SEC-3140: A user with an expired session can send messages throught websocket

Danilkovich Denis (Migrated from SEC-3140) said:

In my application I have an websocket-based chat. And only authenticated users cat post messages. My spring-security config is below

<s:websocket-message-broker same-origin-disabled="true">
        <s:intercept-message type="MESSAGE" pattern="/app/chat.message" access="(hasRole('ROLE_USER') and !hasRole('ROLE_BLOCK_CHAT_POSTER'))" />
    </s:websocket-message-broker>

and when in my admin consloe I make user session expired:

public void logOutManuallyUser(String username){
  for(Object principal: sessionRegistry.getAllPrincipals()) {

    User user = (User)principal;
    if (user.getUsername().toUpperCase().equals(username.toUpperCase())){               
      for(SessionInformation session : sessionRegistry.getAllSessions(principal, false)) {
        session.expireNow();
        break;
      }
    }
  }
}

user can send any messages througth websocket.

Start with the Spring Security websocket-message-broker configuration and the SessionInformation.expireNow() path shown in the report. Trace how MESSAGE authorization handles an expired session, then verify that a user whose session is expired can no longer post to /app/chat.message.