Fix double submit csrf cookie

server/src/main/java/org/cloudfoundry/identity/uaa/security/web/CookieBasedCsrfTokenRepository.java

@@ -113,10 +113,18 @@ public void saveToken(CsrfToken token, HttpServletRequest request, HttpServletRe
             token = generateToken(request);
             expire = true;
         }
-        Cookie csrfCookie = new Cookie(token.getParameterName(), token.getToken());
+
+        boolean isSecure = secure || "https".equals(request.getScheme());
+        String cookieName = isSecure ? "__Host-" + token.getParameterName() : token.getParameterName();
+
+        Cookie csrfCookie = new Cookie(cookieName, token.getToken());
         csrfCookie.setHttpOnly(true);
-        csrfCookie.setSecure(secure || "https".equals(request.getScheme()));
-        csrfCookie.setPath(ofNullable(request.getContextPath()).orElse("") + "/");
+        csrfCookie.setSecure(isSecure);
+        if (cookieName.startsWith("__Host-")) {
+            csrfCookie.setPath("/");
+        } else {
+            csrfCookie.setPath(ofNullable(request.getContextPath()).orElse("") + "/");
+        }
         if (expire) {
             csrfCookie.setMaxAge(0);
         } else {
@@ -133,8 +141,10 @@ public CsrfToken loadToken(HttpServletRequest request) {
         if (requiresCsrfProtection) {
             Cookie[] cookies = request.getCookies();
             if (cookies != null) {
-                for (Cookie cookie : request.getCookies()) {
-                    if (getParameterName().equals(cookie.getName())) {
+                boolean isSecure = secure || "https".equals(request.getScheme());
+                String expectedCookieName = isSecure ? "__Host-" + getParameterName() : getParameterName();
+                for (Cookie cookie : cookies) {
+                    if (expectedCookieName.equals(cookie.getName())) {
                         return new DefaultCsrfToken(getHeaderName(), getParameterName(), cookie.getValue());
                     }
                 }

server/src/test/java/org/cloudfoundry/identity/uaa/web/CookieBasedCsrfTokenRepositoryTests.java

@@ -166,6 +166,17 @@ private MockHttpServletResponse saveTokenAndReturnResponse(boolean isSecure, Str
     }
 
     private Cookie saveTokenAndReturnCookie(boolean isSecure, String protocol) {
-        return saveTokenAndReturnResponse(isSecure, protocol).getCookie("X-Uaa-Csrf");
+        MockHttpServletResponse response = saveTokenAndReturnResponse(isSecure, protocol);
+        boolean expectSecure = isSecure || "https".equals(protocol);
+        String expectedCookieName = expectSecure ? "__Host-X-Uaa-Csrf" : "X-Uaa-Csrf";
+
+        String setCookie = response.getHeader("Set-Cookie");
+        if (setCookie != null && setCookie.contains(expectedCookieName + "=")) {
+            Cookie cookie = new Cookie(expectedCookieName, "");
+            cookie.setSecure(setCookie.contains("Secure"));
+            cookie.setHttpOnly(setCookie.contains("HttpOnly"));
+            return cookie;
+        }
+        return response.getCookie(expectedCookieName);
     }
 }