Skip to content

Commit 1de810a

Browse files
rwinchrwinch
committed
Add DeferHttpSession*Tests
Closes gh-6125
1 parent 89f8310 commit 1de810a

File tree

3 files changed

+247
-0
lines changed

3 files changed

+247
-0
lines changed

‎config/src/test/java/org/springframework/security/config/annotation/web/configuration/DeferHttpSessionJavaConfigTests.java

+120
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,120 @@
1+
/*
2+
* Copyright 2002-2022 the original author or authors.
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* https://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
package org.springframework.security.config.annotation.web.configuration;
18+
19+
import javax.servlet.FilterChain;
20+
21+
import org.junit.jupiter.api.Test;
22+
import org.junit.jupiter.api.extension.ExtendWith;
23+
24+
import org.springframework.beans.factory.annotation.Autowired;
25+
import org.springframework.context.annotation.Bean;
26+
import org.springframework.context.annotation.Configuration;
27+
import org.springframework.mock.web.MockHttpServletRequest;
28+
import org.springframework.mock.web.MockHttpServletResponse;
29+
import org.springframework.security.access.prepost.PreAuthorize;
30+
import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity;
31+
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
32+
import org.springframework.security.config.test.SpringTestContext;
33+
import org.springframework.security.config.test.SpringTestContextExtension;
34+
import org.springframework.security.web.DefaultSecurityFilterChain;
35+
import org.springframework.security.web.FilterChainProxy;
36+
import org.springframework.security.web.csrf.HttpSessionCsrfTokenRepository;
37+
import org.springframework.security.web.csrf.LazyCsrfTokenRepository;
38+
import org.springframework.security.web.savedrequest.HttpSessionRequestCache;
39+
40+
import static org.mockito.ArgumentMatchers.anyBoolean;
41+
import static org.mockito.Mockito.never;
42+
import static org.mockito.Mockito.spy;
43+
import static org.mockito.Mockito.verify;
44+
45+
@ExtendWith(SpringTestContextExtension.class)
46+
public class DeferHttpSessionJavaConfigTests {
47+
48+
@Autowired
49+
private FilterChainProxy springSecurityFilterChain;
50+
51+
@Autowired
52+
private Service service;
53+
54+
public final SpringTestContext spring = new SpringTestContext(this);
55+
56+
@Test
57+
public void explicitDeferHttpSession() throws Exception {
58+
this.spring.register(DeferHttpSessionConfig.class).autowire();
59+
60+
MockHttpServletRequest request = new MockHttpServletRequest("GET", "/");
61+
MockHttpServletRequest mockRequest = spy(request);
62+
MockHttpServletResponse response = new MockHttpServletResponse();
63+
FilterChain chain = (httpRequest, httpResponse) -> httpResponse.getWriter().write(this.service.getMessage());
64+
65+
this.springSecurityFilterChain.doFilter(mockRequest, response, chain);
66+
67+
verify(mockRequest, never()).getSession(anyBoolean());
68+
verify(mockRequest, never()).getSession();
69+
}
70+
71+
@Configuration
72+
@EnableWebSecurity
73+
@EnableMethodSecurity(prePostEnabled = true)
74+
static class DeferHttpSessionConfig {
75+
76+
@Bean
77+
Service service() {
78+
return new Service();
79+
}
80+
81+
@Bean
82+
DefaultSecurityFilterChain springSecurity(HttpSecurity http) throws Exception {
83+
LazyCsrfTokenRepository csrfRepository = new LazyCsrfTokenRepository(new HttpSessionCsrfTokenRepository());
84+
csrfRepository.setDeferLoadToken(true);
85+
HttpSessionRequestCache requestCache = new HttpSessionRequestCache();
86+
requestCache.setMatchingRequestParameterName("continue");
87+
// @formatter:off
88+
http
89+
.requestCache((cache) -> cache
90+
.requestCache(requestCache)
91+
)
92+
.securityContext((securityContext) -> securityContext
93+
.requireExplicitSave(true)
94+
)
95+
.authorizeHttpRequests((requests) -> requests
96+
.anyRequest().permitAll()
97+
)
98+
.sessionManagement((sessions) -> sessions
99+
.requireExplicitAuthenticationStrategy(true)
100+
)
101+
.csrf((csrf) -> csrf
102+
.csrfRequestAttributeName("_csrf")
103+
.csrfTokenRepository(csrfRepository)
104+
);
105+
// @formatter:on
106+
return http.build();
107+
}
108+
109+
}
110+
111+
public static class Service {
112+
113+
@PreAuthorize("permitAll")
114+
public String getMessage() {
115+
return "message";
116+
}
117+
118+
}
119+
120+
}

‎config/src/test/java/org/springframework/security/config/http/DeferHttpSessionXmlConfigTests.java

+81
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,81 @@
1+
/*
2+
* Copyright 2002-2022 the original author or authors.
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* https://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
package org.springframework.security.config.http;
18+
19+
import javax.servlet.FilterChain;
20+
21+
import org.junit.jupiter.api.Test;
22+
import org.junit.jupiter.api.extension.ExtendWith;
23+
24+
import org.springframework.beans.factory.annotation.Autowired;
25+
import org.springframework.mock.web.MockHttpServletRequest;
26+
import org.springframework.mock.web.MockHttpServletResponse;
27+
import org.springframework.security.access.prepost.PreAuthorize;
28+
import org.springframework.security.config.test.SpringTestContext;
29+
import org.springframework.security.config.test.SpringTestContextExtension;
30+
import org.springframework.security.web.FilterChainProxy;
31+
32+
import static org.mockito.ArgumentMatchers.anyBoolean;
33+
import static org.mockito.Mockito.never;
34+
import static org.mockito.Mockito.spy;
35+
import static org.mockito.Mockito.verify;
36+
37+
/**
38+
* @author Rob Winch
39+
*/
40+
@ExtendWith(SpringTestContextExtension.class)
41+
public class DeferHttpSessionXmlConfigTests {
42+
43+
private static final String CONFIG_LOCATION_PREFIX = "classpath:org/springframework/security/config/http/DeferHttpSessionTests";
44+
45+
@Autowired
46+
FilterChainProxy springSecurityFilterChain;
47+
48+
@Autowired
49+
private Service service;
50+
51+
public final SpringTestContext spring = new SpringTestContext(this);
52+
53+
@Test
54+
public void explicitDeferHttpSession() throws Exception {
55+
this.spring.configLocations(xml("Explicit")).autowire();
56+
57+
MockHttpServletRequest request = new MockHttpServletRequest("GET", "/");
58+
MockHttpServletRequest mockRequest = spy(request);
59+
MockHttpServletResponse response = new MockHttpServletResponse();
60+
FilterChain chain = (httpRequest, httpResponse) -> httpResponse.getWriter().write(this.service.getMessage());
61+
62+
this.springSecurityFilterChain.doFilter(mockRequest, response, chain);
63+
64+
verify(mockRequest, never()).getSession(anyBoolean());
65+
verify(mockRequest, never()).getSession();
66+
}
67+
68+
private static String xml(String configName) {
69+
return CONFIG_LOCATION_PREFIX + "-" + configName + ".xml";
70+
}
71+
72+
public static class Service {
73+
74+
@PreAuthorize("permitAll")
75+
public String getMessage() {
76+
return "message";
77+
}
78+
79+
}
80+
81+
}

‎config/src/test/resources/org/springframework/security/config/http/DeferHttpSessionTests-Explicit.xml

+46
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<!--
3+
~ Copyright 2002-2018 the original author or authors.
4+
~
5+
~ Licensed under the Apache License, Version 2.0 (the "License");
6+
~ you may not use this file except in compliance with the License.
7+
~ You may obtain a copy of the License at
8+
~
9+
~ https://www.apache.org/licenses/LICENSE-2.0
10+
~
11+
~ Unless required by applicable law or agreed to in writing, software
12+
~ distributed under the License is distributed on an "AS IS" BASIS,
13+
~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
~ See the License for the specific language governing permissions and
15+
~ limitations under the License.
16+
-->
17+
18+
<b:beans xmlns:b="http://www.springframework.org/schema/beans"
19+
xmlns:p="http://www.springframework.org/schema/p"
20+
xmlns:c="http://www.springframework.org/schema/c"
21+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
22+
xmlns="http://www.springframework.org/schema/security"
23+
xsi:schemaLocation="http://www.springframework.org/schema/security https://www.springframework.org/schema/security/spring-security.xsd
24+
http://www.springframework.org/schema/beans https://www.springframework.org/schema/beans/spring-beans.xsd">
25+
26+
<method-security pre-post-enabled="true" />
27+
<b:bean class="org.springframework.security.config.http.DeferHttpSessionXmlConfigTests$Service" />
28+
29+
<http auto-config="true"
30+
security-context-explicit-save="true"
31+
use-authorization-manager="true">
32+
<intercept-url pattern="/**" access="permitAll"/>
33+
<csrf request-attribute-name="_csrf"
34+
token-repository-ref="csrfRepository"/>
35+
<request-cache ref="requestCache"/>
36+
<session-management authentication-strategy-explicit-invocation="true"/>
37+
</http>
38+
39+
<b:bean id="requestCache" class="org.springframework.security.web.savedrequest.HttpSessionRequestCache"
40+
p:matchingRequestParameterName="continue"/>
41+
<b:bean id="httpSessionCsrfRepository" class="org.springframework.security.web.csrf.HttpSessionCsrfTokenRepository"/>
42+
<b:bean id="csrfRepository" class="org.springframework.security.web.csrf.LazyCsrfTokenRepository"
43+
c:delegate-ref="httpSessionCsrfRepository"
44+
p:deferLoadToken="true"/>
45+
<b:import resource="CsrfConfigTests-shared-userservice.xml"/>
46+
</b:beans>

0 commit comments

Comments
 (0)