Don't Attempt to Generate Token Without Valid Token Request

jzheaux · jzheaux · commit 1c112005fa4e · 2025-10-20T17:09:43.000-06:00
Closes gh-18088 Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
diff --git a/web/src/main/java/org/springframework/security/web/authentication/ott/GenerateOneTimeTokenFilter.java b/web/src/main/java/org/springframework/security/web/authentication/ott/GenerateOneTimeTokenFilter.java
@@ -68,11 +68,11 @@ protected void doFilterInternal(HttpServletRequest request, HttpServletResponse
 			return;
 		}
 		GenerateOneTimeTokenRequest generateRequest = this.requestResolver.resolve(request);
-		OneTimeToken ott = this.tokenService.generate(generateRequest);
 		if (generateRequest == null) {
 			filterChain.doFilter(request, response);
 			return;
 		}
+		OneTimeToken ott = this.tokenService.generate(generateRequest);
 		this.tokenGenerationSuccessHandler.handle(request, response, ott);
 	}
 

Original file line number	Diff line number	Diff line change
`@@ -68,11 +68,11 @@ protected void doFilterInternal(HttpServletRequest request, HttpServletResponse`
`68`	`68`	`return;`
`69`	`69`	`}`
`70`	`70`	`GenerateOneTimeTokenRequest generateRequest = this.requestResolver.resolve(request);`
`71`		`- OneTimeToken ott = this.tokenService.generate(generateRequest);`
`72`	`71`	`if (generateRequest == null) {`
`73`	`72`	`filterChain.doFilter(request, response);`
`74`	`73`	`return;`
`75`	`74`	`}`
	`75`	`+ OneTimeToken ott = this.tokenService.generate(generateRequest);`
`76`	`76`	`this.tokenGenerationSuccessHandler.handle(request, response, ott);`
`77`	`77`	`}`
`78`	`78`