trigger spurious rejections --- java/org/apache/catalina/filters/CsrfPreventionFilter.java | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/java/org/apache/catalina/filters/CsrfPreventionFilter.java b/java/org/apache/catalina/filters/CsrfPreventionFilter.java index 1dcdca63f2..35aef63c5b 100644 --- a/java/org/apache/catalina/filters/CsrfPreventionFilter.java +++ b/java/org/apache/catalina/filters/CsrfPreventionFilter.java @@ -447,7 +447,12 @@ public class CsrfPreventionFilter extends CsrfPreventionFilterBase { session = req.getSession(true); } - nonceCache = createNonceCache(req, session); + synchronized (session) { + nonceCache = getNonceCache(req, session); + if (nonceCache == null) { + nonceCache = createNonceCache(req, session); + } + } } String newNonce = generateNonce(req); --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
