This is an automated email from the ASF dual-hosted git repository. rmaucher pushed a commit to branch 10.1.x in repository https://gitbox.apache.org/repos/asf/tomcat.git
commit cb9c6ecc0416abc2d9c08cb06317e9342f288b3c Author: opencode <[email protected]> AuthorDate: Wed Sep 30 16:35:45 2026 +0200 Synchronise the check for an existing nonce cache with its creation in CsrfPreventionFilter to prevent concurrent requests on the same session discarding a cache containing already-issued nonces, which could trigger spurious rejections --- java/org/apache/catalina/filters/CsrfPreventionFilter.java | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/java/org/apache/catalina/filters/CsrfPreventionFilter.java b/java/org/apache/catalina/filters/CsrfPreventionFilter.java index 0986cd2330..26119346f5 100644 --- a/java/org/apache/catalina/filters/CsrfPreventionFilter.java +++ b/java/org/apache/catalina/filters/CsrfPreventionFilter.java @@ -449,7 +449,12 @@ public class CsrfPreventionFilter extends CsrfPreventionFilterBase { session = req.getSession(true); } - nonceCache = createNonceCache(req, session); + synchronized (session) { + nonceCache = getNonceCache(req, session); + if (nonceCache == null) { + nonceCache = createNonceCache(req, session); + } + } } String newNonce = generateNonce(req); --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
