Add logging to CsrfTokenRequestHandler implementations #16994

yybmion · 2025-04-24T17:34:04Z

Issue

This PR adds trace-level logging to CSRF token handlers to improve debugging capabilities.

Changes

Add logging to show token source (header or parameter) in resolveCsrfTokenValue
Add logging to show request attribute names used in handle methods
Add logging in XorCsrfTokenRequestAttributeHandler when token processing fails (as specifically requested in the issue)
Apply similar logging improvements to XorServerCsrfTokenRequestAttributeHandler for consistency

Add trace-level logging to show the logical path of CSRF token processing - Log token source (header or parameter) in resolveCsrfTokenValue - Log request attribute names in handle methods - Log failures in XorCsrfTokenRequestAttributeHandler (especially Base64 decoding) - Add similar logging to XorServerCsrfTokenRequestAttributeHandler Improves debugging capabilities without changing functionality. Signed-off-by: yybmion <[email protected]>

jzheaux

Hi, @yybmion, thanks for the PR! I've left some feedback inline for the servlet code. Will you please apply the same to the reactive code?

Also, I don't see changes to ServerCsrfTokenRequestHandler. Can you add logging changes equivalent to CsrfTokenRequestHandler?

jzheaux · 2025-04-29T17:02:11Z

web/src/main/java/org/springframework/security/web/csrf/CsrfTokenRequestAttributeHandler.java

@@ -60,6 +66,9 @@ public void handle(HttpServletRequest request, HttpServletResponse response,
 		String csrfAttrName = (this.csrfRequestAttributeName != null) ? this.csrfRequestAttributeName
 				: csrfToken.getParameterName();
 		request.setAttribute(csrfAttrName, csrfToken);
+
+		logger.trace(LogMessage.format("CSRF token written to request attributes: %s, %s", CsrfToken.class.getName(),


Let's please rephrase to match the following grammar:

Wrote a CSRF token to the following request attributes: [%s, %s]

The motive for this is it allows the logs to read more like a sentence:

2025-01-03T02:20:45Z [CsrfTokenRequestAttributeHandler] Wrote a CSRF token to the following request attributes ...

The reason for the brackets is that the CsrfToken class name will be log in the logs and it will make it easier visually to find the end of the list.

jzheaux · 2025-04-29T17:02:22Z

web/src/main/java/org/springframework/security/web/csrf/CsrfTokenRequestHandler.java

@@ -51,6 +55,13 @@ default String resolveCsrfTokenValue(HttpServletRequest request, CsrfToken csrfT
 		String actualToken = request.getHeader(csrfToken.getHeaderName());
 		if (actualToken == null) {
 			actualToken = request.getParameter(csrfToken.getParameterName());
+			if (actualToken != null) {


Can we refactor this logic a bit to reduce nesting? For example (starting at line 56):

if (actualToken != null) { return actualToken; } logger.trace(LogMessage.format("Did not find a CSRF token in the [%s] request header", csrfToken.getHeaderName())); actualToken = request.getParameter(csrfToken.getParameterName()); if (actualToken != null) { return actualToken; } logger.trace(LogMessage.format("Did not find a CSRF token in the [%s] request parameter", csrfToken.getParameterName())); return null;

jzheaux · 2025-04-29T17:16:20Z

web/src/main/java/org/springframework/security/web/csrf/CsrfTokenRequestHandler.java

 * @since 5.8
 * @see CsrfTokenRequestAttributeHandler
 */
 @FunctionalInterface
 public interface CsrfTokenRequestHandler extends CsrfTokenRequestResolver {

+	Log logger = LogFactory.getLog(CsrfTokenRequestHandler.class);


We don't want to expose our logger as a public member. Instead, please create a package-private class (maybe called CsrfTokenRequestHandlerLoggerHolder) that has a package-private Log member. The default method can reference it.

Created a package-private CsrfTokenRequestHandlerLoggerHolder class to encapsulate the logger as requested.

jzheaux · 2025-04-29T17:20:26Z

...src/main/java/org/springframework/security/web/csrf/XorCsrfTokenRequestAttributeHandler.java

@@ -55,6 +59,7 @@ public void handle(HttpServletRequest request, HttpServletResponse response,
 		Assert.notNull(response, "response cannot be null");
 		Assert.notNull(deferredCsrfToken, "deferredCsrfToken cannot be null");
 		Supplier<CsrfToken> updatedCsrfToken = deferCsrfTokenUpdate(deferredCsrfToken);
+		logger.trace(LogMessage.format("XOR CSRF token created and will be written to request attributes"));


Will you please remove this log? It is implied by the CsrfTokenRequestAttributeHandler log message. Also, we don't typically want to make future promises in logs since future logic in CsrfTokenRequestAttributeHandler might contradict this statement.

jzheaux · 2025-04-29T17:23:10Z

...src/main/java/org/springframework/security/web/csrf/XorCsrfTokenRequestAttributeHandler.java

@@ -70,7 +75,18 @@ private Supplier<CsrfToken> deferCsrfTokenUpdate(Supplier<CsrfToken> csrfTokenSu
 	@Override
 	public String resolveCsrfTokenValue(HttpServletRequest request, CsrfToken csrfToken) {
 		String actualToken = super.resolveCsrfTokenValue(request, csrfToken);
-		return getTokenValue(actualToken, csrfToken.getToken());
+		if (actualToken == null) {
+			logger.trace(LogMessage.format("No CSRF token value found in request"));


Will you please remove this log? It is taken care of by the suggested changes to CsrfTokenRequestHandler.

jzheaux · 2025-04-29T17:27:35Z

...src/main/java/org/springframework/security/web/csrf/XorCsrfTokenRequestAttributeHandler.java

+		}
+		String tokenValue = getTokenValue(actualToken, csrfToken.getToken());
+		if (tokenValue == null) {
+			logger.trace(LogMessage.format("CSRF token validation failed"));


Will you please remove this log? It's taken care of in getTokenValue

jzheaux · 2025-04-29T17:35:13Z

...src/main/java/org/springframework/security/web/csrf/XorCsrfTokenRequestAttributeHandler.java

+			logger.trace(LogMessage.format("CSRF token validation failed"));
+		}
+		else {
+			logger.trace(LogMessage.format("CSRF token successfully validated"));


Please remove this log message since we don't know if the value is valid yet. Instead, let's add a log to CsrfFilter that says

Found a CSRF token in the request

Added the requested log message to CsrfFilter as follows:

CsrfToken csrfToken = deferredCsrfToken.get(); String actualToken = this.requestHandler.resolveCsrfTokenValue(request, csrfToken); if (actualToken != null && this.logger.isTraceEnabled()) { this.logger.trace(LogMessage.format("Found a CSRF token in the request")); }

jzheaux · 2025-04-29T17:39:24Z

web/src/main/java/org/springframework/security/web/csrf/CsrfTokenRequestAttributeHandler.java

@@ -60,6 +66,9 @@ public void handle(HttpServletRequest request, HttpServletResponse response,
 		String csrfAttrName = (this.csrfRequestAttributeName != null) ? this.csrfRequestAttributeName
 				: csrfToken.getParameterName();
 		request.setAttribute(csrfAttrName, csrfToken);
+
+		logger.trace(LogMessage.format("CSRF token written to request attributes: %s, %s", CsrfToken.class.getName(),
+				csrfAttrName));


Please switch the two attribute names to show the shorter one first.

jzheaux · 2025-04-29T17:47:48Z

...src/main/java/org/springframework/security/web/csrf/XorCsrfTokenRequestAttributeHandler.java

@@ -79,12 +95,14 @@ private static String getTokenValue(String actualToken, String token) {
 			actualBytes = Base64.getUrlDecoder().decode(actualToken);
 		}
 		catch (Exception ex) {
+			logger.trace(LogMessage.format("Failed to find CSRF token since Base64 decoding failed"), ex);


Please change this to:

Not returning the CSRF token since it's not Base64-encoded

jzheaux · 2025-04-29T17:48:10Z

...src/main/java/org/springframework/security/web/csrf/XorCsrfTokenRequestAttributeHandler.java

 			return null;
 		}

 		byte[] tokenBytes = Utf8.encode(token);
 		int tokenSize = tokenBytes.length;
 		if (actualBytes.length != tokenSize * 2) {
+			logger.trace(LogMessage.format("Failed to validate CSRF token since token length is invalid"));


Please change this to:

"Not returning the CSRF token since its Base64-decoded length (%d) is not equal to (%d)", actualBytes.length, tokenSize * 2

Improve CSRF logging: consistent formatting, reduced nesting, proper encapsulation, and removal of redundant messages Signed-off-by: yybmion <[email protected]>

yybmion · 2025-04-30T06:22:17Z

Thank you @jzheaux for thorough review and detailed guidance!

spring-projects-issues added the status: waiting-for-triage An issue we've not yet triaged label Apr 24, 2025

jzheaux requested changes Apr 29, 2025

View reviewed changes

Improve CSRF token logging and code organization

a913f1c

Improve CSRF logging: consistent formatting, reduced nesting, proper encapsulation, and removal of redundant messages Signed-off-by: yybmion <[email protected]>

yybmion force-pushed the gh-13626 branch from ff9dedf to a913f1c Compare April 30, 2025 06:04

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add logging to CsrfTokenRequestHandler implementations #16994

Add logging to CsrfTokenRequestHandler implementations #16994

yybmion commented Apr 24, 2025

jzheaux left a comment •

edited

Loading

jzheaux Apr 29, 2025

yybmion Apr 30, 2025

jzheaux Apr 29, 2025

yybmion Apr 30, 2025

jzheaux Apr 29, 2025 •

edited

Loading

yybmion Apr 30, 2025

jzheaux Apr 29, 2025

yybmion Apr 30, 2025

jzheaux Apr 29, 2025

yybmion Apr 30, 2025

jzheaux Apr 29, 2025

yybmion Apr 30, 2025

jzheaux Apr 29, 2025

yybmion Apr 30, 2025

jzheaux Apr 29, 2025

yybmion Apr 30, 2025

jzheaux Apr 29, 2025

yybmion Apr 30, 2025

jzheaux Apr 29, 2025

yybmion Apr 30, 2025

yybmion commented Apr 30, 2025

Add logging to CsrfTokenRequestHandler implementations #16994

Are you sure you want to change the base?

Add logging to CsrfTokenRequestHandler implementations #16994

Conversation

yybmion commented Apr 24, 2025

Issue

Changes

jzheaux left a comment • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jzheaux Apr 29, 2025 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

yybmion commented Apr 30, 2025

jzheaux left a comment •

edited

Loading

jzheaux Apr 29, 2025 •

edited

Loading