Skip to content

Conversation

@therepanic
Copy link
Contributor

@therepanic therepanic commented Jan 22, 2026

Returning Mono from ServerCsrfTokenRequestHandler#handle would allow non-blocking response writes.

Closes: gh-16869

@rwinch
Copy link
Member

rwinch commented Jan 23, 2026

Thanks for the PR! Unfortunately, the changes in this pull request are not passive and we cannot accept it as it is. For this to be accepted, we cannot change the method signature. Instead, you probably need to:

  • Introduce a new default method on the interface that returns Mono<Void>. The default implementation would call the old method.
  • Deprecate the old method for removal in Spring Security 8
  • Update Spring Security to call the new method that returns Mono<Void>

Are you able to update the PR accordingly?

@rwinch rwinch added status: waiting-for-feedback We need additional information before we can continue in: web An issue in web modules (web, webmvc) type: enhancement A general enhancement and removed status: waiting-for-triage An issue we've not yet triaged labels Jan 23, 2026
@therepanic
Copy link
Contributor Author

Sure, I will update the PR ASAP

@spring-projects-issues spring-projects-issues added status: feedback-provided Feedback has been provided and removed status: waiting-for-feedback We need additional information before we can continue labels Jan 23, 2026
@rwinch rwinch added status: waiting-for-feedback We need additional information before we can continue and removed status: feedback-provided Feedback has been provided labels Jan 23, 2026
@therepanic therepanic changed the title Return Mono<Void> in ServerCsrfTokenRequestHandler#handle Add reactive handle method to ServerCsrfTokenRequestHandler Jan 25, 2026
Comment on lines +49 to +60
/**
* Handles a request using a {@link CsrfToken}.
* @param exchange the {@code ServerWebExchange} with the request being handled
* @param csrfToken the {@code Mono<CsrfToken>} created by the
* {@link ServerCsrfTokenRepository}
* @return a {@code Mono} that completes when handling is finished
*/
default Mono<Void> handleAsync(ServerWebExchange exchange, Mono<CsrfToken> csrfToken) {
handle(exchange, csrfToken);
return Mono.empty();
}

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Will this method name suit us?

Adds a default reactive handle method returning Mono<Void> and
deprecates the legacy void handle method in preparation for Spring
Security 8.

Closes: spring-projectsgh-16869

Signed-off-by: Andrey Litvitski <[email protected]>
@therepanic
Copy link
Contributor Author

Flaky test I guess?

@spring-projects-issues spring-projects-issues added status: feedback-provided Feedback has been provided and removed status: waiting-for-feedback We need additional information before we can continue labels Jan 25, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

in: web An issue in web modules (web, webmvc) status: feedback-provided Feedback has been provided type: enhancement A general enhancement

Projects

None yet

Development

Successfully merging this pull request may close these issues.

ServerCsrfTokenRequestHandler should return reactive types

3 participants