Skip to content

Commit 888c65a

Browse files
rwinchrwinch
committed
Add DeferHttpSession*Tests
Closes gh-6125
1 parent 81d6b6d commit 888c65a

File tree

3 files changed

+245
-0
lines changed

3 files changed

+245
-0
lines changed

Diff for: ‎config/src/test/java/org/springframework/security/config/annotation/web/configuration/DeferHttpSessionJavaConfigTests.java

+119
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,119 @@
1+
/*
2+
* Copyright 2002-2022 the original author or authors.
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* https://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
package org.springframework.security.config.annotation.web.configuration;
18+
19+
import jakarta.servlet.FilterChain;
20+
import org.junit.jupiter.api.Test;
21+
import org.junit.jupiter.api.extension.ExtendWith;
22+
23+
import org.springframework.beans.factory.annotation.Autowired;
24+
import org.springframework.context.annotation.Bean;
25+
import org.springframework.context.annotation.Configuration;
26+
import org.springframework.mock.web.MockHttpServletRequest;
27+
import org.springframework.mock.web.MockHttpServletResponse;
28+
import org.springframework.security.access.prepost.PreAuthorize;
29+
import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity;
30+
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
31+
import org.springframework.security.config.test.SpringTestContext;
32+
import org.springframework.security.config.test.SpringTestContextExtension;
33+
import org.springframework.security.web.DefaultSecurityFilterChain;
34+
import org.springframework.security.web.FilterChainProxy;
35+
import org.springframework.security.web.csrf.HttpSessionCsrfTokenRepository;
36+
import org.springframework.security.web.csrf.LazyCsrfTokenRepository;
37+
import org.springframework.security.web.savedrequest.HttpSessionRequestCache;
38+
39+
import static org.mockito.ArgumentMatchers.anyBoolean;
40+
import static org.mockito.Mockito.never;
41+
import static org.mockito.Mockito.spy;
42+
import static org.mockito.Mockito.verify;
43+
44+
@ExtendWith(SpringTestContextExtension.class)
45+
public class DeferHttpSessionJavaConfigTests {
46+
47+
@Autowired
48+
private FilterChainProxy springSecurityFilterChain;
49+
50+
@Autowired
51+
private Service service;
52+
53+
public final SpringTestContext spring = new SpringTestContext(this);
54+
55+
@Test
56+
public void explicitDeferHttpSession() throws Exception {
57+
this.spring.register(DeferHttpSessionConfig.class).autowire();
58+
59+
MockHttpServletRequest request = new MockHttpServletRequest("GET", "/");
60+
MockHttpServletRequest mockRequest = spy(request);
61+
MockHttpServletResponse response = new MockHttpServletResponse();
62+
FilterChain chain = (httpRequest, httpResponse) -> httpResponse.getWriter().write(this.service.getMessage());
63+
64+
this.springSecurityFilterChain.doFilter(mockRequest, response, chain);
65+
66+
verify(mockRequest, never()).getSession(anyBoolean());
67+
verify(mockRequest, never()).getSession();
68+
}
69+
70+
@Configuration
71+
@EnableWebSecurity
72+
@EnableMethodSecurity(prePostEnabled = true)
73+
static class DeferHttpSessionConfig {
74+
75+
@Bean
76+
Service service() {
77+
return new Service();
78+
}
79+
80+
@Bean
81+
DefaultSecurityFilterChain springSecurity(HttpSecurity http) throws Exception {
82+
LazyCsrfTokenRepository csrfRepository = new LazyCsrfTokenRepository(new HttpSessionCsrfTokenRepository());
83+
csrfRepository.setDeferLoadToken(true);
84+
HttpSessionRequestCache requestCache = new HttpSessionRequestCache();
85+
requestCache.setMatchingRequestParameterName("continue");
86+
// @formatter:off
87+
http
88+
.requestCache((cache) -> cache
89+
.requestCache(requestCache)
90+
)
91+
.securityContext((securityContext) -> securityContext
92+
.requireExplicitSave(true)
93+
)
94+
.authorizeHttpRequests((requests) -> requests
95+
.anyRequest().permitAll()
96+
)
97+
.sessionManagement((sessions) -> sessions
98+
.requireExplicitAuthenticationStrategy(true)
99+
)
100+
.csrf((csrf) -> csrf
101+
.csrfRequestAttributeName("_csrf")
102+
.csrfTokenRepository(csrfRepository)
103+
);
104+
// @formatter:on
105+
return http.build();
106+
}
107+
108+
}
109+
110+
public static class Service {
111+
112+
@PreAuthorize("permitAll")
113+
public String getMessage() {
114+
return "message";
115+
}
116+
117+
}
118+
119+
}

Diff for: ‎config/src/test/java/org/springframework/security/config/http/DeferHttpSessionXmlConfigTests.java

+80
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,80 @@
1+
/*
2+
* Copyright 2002-2022 the original author or authors.
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* https://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
package org.springframework.security.config.http;
18+
19+
import jakarta.servlet.FilterChain;
20+
import org.junit.jupiter.api.Test;
21+
import org.junit.jupiter.api.extension.ExtendWith;
22+
23+
import org.springframework.beans.factory.annotation.Autowired;
24+
import org.springframework.mock.web.MockHttpServletRequest;
25+
import org.springframework.mock.web.MockHttpServletResponse;
26+
import org.springframework.security.access.prepost.PreAuthorize;
27+
import org.springframework.security.config.test.SpringTestContext;
28+
import org.springframework.security.config.test.SpringTestContextExtension;
29+
import org.springframework.security.web.FilterChainProxy;
30+
31+
import static org.mockito.ArgumentMatchers.anyBoolean;
32+
import static org.mockito.Mockito.never;
33+
import static org.mockito.Mockito.spy;
34+
import static org.mockito.Mockito.verify;
35+
36+
/**
37+
* @author Rob Winch
38+
*/
39+
@ExtendWith(SpringTestContextExtension.class)
40+
public class DeferHttpSessionXmlConfigTests {
41+
42+
private static final String CONFIG_LOCATION_PREFIX = "classpath:org/springframework/security/config/http/DeferHttpSessionTests";
43+
44+
@Autowired
45+
FilterChainProxy springSecurityFilterChain;
46+
47+
@Autowired
48+
private Service service;
49+
50+
public final SpringTestContext spring = new SpringTestContext(this);
51+
52+
@Test
53+
public void explicitDeferHttpSession() throws Exception {
54+
this.spring.configLocations(xml("Explicit")).autowire();
55+
56+
MockHttpServletRequest request = new MockHttpServletRequest("GET", "/");
57+
MockHttpServletRequest mockRequest = spy(request);
58+
MockHttpServletResponse response = new MockHttpServletResponse();
59+
FilterChain chain = (httpRequest, httpResponse) -> httpResponse.getWriter().write(this.service.getMessage());
60+
61+
this.springSecurityFilterChain.doFilter(mockRequest, response, chain);
62+
63+
verify(mockRequest, never()).getSession(anyBoolean());
64+
verify(mockRequest, never()).getSession();
65+
}
66+
67+
private static String xml(String configName) {
68+
return CONFIG_LOCATION_PREFIX + "-" + configName + ".xml";
69+
}
70+
71+
public static class Service {
72+
73+
@PreAuthorize("permitAll")
74+
public String getMessage() {
75+
return "message";
76+
}
77+
78+
}
79+
80+
}

Diff for: ‎config/src/test/resources/org/springframework/security/config/http/DeferHttpSessionTests-Explicit.xml

+46
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<!--
3+
~ Copyright 2002-2018 the original author or authors.
4+
~
5+
~ Licensed under the Apache License, Version 2.0 (the "License");
6+
~ you may not use this file except in compliance with the License.
7+
~ You may obtain a copy of the License at
8+
~
9+
~ https://www.apache.org/licenses/LICENSE-2.0
10+
~
11+
~ Unless required by applicable law or agreed to in writing, software
12+
~ distributed under the License is distributed on an "AS IS" BASIS,
13+
~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
~ See the License for the specific language governing permissions and
15+
~ limitations under the License.
16+
-->
17+
18+
<b:beans xmlns:b="http://www.springframework.org/schema/beans"
19+
xmlns:p="http://www.springframework.org/schema/p"
20+
xmlns:c="http://www.springframework.org/schema/c"
21+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
22+
xmlns="http://www.springframework.org/schema/security"
23+
xsi:schemaLocation="http://www.springframework.org/schema/security https://www.springframework.org/schema/security/spring-security.xsd
24+
http://www.springframework.org/schema/beans https://www.springframework.org/schema/beans/spring-beans.xsd">
25+
26+
<method-security pre-post-enabled="true" />
27+
<b:bean class="org.springframework.security.config.http.DeferHttpSessionXmlConfigTests$Service" />
28+
29+
<http auto-config="true"
30+
security-context-explicit-save="true"
31+
use-authorization-manager="true">
32+
<intercept-url pattern="/**" access="permitAll"/>
33+
<csrf request-attribute-name="_csrf"
34+
token-repository-ref="csrfRepository"/>
35+
<request-cache ref="requestCache"/>
36+
<session-management authentication-strategy-explicit-invocation="true"/>
37+
</http>
38+
39+
<b:bean id="requestCache" class="org.springframework.security.web.savedrequest.HttpSessionRequestCache"
40+
p:matchingRequestParameterName="continue"/>
41+
<b:bean id="httpSessionCsrfRepository" class="org.springframework.security.web.csrf.HttpSessionCsrfTokenRepository"/>
42+
<b:bean id="csrfRepository" class="org.springframework.security.web.csrf.LazyCsrfTokenRepository"
43+
c:delegate-ref="httpSessionCsrfRepository"
44+
p:deferLoadToken="true"/>
45+
<b:import resource="CsrfConfigTests-shared-userservice.xml"/>
46+
</b:beans>

0 commit comments

Comments
 (0)