This is an automated email from the ASF dual-hosted git repository. rmaucher pushed a commit to branch 9.0.x in repository https://gitbox.apache.org/repos/asf/tomcat.git
commit 154ecc30452e10d9e4596d92effa92825e27df25 Author: opencode <[email protected]> AuthorDate: Wed Sep 30 16:35:45 2026 +0200 Synchronise the check for an existing nonce cache with its creation in CsrfPreventionFilter to prevent concurrent requests on the same session discarding a cache containing already-issued nonces, which could trigger spurious rejections --- java/org/apache/catalina/filters/CsrfPreventionFilter.java | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/java/org/apache/catalina/filters/CsrfPreventionFilter.java b/java/org/apache/catalina/filters/CsrfPreventionFilter.java index 1e0ef188ad..2d8dc5f268 100644 --- a/java/org/apache/catalina/filters/CsrfPreventionFilter.java +++ b/java/org/apache/catalina/filters/CsrfPreventionFilter.java @@ -449,7 +449,12 @@ public class CsrfPreventionFilter extends CsrfPreventionFilterBase { session = req.getSession(true); } - nonceCache = createNonceCache(req, session); + synchronized (session) { + nonceCache = getNonceCache(req, session); + if (nonceCache == null) { + nonceCache = createNonceCache(req, session); + } + } } String newNonce = generateNonce(req); --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
