From 5c9b87b096456206b7b8ab5caa119bb0927a2d20 Mon Sep 17 00:00:00 2001 From: Tomoki Tsubaki Date: Wed, 16 Sep 2020 21:52:26 +0900 Subject: [PATCH] Create the CSRF token on the bounded elactic scheduler The CSRF token is generated by UUID.randomUUID() which is I/O blocking operation. This commit changes the subscriber thread to the bounded elactic scheduler. Closes gh-9018 --- .../web/server/csrf/CookieServerCsrfTokenRepository.java | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/web/src/main/java/org/springframework/security/web/server/csrf/CookieServerCsrfTokenRepository.java b/web/src/main/java/org/springframework/security/web/server/csrf/CookieServerCsrfTokenRepository.java index 8b2c9529117..5910ff3e45e 100644 --- a/web/src/main/java/org/springframework/security/web/server/csrf/CookieServerCsrfTokenRepository.java +++ b/web/src/main/java/org/springframework/security/web/server/csrf/CookieServerCsrfTokenRepository.java @@ -19,6 +19,7 @@ import java.util.UUID; import reactor.core.publisher.Mono; +import reactor.core.scheduler.Schedulers; import org.springframework.http.HttpCookie; import org.springframework.http.ResponseCookie; @@ -67,7 +68,7 @@ public static CookieServerCsrfTokenRepository withHttpOnlyFalse() { @Override public Mono generateToken(ServerWebExchange exchange) { - return Mono.fromCallable(this::createCsrfToken); + return Mono.fromCallable(this::createCsrfToken).subscribeOn(Schedulers.boundedElastic()); } @Override