Merge branch '7.0.x'

Author: rstoyanchev

spring-websocket/src/main/java/org/springframework/web/socket/sockjs/transport/TransportHandlingSockJsService.java

@@ -321,7 +321,7 @@ else if (transportType.supportsCors()) {
 						return;
 					}
 					InetSocketAddress remoteAddress = session.getRemoteAddress();
-					if (remoteAddress != null && !remoteAddress.equals(request.getRemoteAddress())) {
+					if (remoteAddress != null && !isSameAddress(remoteAddress, request.getRemoteAddress())) {
 						logger.debug("The remote address for the session and the request do not match.");
 						response.setStatusCode(HttpStatus.NOT_FOUND);
 						return;
@@ -366,6 +366,19 @@ else if (transportType.supportsCors()) {
 		}
 	}
 
+	private boolean isSameAddress(InetSocketAddress address, InetSocketAddress that) {
+		// InetSocketAddress#equals minus port checks, which can vary by requests
+		if (address.getAddress() != null) {
+			return address.getAddress().equals(that.getAddress());
+		}
+		else if (address.getHostName() != null) {
+			return (that.getAddress() == null && address.getHostName().equalsIgnoreCase(that.getHostName()));
+		}
+		else {
+			return (that.getAddress() == null) && (that.getHostName() == null);
+		}
+	}
+
 	@Override
 	protected boolean validateRequest(String serverId, String sessionId, String transport) {
 		if (!super.validateRequest(serverId, sessionId, transport)) {

spring-websocket/src/test/java/org/springframework/web/socket/sockjs/transport/handler/DefaultSockJsServiceTests.java

@@ -291,8 +291,9 @@ void handleTransportRequestXhrSendWithDifferentRemoteAddress() {
 		assertThat(this.servletResponse.getStatus()).isEqualTo(200);
 		verify(this.xhrHandler).handleRequest(this.request, this.response, this.wsHandler, this.session);
 
-		this.session.setRemoteAddress(new InetSocketAddress("127.0.0.1:8080", 8080));
-		this.servletRequest.setRemoteAddr("127.0.0.1:9090");
+		this.session.setRemoteAddress(new InetSocketAddress("0.0.0.0.1", 54001));
+		this.servletRequest.setRemoteAddr("0.0.0.0.2");
+		this.servletRequest.setRemotePort(54001);
 
 		resetResponse();
 		reset(this.xhrSendHandler);
@@ -304,6 +305,32 @@ void handleTransportRequestXhrSendWithDifferentRemoteAddress() {
 		verifyNoMoreInteractions(this.xhrSendHandler);
 	}
 
+	@Test
+	void handleTransportRequestXhrSendWithSameRemoteAddress() {
+		String sockJsPath = sessionUrlPrefix + "xhr";
+		setRequest("POST", sockJsPrefix + sockJsPath);
+		this.service.handleRequest(this.request, this.response, sockJsPath, this.wsHandler);
+
+		// session created
+		assertThat(this.servletResponse.getStatus()).isEqualTo(200);
+		verify(this.xhrHandler).handleRequest(this.request, this.response, this.wsHandler, this.session);
+
+		this.session.setRemoteAddress(new InetSocketAddress("0.0.0.0.1", 54001));
+		this.servletRequest.setRemoteAddr("0.0.0.0.1");
+		this.servletRequest.setRemotePort(54002); // port can vary
+
+		resetResponse();
+		reset(this.xhrSendHandler);
+		given(this.xhrSendHandler.checkSessionType(this.session)).willReturn(true);
+
+		sockJsPath = sessionUrlPrefix + "xhr_send";
+		setRequest("POST", sockJsPrefix + sockJsPath);
+		this.service.handleRequest(this.request, this.response, sockJsPath, this.wsHandler);
+
+		assertThat(this.servletResponse.getStatus()).isEqualTo(200);
+		verify(this.xhrSendHandler).handleRequest(this.request, this.response, this.wsHandler, this.session);
+	}
+
 	@Test
 	void handleTransportRequestWebsocket() {
 		TransportHandlingSockJsService wsService = new TransportHandlingSockJsService(