Browse Source
Add DSL support for Cross-Origin-Opener-Policy, Cross-Origin-Embedder-Policy and Cross-Origin-Resource-Policy headers Closes gh-9385, gh-10118pull/10603/head
Marcus Da Coregio
4 years ago
committed by
Eleftheria Stein
38 changed files with 2513 additions and 8 deletions
@ -0,0 +1,43 @@
@@ -0,0 +1,43 @@
|
||||
/* |
||||
* Copyright 2002-2021 the original author or authors. |
||||
* |
||||
* Licensed under the Apache License, Version 2.0 (the "License"); |
||||
* you may not use this file except in compliance with the License. |
||||
* You may obtain a copy of the License at |
||||
* |
||||
* https://www.apache.org/licenses/LICENSE-2.0 |
||||
* |
||||
* Unless required by applicable law or agreed to in writing, software |
||||
* distributed under the License is distributed on an "AS IS" BASIS, |
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
||||
* See the License for the specific language governing permissions and |
||||
* limitations under the License. |
||||
*/ |
||||
|
||||
package org.springframework.security.config.annotation.web.headers |
||||
|
||||
import org.springframework.security.config.annotation.web.builders.HttpSecurity |
||||
import org.springframework.security.config.annotation.web.configurers.HeadersConfigurer |
||||
import org.springframework.security.web.header.writers.CrossOriginEmbedderPolicyHeaderWriter |
||||
|
||||
/** |
||||
* A Kotlin DSL to configure the [HttpSecurity] Cross-Origin-Embedder-Policy header using |
||||
* idiomatic Kotlin code. |
||||
* |
||||
* @author Marcus Da Coregio |
||||
* @since 5.7 |
||||
* @property policy the policy to be used in the response header. |
||||
*/ |
||||
@HeadersSecurityMarker |
||||
class CrossOriginEmbedderPolicyDsl { |
||||
|
||||
var policy: CrossOriginEmbedderPolicyHeaderWriter.CrossOriginEmbedderPolicy? = null |
||||
|
||||
internal fun get(): (HeadersConfigurer<HttpSecurity>.CrossOriginEmbedderPolicyConfig) -> Unit { |
||||
return { crossOriginEmbedderPolicy -> |
||||
policy?.also { |
||||
crossOriginEmbedderPolicy.policy(policy) |
||||
} |
||||
} |
||||
} |
||||
} |
||||
@ -0,0 +1,43 @@
@@ -0,0 +1,43 @@
|
||||
/* |
||||
* Copyright 2002-2021 the original author or authors. |
||||
* |
||||
* Licensed under the Apache License, Version 2.0 (the "License"); |
||||
* you may not use this file except in compliance with the License. |
||||
* You may obtain a copy of the License at |
||||
* |
||||
* https://www.apache.org/licenses/LICENSE-2.0 |
||||
* |
||||
* Unless required by applicable law or agreed to in writing, software |
||||
* distributed under the License is distributed on an "AS IS" BASIS, |
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
||||
* See the License for the specific language governing permissions and |
||||
* limitations under the License. |
||||
*/ |
||||
|
||||
package org.springframework.security.config.annotation.web.headers |
||||
|
||||
import org.springframework.security.config.annotation.web.builders.HttpSecurity |
||||
import org.springframework.security.config.annotation.web.configurers.HeadersConfigurer |
||||
import org.springframework.security.web.header.writers.CrossOriginOpenerPolicyHeaderWriter |
||||
|
||||
/** |
||||
* A Kotlin DSL to configure the [HttpSecurity] Cross-Origin-Opener-Policy header using |
||||
* idiomatic Kotlin code. |
||||
* |
||||
* @author Marcus Da Coregio |
||||
* @since 5.7 |
||||
* @property policy the policy to be used in the response header. |
||||
*/ |
||||
@HeadersSecurityMarker |
||||
class CrossOriginOpenerPolicyDsl { |
||||
|
||||
var policy: CrossOriginOpenerPolicyHeaderWriter.CrossOriginOpenerPolicy? = null |
||||
|
||||
internal fun get(): (HeadersConfigurer<HttpSecurity>.CrossOriginOpenerPolicyConfig) -> Unit { |
||||
return { crossOriginOpenerPolicy -> |
||||
policy?.also { |
||||
crossOriginOpenerPolicy.policy(policy) |
||||
} |
||||
} |
||||
} |
||||
} |
||||
@ -0,0 +1,43 @@
@@ -0,0 +1,43 @@
|
||||
/* |
||||
* Copyright 2002-2021 the original author or authors. |
||||
* |
||||
* Licensed under the Apache License, Version 2.0 (the "License"); |
||||
* you may not use this file except in compliance with the License. |
||||
* You may obtain a copy of the License at |
||||
* |
||||
* https://www.apache.org/licenses/LICENSE-2.0 |
||||
* |
||||
* Unless required by applicable law or agreed to in writing, software |
||||
* distributed under the License is distributed on an "AS IS" BASIS, |
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
||||
* See the License for the specific language governing permissions and |
||||
* limitations under the License. |
||||
*/ |
||||
|
||||
package org.springframework.security.config.annotation.web.headers |
||||
|
||||
import org.springframework.security.config.annotation.web.builders.HttpSecurity |
||||
import org.springframework.security.config.annotation.web.configurers.HeadersConfigurer |
||||
import org.springframework.security.web.header.writers.CrossOriginResourcePolicyHeaderWriter |
||||
|
||||
/** |
||||
* A Kotlin DSL to configure the [HttpSecurity] Cross-Origin-Resource-Policy header using |
||||
* idiomatic Kotlin code. |
||||
* |
||||
* @author Marcus Da Coregio |
||||
* @since 5.7 |
||||
* @property policy the policy to be used in the response header. |
||||
*/ |
||||
@HeadersSecurityMarker |
||||
class CrossOriginResourcePolicyDsl { |
||||
|
||||
var policy: CrossOriginResourcePolicyHeaderWriter.CrossOriginResourcePolicy? = null |
||||
|
||||
internal fun get(): (HeadersConfigurer<HttpSecurity>.CrossOriginResourcePolicyConfig) -> Unit { |
||||
return { crossOriginResourcePolicy -> |
||||
policy?.also { |
||||
crossOriginResourcePolicy.policy(policy) |
||||
} |
||||
} |
||||
} |
||||
} |
||||
@ -0,0 +1,42 @@
@@ -0,0 +1,42 @@
|
||||
/* |
||||
* Copyright 2002-2021 the original author or authors. |
||||
* |
||||
* Licensed under the Apache License, Version 2.0 (the "License"); |
||||
* you may not use this file except in compliance with the License. |
||||
* You may obtain a copy of the License at |
||||
* |
||||
* https://www.apache.org/licenses/LICENSE-2.0 |
||||
* |
||||
* Unless required by applicable law or agreed to in writing, software |
||||
* distributed under the License is distributed on an "AS IS" BASIS, |
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
||||
* See the License for the specific language governing permissions and |
||||
* limitations under the License. |
||||
*/ |
||||
|
||||
package org.springframework.security.config.web.server |
||||
|
||||
import org.springframework.security.config.annotation.web.builders.HttpSecurity |
||||
import org.springframework.security.web.server.header.CrossOriginEmbedderPolicyServerHttpHeadersWriter |
||||
|
||||
/** |
||||
* A Kotlin DSL to configure the [HttpSecurity] Cross-Origin-Embedder-Policy header using |
||||
* idiomatic Kotlin code. |
||||
* |
||||
* @author Marcus Da Coregio |
||||
* @since 5.7 |
||||
* @property policy the policy to be used in the response header. |
||||
*/ |
||||
@ServerSecurityMarker |
||||
class ServerCrossOriginEmbedderPolicyDsl { |
||||
|
||||
var policy: CrossOriginEmbedderPolicyServerHttpHeadersWriter.CrossOriginEmbedderPolicy? = null |
||||
|
||||
internal fun get(): (ServerHttpSecurity.HeaderSpec.CrossOriginEmbedderPolicySpec) -> Unit { |
||||
return { crossOriginEmbedderPolicy -> |
||||
policy?.also { |
||||
crossOriginEmbedderPolicy.policy(policy) |
||||
} |
||||
} |
||||
} |
||||
} |
||||
@ -0,0 +1,42 @@
@@ -0,0 +1,42 @@
|
||||
/* |
||||
* Copyright 2002-2021 the original author or authors. |
||||
* |
||||
* Licensed under the Apache License, Version 2.0 (the "License"); |
||||
* you may not use this file except in compliance with the License. |
||||
* You may obtain a copy of the License at |
||||
* |
||||
* https://www.apache.org/licenses/LICENSE-2.0 |
||||
* |
||||
* Unless required by applicable law or agreed to in writing, software |
||||
* distributed under the License is distributed on an "AS IS" BASIS, |
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
||||
* See the License for the specific language governing permissions and |
||||
* limitations under the License. |
||||
*/ |
||||
|
||||
package org.springframework.security.config.web.server |
||||
|
||||
import org.springframework.security.config.annotation.web.builders.HttpSecurity |
||||
import org.springframework.security.web.server.header.CrossOriginOpenerPolicyServerHttpHeadersWriter |
||||
|
||||
/** |
||||
* A Kotlin DSL to configure the [HttpSecurity] Cross-Origin-Opener-Policy header using |
||||
* idiomatic Kotlin code. |
||||
* |
||||
* @author Marcus Da Coregio |
||||
* @since 5.7 |
||||
* @property policy the policy to be used in the response header. |
||||
*/ |
||||
@ServerSecurityMarker |
||||
class ServerCrossOriginOpenerPolicyDsl { |
||||
|
||||
var policy: CrossOriginOpenerPolicyServerHttpHeadersWriter.CrossOriginOpenerPolicy? = null |
||||
|
||||
internal fun get(): (ServerHttpSecurity.HeaderSpec.CrossOriginOpenerPolicySpec) -> Unit { |
||||
return { crossOriginOpenerPolicy -> |
||||
policy?.also { |
||||
crossOriginOpenerPolicy.policy(policy) |
||||
} |
||||
} |
||||
} |
||||
} |
||||
@ -0,0 +1,42 @@
@@ -0,0 +1,42 @@
|
||||
/* |
||||
* Copyright 2002-2021 the original author or authors. |
||||
* |
||||
* Licensed under the Apache License, Version 2.0 (the "License"); |
||||
* you may not use this file except in compliance with the License. |
||||
* You may obtain a copy of the License at |
||||
* |
||||
* https://www.apache.org/licenses/LICENSE-2.0 |
||||
* |
||||
* Unless required by applicable law or agreed to in writing, software |
||||
* distributed under the License is distributed on an "AS IS" BASIS, |
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
||||
* See the License for the specific language governing permissions and |
||||
* limitations under the License. |
||||
*/ |
||||
|
||||
package org.springframework.security.config.web.server |
||||
|
||||
import org.springframework.security.config.annotation.web.builders.HttpSecurity |
||||
import org.springframework.security.web.server.header.CrossOriginResourcePolicyServerHttpHeadersWriter |
||||
|
||||
/** |
||||
* A Kotlin DSL to configure the [HttpSecurity] Cross-Origin-Resource-Policy header using |
||||
* idiomatic Kotlin code. |
||||
* |
||||
* @author Marcus Da Coregio |
||||
* @since 5.7 |
||||
* @property policy the policy to be used in the response header. |
||||
*/ |
||||
@ServerSecurityMarker |
||||
class ServerCrossOriginResourcePolicyDsl { |
||||
|
||||
var policy: CrossOriginResourcePolicyServerHttpHeadersWriter.CrossOriginResourcePolicy? = null |
||||
|
||||
internal fun get(): (ServerHttpSecurity.HeaderSpec.CrossOriginResourcePolicySpec) -> Unit { |
||||
return { crossOriginResourcePolicy -> |
||||
policy?.also { |
||||
crossOriginResourcePolicy.policy(policy) |
||||
} |
||||
} |
||||
} |
||||
} |
||||
@ -0,0 +1,36 @@
@@ -0,0 +1,36 @@
|
||||
<?xml version="1.0" encoding="UTF-8"?> |
||||
<!-- |
||||
~ Copyright 2002-2021 the original author or authors. |
||||
~ |
||||
~ Licensed under the Apache License, Version 2.0 (the "License"); |
||||
~ you may not use this file except in compliance with the License. |
||||
~ You may obtain a copy of the License at |
||||
~ |
||||
~ https://www.apache.org/licenses/LICENSE-2.0 |
||||
~ |
||||
~ Unless required by applicable law or agreed to in writing, software |
||||
~ distributed under the License is distributed on an "AS IS" BASIS, |
||||
~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
||||
~ See the License for the specific language governing permissions and |
||||
~ limitations under the License. |
||||
--> |
||||
|
||||
<b:beans xmlns:b="http://www.springframework.org/schema/beans" |
||||
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" |
||||
xmlns="http://www.springframework.org/schema/security" |
||||
xsi:schemaLocation=" |
||||
http://www.springframework.org/schema/security |
||||
https://www.springframework.org/schema/security/spring-security.xsd |
||||
http://www.springframework.org/schema/beans |
||||
https://www.springframework.org/schema/beans/spring-beans.xsd"> |
||||
|
||||
<http auto-config="true"> |
||||
<headers defaults-disabled="true"> |
||||
<cross-origin-embedder-policy policy="require-corp"/> |
||||
</headers> |
||||
</http> |
||||
|
||||
<b:bean name="simple" class="org.springframework.security.config.http.HttpHeadersConfigTests.SimpleController"/> |
||||
|
||||
<b:import resource="userservice.xml"/> |
||||
</b:beans> |
||||
@ -0,0 +1,36 @@
@@ -0,0 +1,36 @@
|
||||
<?xml version="1.0" encoding="UTF-8"?> |
||||
<!-- |
||||
~ Copyright 2002-2021 the original author or authors. |
||||
~ |
||||
~ Licensed under the Apache License, Version 2.0 (the "License"); |
||||
~ you may not use this file except in compliance with the License. |
||||
~ You may obtain a copy of the License at |
||||
~ |
||||
~ https://www.apache.org/licenses/LICENSE-2.0 |
||||
~ |
||||
~ Unless required by applicable law or agreed to in writing, software |
||||
~ distributed under the License is distributed on an "AS IS" BASIS, |
||||
~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
||||
~ See the License for the specific language governing permissions and |
||||
~ limitations under the License. |
||||
--> |
||||
|
||||
<b:beans xmlns:b="http://www.springframework.org/schema/beans" |
||||
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" |
||||
xmlns="http://www.springframework.org/schema/security" |
||||
xsi:schemaLocation=" |
||||
http://www.springframework.org/schema/security |
||||
https://www.springframework.org/schema/security/spring-security.xsd |
||||
http://www.springframework.org/schema/beans |
||||
https://www.springframework.org/schema/beans/spring-beans.xsd"> |
||||
|
||||
<http auto-config="true"> |
||||
<headers defaults-disabled="true"> |
||||
<cross-origin-opener-policy policy="same-origin-allow-popups"/> |
||||
</headers> |
||||
</http> |
||||
|
||||
<b:bean name="simple" class="org.springframework.security.config.http.HttpHeadersConfigTests.SimpleController"/> |
||||
|
||||
<b:import resource="userservice.xml"/> |
||||
</b:beans> |
||||
@ -0,0 +1,38 @@
@@ -0,0 +1,38 @@
|
||||
<?xml version="1.0" encoding="UTF-8"?> |
||||
<!-- |
||||
~ Copyright 2002-2021 the original author or authors. |
||||
~ |
||||
~ Licensed under the Apache License, Version 2.0 (the "License"); |
||||
~ you may not use this file except in compliance with the License. |
||||
~ You may obtain a copy of the License at |
||||
~ |
||||
~ https://www.apache.org/licenses/LICENSE-2.0 |
||||
~ |
||||
~ Unless required by applicable law or agreed to in writing, software |
||||
~ distributed under the License is distributed on an "AS IS" BASIS, |
||||
~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
||||
~ See the License for the specific language governing permissions and |
||||
~ limitations under the License. |
||||
--> |
||||
|
||||
<b:beans xmlns:b="http://www.springframework.org/schema/beans" |
||||
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" |
||||
xmlns="http://www.springframework.org/schema/security" |
||||
xsi:schemaLocation=" |
||||
http://www.springframework.org/schema/security |
||||
https://www.springframework.org/schema/security/spring-security.xsd |
||||
http://www.springframework.org/schema/beans |
||||
https://www.springframework.org/schema/beans/spring-beans.xsd"> |
||||
|
||||
<http auto-config="true"> |
||||
<headers defaults-disabled="true"> |
||||
<cross-origin-opener-policy policy="same-origin"/> |
||||
<cross-origin-embedder-policy policy="require-corp"/> |
||||
<cross-origin-resource-policy policy="same-origin"/> |
||||
</headers> |
||||
</http> |
||||
|
||||
<b:bean name="simple" class="org.springframework.security.config.http.HttpHeadersConfigTests.SimpleController"/> |
||||
|
||||
<b:import resource="userservice.xml"/> |
||||
</b:beans> |
||||
@ -0,0 +1,36 @@
@@ -0,0 +1,36 @@
|
||||
<?xml version="1.0" encoding="UTF-8"?> |
||||
<!-- |
||||
~ Copyright 2002-2021 the original author or authors. |
||||
~ |
||||
~ Licensed under the Apache License, Version 2.0 (the "License"); |
||||
~ you may not use this file except in compliance with the License. |
||||
~ You may obtain a copy of the License at |
||||
~ |
||||
~ https://www.apache.org/licenses/LICENSE-2.0 |
||||
~ |
||||
~ Unless required by applicable law or agreed to in writing, software |
||||
~ distributed under the License is distributed on an "AS IS" BASIS, |
||||
~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
||||
~ See the License for the specific language governing permissions and |
||||
~ limitations under the License. |
||||
--> |
||||
|
||||
<b:beans xmlns:b="http://www.springframework.org/schema/beans" |
||||
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" |
||||
xmlns="http://www.springframework.org/schema/security" |
||||
xsi:schemaLocation=" |
||||
http://www.springframework.org/schema/security |
||||
https://www.springframework.org/schema/security/spring-security.xsd |
||||
http://www.springframework.org/schema/beans |
||||
https://www.springframework.org/schema/beans/spring-beans.xsd"> |
||||
|
||||
<http auto-config="true"> |
||||
<headers defaults-disabled="true"> |
||||
<cross-origin-resource-policy policy="same-origin"/> |
||||
</headers> |
||||
</http> |
||||
|
||||
<b:bean name="simple" class="org.springframework.security.config.http.HttpHeadersConfigTests.SimpleController"/> |
||||
|
||||
<b:import resource="userservice.xml"/> |
||||
</b:beans> |
||||
@ -0,0 +1,84 @@
@@ -0,0 +1,84 @@
|
||||
/* |
||||
* Copyright 2002-2021 the original author or authors. |
||||
* |
||||
* Licensed under the Apache License, Version 2.0 (the "License"); |
||||
* you may not use this file except in compliance with the License. |
||||
* You may obtain a copy of the License at |
||||
* |
||||
* https://www.apache.org/licenses/LICENSE-2.0
|
||||
* |
||||
* Unless required by applicable law or agreed to in writing, software |
||||
* distributed under the License is distributed on an "AS IS" BASIS, |
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
||||
* See the License for the specific language governing permissions and |
||||
* limitations under the License. |
||||
*/ |
||||
|
||||
package org.springframework.security.web.header.writers; |
||||
|
||||
import javax.servlet.http.HttpServletRequest; |
||||
import javax.servlet.http.HttpServletResponse; |
||||
|
||||
import org.springframework.security.web.header.HeaderWriter; |
||||
import org.springframework.util.Assert; |
||||
|
||||
/** |
||||
* Inserts Cross-Origin-Embedder-Policy header. |
||||
* |
||||
* @author Marcus Da Coregio |
||||
* @since 5.7 |
||||
* @see <a href= |
||||
* "https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cross-Origin-Embedder-Policy"> |
||||
* Cross-Origin-Embedder-Policy</a> |
||||
*/ |
||||
public final class CrossOriginEmbedderPolicyHeaderWriter implements HeaderWriter { |
||||
|
||||
private static final String EMBEDDER_POLICY = "Cross-Origin-Embedder-Policy"; |
||||
|
||||
private CrossOriginEmbedderPolicy policy; |
||||
|
||||
/** |
||||
* Sets the {@link CrossOriginEmbedderPolicy} value to be used in the |
||||
* {@code Cross-Origin-Embedder-Policy} header |
||||
* @param embedderPolicy the {@link CrossOriginEmbedderPolicy} to use |
||||
*/ |
||||
public void setPolicy(CrossOriginEmbedderPolicy embedderPolicy) { |
||||
Assert.notNull(embedderPolicy, "embedderPolicy cannot be null"); |
||||
this.policy = embedderPolicy; |
||||
} |
||||
|
||||
@Override |
||||
public void writeHeaders(HttpServletRequest request, HttpServletResponse response) { |
||||
if (this.policy != null && !response.containsHeader(EMBEDDER_POLICY)) { |
||||
response.addHeader(EMBEDDER_POLICY, this.policy.getPolicy()); |
||||
} |
||||
} |
||||
|
||||
public enum CrossOriginEmbedderPolicy { |
||||
|
||||
UNSAFE_NONE("unsafe-none"), |
||||
|
||||
REQUIRE_CORP("require-corp"); |
||||
|
||||
private final String policy; |
||||
|
||||
CrossOriginEmbedderPolicy(String policy) { |
||||
this.policy = policy; |
||||
} |
||||
|
||||
public String getPolicy() { |
||||
return this.policy; |
||||
} |
||||
|
||||
public static CrossOriginEmbedderPolicy from(String embedderPolicy) { |
||||
for (CrossOriginEmbedderPolicy policy : values()) { |
||||
if (policy.getPolicy().equals(embedderPolicy)) { |
||||
return policy; |
||||
} |
||||
} |
||||
return null; |
||||
} |
||||
|
||||
} |
||||
|
||||
} |
||||
@ -0,0 +1,86 @@
@@ -0,0 +1,86 @@
|
||||
/* |
||||
* Copyright 2002-2021 the original author or authors. |
||||
* |
||||
* Licensed under the Apache License, Version 2.0 (the "License"); |
||||
* you may not use this file except in compliance with the License. |
||||
* You may obtain a copy of the License at |
||||
* |
||||
* https://www.apache.org/licenses/LICENSE-2.0
|
||||
* |
||||
* Unless required by applicable law or agreed to in writing, software |
||||
* distributed under the License is distributed on an "AS IS" BASIS, |
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
||||
* See the License for the specific language governing permissions and |
||||
* limitations under the License. |
||||
*/ |
||||
|
||||
package org.springframework.security.web.header.writers; |
||||
|
||||
import javax.servlet.http.HttpServletRequest; |
||||
import javax.servlet.http.HttpServletResponse; |
||||
|
||||
import org.springframework.security.web.header.HeaderWriter; |
||||
import org.springframework.util.Assert; |
||||
|
||||
/** |
||||
* Inserts the Cross-Origin-Opener-Policy header |
||||
* |
||||
* @author Marcus Da Coregio |
||||
* @since 5.7 |
||||
* @see <a href= |
||||
* "https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cross-Origin-Opener-Policy"> |
||||
* Cross-Origin-Opener-Policy</a> |
||||
*/ |
||||
public final class CrossOriginOpenerPolicyHeaderWriter implements HeaderWriter { |
||||
|
||||
private static final String OPENER_POLICY = "Cross-Origin-Opener-Policy"; |
||||
|
||||
private CrossOriginOpenerPolicy policy; |
||||
|
||||
/** |
||||
* Sets the {@link CrossOriginOpenerPolicy} value to be used in the |
||||
* {@code Cross-Origin-Opener-Policy} header |
||||
* @param openerPolicy the {@link CrossOriginOpenerPolicy} to use |
||||
*/ |
||||
public void setPolicy(CrossOriginOpenerPolicy openerPolicy) { |
||||
Assert.notNull(openerPolicy, "openerPolicy cannot be null"); |
||||
this.policy = openerPolicy; |
||||
} |
||||
|
||||
@Override |
||||
public void writeHeaders(HttpServletRequest request, HttpServletResponse response) { |
||||
if (this.policy != null && !response.containsHeader(OPENER_POLICY)) { |
||||
response.addHeader(OPENER_POLICY, this.policy.getPolicy()); |
||||
} |
||||
} |
||||
|
||||
public enum CrossOriginOpenerPolicy { |
||||
|
||||
UNSAFE_NONE("unsafe-none"), |
||||
|
||||
SAME_ORIGIN_ALLOW_POPUPS("same-origin-allow-popups"), |
||||
|
||||
SAME_ORIGIN("same-origin"); |
||||
|
||||
private final String policy; |
||||
|
||||
CrossOriginOpenerPolicy(String policy) { |
||||
this.policy = policy; |
||||
} |
||||
|
||||
public String getPolicy() { |
||||
return this.policy; |
||||
} |
||||
|
||||
public static CrossOriginOpenerPolicy from(String openerPolicy) { |
||||
for (CrossOriginOpenerPolicy policy : values()) { |
||||
if (policy.getPolicy().equals(openerPolicy)) { |
||||
return policy; |
||||
} |
||||
} |
||||
return null; |
||||
} |
||||
|
||||
} |
||||
|
||||
} |
||||
@ -0,0 +1,86 @@
@@ -0,0 +1,86 @@
|
||||
/* |
||||
* Copyright 2002-2021 the original author or authors. |
||||
* |
||||
* Licensed under the Apache License, Version 2.0 (the "License"); |
||||
* you may not use this file except in compliance with the License. |
||||
* You may obtain a copy of the License at |
||||
* |
||||
* https://www.apache.org/licenses/LICENSE-2.0
|
||||
* |
||||
* Unless required by applicable law or agreed to in writing, software |
||||
* distributed under the License is distributed on an "AS IS" BASIS, |
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
||||
* See the License for the specific language governing permissions and |
||||
* limitations under the License. |
||||
*/ |
||||
|
||||
package org.springframework.security.web.header.writers; |
||||
|
||||
import javax.servlet.http.HttpServletRequest; |
||||
import javax.servlet.http.HttpServletResponse; |
||||
|
||||
import org.springframework.security.web.header.HeaderWriter; |
||||
import org.springframework.util.Assert; |
||||
|
||||
/** |
||||
* Inserts Cross-Origin-Resource-Policy header |
||||
* |
||||
* @author Marcus Da Coregio |
||||
* @since 5.7 |
||||
* @see <a href= |
||||
* "https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cross-Origin-Resource-Policy"> |
||||
* Cross-Origin-Resource-Policy</a> |
||||
*/ |
||||
public final class CrossOriginResourcePolicyHeaderWriter implements HeaderWriter { |
||||
|
||||
private static final String RESOURCE_POLICY = "Cross-Origin-Resource-Policy"; |
||||
|
||||
private CrossOriginResourcePolicy policy; |
||||
|
||||
/** |
||||
* Sets the {@link CrossOriginResourcePolicy} value to be used in the |
||||
* {@code Cross-Origin-Resource-Policy} header |
||||
* @param resourcePolicy the {@link CrossOriginResourcePolicy} to use |
||||
*/ |
||||
public void setPolicy(CrossOriginResourcePolicy resourcePolicy) { |
||||
Assert.notNull(resourcePolicy, "resourcePolicy cannot be null"); |
||||
this.policy = resourcePolicy; |
||||
} |
||||
|
||||
@Override |
||||
public void writeHeaders(HttpServletRequest request, HttpServletResponse response) { |
||||
if (this.policy != null && !response.containsHeader(RESOURCE_POLICY)) { |
||||
response.addHeader(RESOURCE_POLICY, this.policy.getPolicy()); |
||||
} |
||||
} |
||||
|
||||
public enum CrossOriginResourcePolicy { |
||||
|
||||
SAME_SITE("same-site"), |
||||
|
||||
SAME_ORIGIN("same-origin"), |
||||
|
||||
CROSS_ORIGIN("cross-origin"); |
||||
|
||||
private final String policy; |
||||
|
||||
CrossOriginResourcePolicy(String policy) { |
||||
this.policy = policy; |
||||
} |
||||
|
||||
public String getPolicy() { |
||||
return this.policy; |
||||
} |
||||
|
||||
public static CrossOriginResourcePolicy from(String resourcePolicy) { |
||||
for (CrossOriginResourcePolicy policy : values()) { |
||||
if (policy.getPolicy().equals(resourcePolicy)) { |
||||
return policy; |
||||
} |
||||
} |
||||
return null; |
||||
} |
||||
|
||||
} |
||||
|
||||
} |
||||
@ -0,0 +1,78 @@
@@ -0,0 +1,78 @@
|
||||
/* |
||||
* Copyright 2002-2021 the original author or authors. |
||||
* |
||||
* Licensed under the Apache License, Version 2.0 (the "License"); |
||||
* you may not use this file except in compliance with the License. |
||||
* You may obtain a copy of the License at |
||||
* |
||||
* https://www.apache.org/licenses/LICENSE-2.0
|
||||
* |
||||
* Unless required by applicable law or agreed to in writing, software |
||||
* distributed under the License is distributed on an "AS IS" BASIS, |
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
||||
* See the License for the specific language governing permissions and |
||||
* limitations under the License. |
||||
*/ |
||||
|
||||
package org.springframework.security.web.server.header; |
||||
|
||||
import reactor.core.publisher.Mono; |
||||
|
||||
import org.springframework.util.Assert; |
||||
import org.springframework.web.server.ServerWebExchange; |
||||
|
||||
/** |
||||
* Inserts Cross-Origin-Embedder-Policy headers. |
||||
* |
||||
* @author Marcus Da Coregio |
||||
* @since 5.7 |
||||
* @see <a href= |
||||
* "https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cross-Origin-Embedder-Policy"> |
||||
* Cross-Origin-Embedder-Policy</a> |
||||
*/ |
||||
public final class CrossOriginEmbedderPolicyServerHttpHeadersWriter implements ServerHttpHeadersWriter { |
||||
|
||||
public static final String EMBEDDER_POLICY = "Cross-Origin-Embedder-Policy"; |
||||
|
||||
private ServerHttpHeadersWriter delegate; |
||||
|
||||
/** |
||||
* Sets the {@link CrossOriginEmbedderPolicy} value to be used in the |
||||
* {@code Cross-Origin-Embedder-Policy} header |
||||
* @param embedderPolicy the {@link CrossOriginEmbedderPolicy} to use |
||||
*/ |
||||
public void setPolicy(CrossOriginEmbedderPolicy embedderPolicy) { |
||||
Assert.notNull(embedderPolicy, "embedderPolicy cannot be null"); |
||||
this.delegate = createDelegate(embedderPolicy); |
||||
} |
||||
|
||||
@Override |
||||
public Mono<Void> writeHttpHeaders(ServerWebExchange exchange) { |
||||
return (this.delegate != null) ? this.delegate.writeHttpHeaders(exchange) : Mono.empty(); |
||||
} |
||||
|
||||
private static ServerHttpHeadersWriter createDelegate(CrossOriginEmbedderPolicy embedderPolicy) { |
||||
StaticServerHttpHeadersWriter.Builder builder = StaticServerHttpHeadersWriter.builder(); |
||||
builder.header(EMBEDDER_POLICY, embedderPolicy.getPolicy()); |
||||
return builder.build(); |
||||
} |
||||
|
||||
public enum CrossOriginEmbedderPolicy { |
||||
|
||||
UNSAFE_NONE("unsafe-none"), |
||||
|
||||
REQUIRE_CORP("require-corp"); |
||||
|
||||
private final String policy; |
||||
|
||||
CrossOriginEmbedderPolicy(String policy) { |
||||
this.policy = policy; |
||||
} |
||||
|
||||
public String getPolicy() { |
||||
return this.policy; |
||||
} |
||||
|
||||
} |
||||
|
||||
} |
||||
@ -0,0 +1,80 @@
@@ -0,0 +1,80 @@
|
||||
/* |
||||
* Copyright 2002-2021 the original author or authors. |
||||
* |
||||
* Licensed under the Apache License, Version 2.0 (the "License"); |
||||
* you may not use this file except in compliance with the License. |
||||
* You may obtain a copy of the License at |
||||
* |
||||
* https://www.apache.org/licenses/LICENSE-2.0
|
||||
* |
||||
* Unless required by applicable law or agreed to in writing, software |
||||
* distributed under the License is distributed on an "AS IS" BASIS, |
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
||||
* See the License for the specific language governing permissions and |
||||
* limitations under the License. |
||||
*/ |
||||
|
||||
package org.springframework.security.web.server.header; |
||||
|
||||
import reactor.core.publisher.Mono; |
||||
|
||||
import org.springframework.util.Assert; |
||||
import org.springframework.web.server.ServerWebExchange; |
||||
|
||||
/** |
||||
* Inserts Cross-Origin-Opener-Policy header. |
||||
* |
||||
* @author Marcus Da Coregio |
||||
* @since 5.7 |
||||
* @see <a href= |
||||
* "https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cross-Origin-Opener-Policy"> |
||||
* Cross-Origin-Opener-Policy</a> |
||||
*/ |
||||
public final class CrossOriginOpenerPolicyServerHttpHeadersWriter implements ServerHttpHeadersWriter { |
||||
|
||||
public static final String OPENER_POLICY = "Cross-Origin-Opener-Policy"; |
||||
|
||||
private ServerHttpHeadersWriter delegate; |
||||
|
||||
/** |
||||
* Sets the {@link CrossOriginOpenerPolicy} value to be used in the |
||||
* {@code Cross-Origin-Opener-Policy} header |
||||
* @param openerPolicy the {@link CrossOriginOpenerPolicy} to use |
||||
*/ |
||||
public void setPolicy(CrossOriginOpenerPolicy openerPolicy) { |
||||
Assert.notNull(openerPolicy, "openerPolicy cannot be null"); |
||||
this.delegate = createDelegate(openerPolicy); |
||||
} |
||||
|
||||
@Override |
||||
public Mono<Void> writeHttpHeaders(ServerWebExchange exchange) { |
||||
return (this.delegate != null) ? this.delegate.writeHttpHeaders(exchange) : Mono.empty(); |
||||
} |
||||
|
||||
private static ServerHttpHeadersWriter createDelegate(CrossOriginOpenerPolicy openerPolicy) { |
||||
StaticServerHttpHeadersWriter.Builder builder = StaticServerHttpHeadersWriter.builder(); |
||||
builder.header(OPENER_POLICY, openerPolicy.getPolicy()); |
||||
return builder.build(); |
||||
} |
||||
|
||||
public enum CrossOriginOpenerPolicy { |
||||
|
||||
UNSAFE_NONE("unsafe-none"), |
||||
|
||||
SAME_ORIGIN_ALLOW_POPUPS("same-origin-allow-popups"), |
||||
|
||||
SAME_ORIGIN("same-origin"); |
||||
|
||||
private final String policy; |
||||
|
||||
CrossOriginOpenerPolicy(String policy) { |
||||
this.policy = policy; |
||||
} |
||||
|
||||
public String getPolicy() { |
||||
return this.policy; |
||||
} |
||||
|
||||
} |
||||
|
||||
} |
||||
@ -0,0 +1,80 @@
@@ -0,0 +1,80 @@
|
||||
/* |
||||
* Copyright 2002-2021 the original author or authors. |
||||
* |
||||
* Licensed under the Apache License, Version 2.0 (the "License"); |
||||
* you may not use this file except in compliance with the License. |
||||
* You may obtain a copy of the License at |
||||
* |
||||
* https://www.apache.org/licenses/LICENSE-2.0
|
||||
* |
||||
* Unless required by applicable law or agreed to in writing, software |
||||
* distributed under the License is distributed on an "AS IS" BASIS, |
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
||||
* See the License for the specific language governing permissions and |
||||
* limitations under the License. |
||||
*/ |
||||
|
||||
package org.springframework.security.web.server.header; |
||||
|
||||
import reactor.core.publisher.Mono; |
||||
|
||||
import org.springframework.util.Assert; |
||||
import org.springframework.web.server.ServerWebExchange; |
||||
|
||||
/** |
||||
* Inserts Cross-Origin-Resource-Policy headers. |
||||
* |
||||
* @author Marcus Da Coregio |
||||
* @since 5.7 |
||||
* @see <a href= |
||||
* "https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cross-Origin-Resource-Policy"> |
||||
* Cross-Origin-Resource-Policy</a> |
||||
*/ |
||||
public final class CrossOriginResourcePolicyServerHttpHeadersWriter implements ServerHttpHeadersWriter { |
||||
|
||||
public static final String RESOURCE_POLICY = "Cross-Origin-Resource-Policy"; |
||||
|
||||
private ServerHttpHeadersWriter delegate; |
||||
|
||||
/** |
||||
* Sets the {@link CrossOriginResourcePolicy} value to be used in the |
||||
* {@code Cross-Origin-Embedder-Policy} header |
||||
* @param resourcePolicy the {@link CrossOriginResourcePolicy} to use |
||||
*/ |
||||
public void setPolicy(CrossOriginResourcePolicy resourcePolicy) { |
||||
Assert.notNull(resourcePolicy, "resourcePolicy cannot be null"); |
||||
this.delegate = createDelegate(resourcePolicy); |
||||
} |
||||
|
||||
@Override |
||||
public Mono<Void> writeHttpHeaders(ServerWebExchange exchange) { |
||||
return (this.delegate != null) ? this.delegate.writeHttpHeaders(exchange) : Mono.empty(); |
||||
} |
||||
|
||||
private static ServerHttpHeadersWriter createDelegate(CrossOriginResourcePolicy resourcePolicy) { |
||||
StaticServerHttpHeadersWriter.Builder builder = StaticServerHttpHeadersWriter.builder(); |
||||
builder.header(RESOURCE_POLICY, resourcePolicy.getPolicy()); |
||||
return builder.build(); |
||||
} |
||||
|
||||
public enum CrossOriginResourcePolicy { |
||||
|
||||
SAME_SITE("same-site"), |
||||
|
||||
SAME_ORIGIN("same-origin"), |
||||
|
||||
CROSS_ORIGIN("cross-origin"); |
||||
|
||||
private final String policy; |
||||
|
||||
CrossOriginResourcePolicy(String policy) { |
||||
this.policy = policy; |
||||
} |
||||
|
||||
public String getPolicy() { |
||||
return this.policy; |
||||
} |
||||
|
||||
} |
||||
|
||||
} |
||||
@ -0,0 +1,80 @@
@@ -0,0 +1,80 @@
|
||||
/* |
||||
* Copyright 2002-2021 the original author or authors. |
||||
* |
||||
* Licensed under the Apache License, Version 2.0 (the "License"); |
||||
* you may not use this file except in compliance with the License. |
||||
* You may obtain a copy of the License at |
||||
* |
||||
* https://www.apache.org/licenses/LICENSE-2.0
|
||||
* |
||||
* Unless required by applicable law or agreed to in writing, software |
||||
* distributed under the License is distributed on an "AS IS" BASIS, |
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
||||
* See the License for the specific language governing permissions and |
||||
* limitations under the License. |
||||
*/ |
||||
|
||||
package org.springframework.security.web.header.writers; |
||||
|
||||
import org.junit.jupiter.api.BeforeEach; |
||||
import org.junit.jupiter.api.Test; |
||||
|
||||
import org.springframework.mock.web.MockHttpServletRequest; |
||||
import org.springframework.mock.web.MockHttpServletResponse; |
||||
|
||||
import static org.assertj.core.api.Assertions.assertThat; |
||||
import static org.assertj.core.api.Assertions.assertThatIllegalArgumentException; |
||||
|
||||
class CrossOriginEmbedderPolicyHeaderWriterTests { |
||||
|
||||
private static final String EMBEDDER_HEADER_NAME = "Cross-Origin-Embedder-Policy"; |
||||
|
||||
private CrossOriginEmbedderPolicyHeaderWriter writer; |
||||
|
||||
private MockHttpServletRequest request; |
||||
|
||||
private MockHttpServletResponse response; |
||||
|
||||
@BeforeEach |
||||
void setup() { |
||||
this.writer = new CrossOriginEmbedderPolicyHeaderWriter(); |
||||
this.request = new MockHttpServletRequest(); |
||||
this.response = new MockHttpServletResponse(); |
||||
} |
||||
|
||||
@Test |
||||
void setEmbedderPolicyWhenNullEmbedderPolicyThenThrowsIllegalArgument() { |
||||
assertThatIllegalArgumentException().isThrownBy(() -> this.writer.setPolicy(null)) |
||||
.withMessage("embedderPolicy cannot be null"); |
||||
} |
||||
|
||||
@Test |
||||
void writeHeadersWhenDefaultValuesThenDontWriteHeaders() { |
||||
this.writer.writeHeaders(this.request, this.response); |
||||
assertThat(this.response.getHeaderNames()).hasSize(0); |
||||
} |
||||
|
||||
@Test |
||||
void writeHeadersWhenResponseHeaderExistsThenDontOverride() { |
||||
this.response.addHeader(EMBEDDER_HEADER_NAME, "require-corp"); |
||||
this.writer.setPolicy(CrossOriginEmbedderPolicyHeaderWriter.CrossOriginEmbedderPolicy.UNSAFE_NONE); |
||||
this.writer.writeHeaders(this.request, this.response); |
||||
assertThat(this.response.getHeader(EMBEDDER_HEADER_NAME)).isEqualTo("require-corp"); |
||||
} |
||||
|
||||
@Test |
||||
void writeHeadersWhenSetHeaderValuesThenWrites() { |
||||
this.writer.setPolicy(CrossOriginEmbedderPolicyHeaderWriter.CrossOriginEmbedderPolicy.REQUIRE_CORP); |
||||
this.writer.writeHeaders(this.request, this.response); |
||||
assertThat(this.response.getHeader(EMBEDDER_HEADER_NAME)).isEqualTo("require-corp"); |
||||
} |
||||
|
||||
@Test |
||||
void writeHeadersWhenSetEmbedderPolicyThenWritesEmbedderPolicy() { |
||||
this.writer.setPolicy(CrossOriginEmbedderPolicyHeaderWriter.CrossOriginEmbedderPolicy.UNSAFE_NONE); |
||||
this.writer.writeHeaders(this.request, this.response); |
||||
assertThat(this.response.getHeaderNames()).hasSize(1); |
||||
assertThat(this.response.getHeader(EMBEDDER_HEADER_NAME)).isEqualTo("unsafe-none"); |
||||
} |
||||
|
||||
} |
||||
@ -0,0 +1,80 @@
@@ -0,0 +1,80 @@
|
||||
/* |
||||
* Copyright 2002-2021 the original author or authors. |
||||
* |
||||
* Licensed under the Apache License, Version 2.0 (the "License"); |
||||
* you may not use this file except in compliance with the License. |
||||
* You may obtain a copy of the License at |
||||
* |
||||
* https://www.apache.org/licenses/LICENSE-2.0
|
||||
* |
||||
* Unless required by applicable law or agreed to in writing, software |
||||
* distributed under the License is distributed on an "AS IS" BASIS, |
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
||||
* See the License for the specific language governing permissions and |
||||
* limitations under the License. |
||||
*/ |
||||
|
||||
package org.springframework.security.web.header.writers; |
||||
|
||||
import org.junit.jupiter.api.BeforeEach; |
||||
import org.junit.jupiter.api.Test; |
||||
|
||||
import org.springframework.mock.web.MockHttpServletRequest; |
||||
import org.springframework.mock.web.MockHttpServletResponse; |
||||
|
||||
import static org.assertj.core.api.Assertions.assertThat; |
||||
import static org.assertj.core.api.Assertions.assertThatIllegalArgumentException; |
||||
|
||||
class CrossOriginOpenerPolicyHeaderWriterTests { |
||||
|
||||
private static final String OPENER_HEADER_NAME = "Cross-Origin-Opener-Policy"; |
||||
|
||||
private CrossOriginOpenerPolicyHeaderWriter writer; |
||||
|
||||
private MockHttpServletRequest request; |
||||
|
||||
private MockHttpServletResponse response; |
||||
|
||||
@BeforeEach |
||||
void setup() { |
||||
this.writer = new CrossOriginOpenerPolicyHeaderWriter(); |
||||
this.request = new MockHttpServletRequest(); |
||||
this.response = new MockHttpServletResponse(); |
||||
} |
||||
|
||||
@Test |
||||
void setOpenerPolicyWhenNullOpenerPolicyThenThrowsIllegalArgument() { |
||||
assertThatIllegalArgumentException().isThrownBy(() -> this.writer.setPolicy(null)) |
||||
.withMessage("openerPolicy cannot be null"); |
||||
} |
||||
|
||||
@Test |
||||
void writeHeadersWhenDefaultValuesThenDontWriteHeaders() { |
||||
this.writer.writeHeaders(this.request, this.response); |
||||
assertThat(this.response.getHeaderNames()).hasSize(0); |
||||
} |
||||
|
||||
@Test |
||||
void writeHeadersWhenResponseHeaderExistsThenDontOverride() { |
||||
this.response.addHeader(OPENER_HEADER_NAME, "same-origin"); |
||||
this.writer.setPolicy(CrossOriginOpenerPolicyHeaderWriter.CrossOriginOpenerPolicy.SAME_ORIGIN_ALLOW_POPUPS); |
||||
this.writer.writeHeaders(this.request, this.response); |
||||
assertThat(this.response.getHeader(OPENER_HEADER_NAME)).isEqualTo("same-origin"); |
||||
} |
||||
|
||||
@Test |
||||
void writeHeadersWhenSetHeaderValuesThenWrites() { |
||||
this.writer.setPolicy(CrossOriginOpenerPolicyHeaderWriter.CrossOriginOpenerPolicy.SAME_ORIGIN_ALLOW_POPUPS); |
||||
this.writer.writeHeaders(this.request, this.response); |
||||
assertThat(this.response.getHeader(OPENER_HEADER_NAME)).isEqualTo("same-origin-allow-popups"); |
||||
} |
||||
|
||||
@Test |
||||
void writeHeadersWhenSetOpenerPolicyThenWritesOpenerPolicy() { |
||||
this.writer.setPolicy(CrossOriginOpenerPolicyHeaderWriter.CrossOriginOpenerPolicy.SAME_ORIGIN_ALLOW_POPUPS); |
||||
this.writer.writeHeaders(this.request, this.response); |
||||
assertThat(this.response.getHeaderNames()).hasSize(1); |
||||
assertThat(this.response.getHeader(OPENER_HEADER_NAME)).isEqualTo("same-origin-allow-popups"); |
||||
} |
||||
|
||||
} |
||||
@ -0,0 +1,80 @@
@@ -0,0 +1,80 @@
|
||||
/* |
||||
* Copyright 2002-2021 the original author or authors. |
||||
* |
||||
* Licensed under the Apache License, Version 2.0 (the "License"); |
||||
* you may not use this file except in compliance with the License. |
||||
* You may obtain a copy of the License at |
||||
* |
||||
* https://www.apache.org/licenses/LICENSE-2.0
|
||||
* |
||||
* Unless required by applicable law or agreed to in writing, software |
||||
* distributed under the License is distributed on an "AS IS" BASIS, |
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
||||
* See the License for the specific language governing permissions and |
||||
* limitations under the License. |
||||
*/ |
||||
|
||||
package org.springframework.security.web.header.writers; |
||||
|
||||
import org.junit.jupiter.api.BeforeEach; |
||||
import org.junit.jupiter.api.Test; |
||||
|
||||
import org.springframework.mock.web.MockHttpServletRequest; |
||||
import org.springframework.mock.web.MockHttpServletResponse; |
||||
|
||||
import static org.assertj.core.api.Assertions.assertThat; |
||||
import static org.assertj.core.api.Assertions.assertThatIllegalArgumentException; |
||||
|
||||
class CrossOriginResourcePolicyHeaderWriterTests { |
||||
|
||||
private static final String RESOURCE_HEADER_NAME = "Cross-Origin-Resource-Policy"; |
||||
|
||||
private CrossOriginResourcePolicyHeaderWriter writer; |
||||
|
||||
private MockHttpServletRequest request; |
||||
|
||||
private MockHttpServletResponse response; |
||||
|
||||
@BeforeEach |
||||
void setup() { |
||||
this.writer = new CrossOriginResourcePolicyHeaderWriter(); |
||||
this.request = new MockHttpServletRequest(); |
||||
this.response = new MockHttpServletResponse(); |
||||
} |
||||
|
||||
@Test |
||||
void setResourcePolicyWhenNullThenThrowsIllegalArgument() { |
||||
assertThatIllegalArgumentException().isThrownBy(() -> this.writer.setPolicy(null)) |
||||
.withMessage("resourcePolicy cannot be null"); |
||||
} |
||||
|
||||
@Test |
||||
void writeHeadersWhenDefaultValuesThenDontWriteHeaders() { |
||||
this.writer.writeHeaders(this.request, this.response); |
||||
assertThat(this.response.getHeaderNames()).hasSize(0); |
||||
} |
||||
|
||||
@Test |
||||
void writeHeadersWhenResponseHeaderExistsThenDontOverride() { |
||||
this.response.addHeader(RESOURCE_HEADER_NAME, "same-site"); |
||||
this.writer.setPolicy(CrossOriginResourcePolicyHeaderWriter.CrossOriginResourcePolicy.CROSS_ORIGIN); |
||||
this.writer.writeHeaders(this.request, this.response); |
||||
assertThat(this.response.getHeader(RESOURCE_HEADER_NAME)).isEqualTo("same-site"); |
||||
} |
||||
|
||||
@Test |
||||
void writeHeadersWhenSetHeaderValuesThenWrites() { |
||||
this.writer.setPolicy(CrossOriginResourcePolicyHeaderWriter.CrossOriginResourcePolicy.SAME_ORIGIN); |
||||
this.writer.writeHeaders(this.request, this.response); |
||||
assertThat(this.response.getHeader(RESOURCE_HEADER_NAME)).isEqualTo("same-origin"); |
||||
} |
||||
|
||||
@Test |
||||
void writeHeadersWhenSetResourcePolicyThenWritesResourcePolicy() { |
||||
this.writer.setPolicy(CrossOriginResourcePolicyHeaderWriter.CrossOriginResourcePolicy.SAME_SITE); |
||||
this.writer.writeHeaders(this.request, this.response); |
||||
assertThat(this.response.getHeaderNames()).hasSize(1); |
||||
assertThat(this.response.getHeader(RESOURCE_HEADER_NAME)).isEqualTo("same-site"); |
||||
} |
||||
|
||||
} |
||||
@ -0,0 +1,76 @@
@@ -0,0 +1,76 @@
|
||||
/* |
||||
* Copyright 2002-2021 the original author or authors. |
||||
* |
||||
* Licensed under the Apache License, Version 2.0 (the "License"); |
||||
* you may not use this file except in compliance with the License. |
||||
* You may obtain a copy of the License at |
||||
* |
||||
* https://www.apache.org/licenses/LICENSE-2.0
|
||||
* |
||||
* Unless required by applicable law or agreed to in writing, software |
||||
* distributed under the License is distributed on an "AS IS" BASIS, |
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
||||
* See the License for the specific language governing permissions and |
||||
* limitations under the License. |
||||
*/ |
||||
|
||||
package org.springframework.security.web.server.header; |
||||
|
||||
import org.junit.jupiter.api.BeforeEach; |
||||
import org.junit.jupiter.api.Test; |
||||
|
||||
import org.springframework.http.HttpHeaders; |
||||
import org.springframework.mock.http.server.reactive.MockServerHttpRequest; |
||||
import org.springframework.mock.web.server.MockServerWebExchange; |
||||
import org.springframework.web.server.ServerWebExchange; |
||||
|
||||
import static org.assertj.core.api.Assertions.assertThat; |
||||
import static org.assertj.core.api.Assertions.assertThatIllegalArgumentException; |
||||
|
||||
class CrossOriginEmbedderPolicyServerHttpHeadersWriterTests { |
||||
|
||||
private ServerWebExchange exchange; |
||||
|
||||
private CrossOriginEmbedderPolicyServerHttpHeadersWriter writer; |
||||
|
||||
@BeforeEach |
||||
void setup() { |
||||
this.exchange = MockServerWebExchange.from(MockServerHttpRequest.get("/")); |
||||
this.writer = new CrossOriginEmbedderPolicyServerHttpHeadersWriter(); |
||||
} |
||||
|
||||
@Test |
||||
void setEmbedderPolicyWhenNullEmbedderPolicyThenThrowsIllegalArgument() { |
||||
assertThatIllegalArgumentException().isThrownBy(() -> this.writer.setPolicy(null)) |
||||
.withMessage("embedderPolicy cannot be null"); |
||||
} |
||||
|
||||
@Test |
||||
void writeHeadersWhenNoValuesThenDoesNotWriteHeaders() { |
||||
this.writer.writeHttpHeaders(this.exchange); |
||||
HttpHeaders headers = this.exchange.getResponse().getHeaders(); |
||||
assertThat(headers).isEmpty(); |
||||
} |
||||
|
||||
@Test |
||||
void writeHeadersWhenResponseHeaderExistsThenDontOverride() { |
||||
this.exchange.getResponse().getHeaders().add(CrossOriginEmbedderPolicyServerHttpHeadersWriter.EMBEDDER_POLICY, |
||||
"require-corp"); |
||||
this.writer.writeHttpHeaders(this.exchange); |
||||
HttpHeaders headers = this.exchange.getResponse().getHeaders(); |
||||
assertThat(headers).hasSize(1); |
||||
assertThat(headers.get(CrossOriginEmbedderPolicyServerHttpHeadersWriter.EMBEDDER_POLICY)) |
||||
.containsOnly("require-corp"); |
||||
} |
||||
|
||||
@Test |
||||
void writeHeadersWhenSetHeaderValuesThenWrites() { |
||||
this.writer.setPolicy(CrossOriginEmbedderPolicyServerHttpHeadersWriter.CrossOriginEmbedderPolicy.REQUIRE_CORP); |
||||
this.writer.writeHttpHeaders(this.exchange); |
||||
HttpHeaders headers = this.exchange.getResponse().getHeaders(); |
||||
assertThat(headers).hasSize(1); |
||||
assertThat(headers.get(CrossOriginEmbedderPolicyServerHttpHeadersWriter.EMBEDDER_POLICY)) |
||||
.containsOnly("require-corp"); |
||||
} |
||||
|
||||
} |
||||
@ -0,0 +1,77 @@
@@ -0,0 +1,77 @@
|
||||
/* |
||||
* Copyright 2002-2021 the original author or authors. |
||||
* |
||||
* Licensed under the Apache License, Version 2.0 (the "License"); |
||||
* you may not use this file except in compliance with the License. |
||||
* You may obtain a copy of the License at |
||||
* |
||||
* https://www.apache.org/licenses/LICENSE-2.0
|
||||
* |
||||
* Unless required by applicable law or agreed to in writing, software |
||||
* distributed under the License is distributed on an "AS IS" BASIS, |
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
||||
* See the License for the specific language governing permissions and |
||||
* limitations under the License. |
||||
*/ |
||||
|
||||
package org.springframework.security.web.server.header; |
||||
|
||||
import org.junit.jupiter.api.BeforeEach; |
||||
import org.junit.jupiter.api.Test; |
||||
|
||||
import org.springframework.http.HttpHeaders; |
||||
import org.springframework.mock.http.server.reactive.MockServerHttpRequest; |
||||
import org.springframework.mock.web.server.MockServerWebExchange; |
||||
import org.springframework.web.server.ServerWebExchange; |
||||
|
||||
import static org.assertj.core.api.Assertions.assertThat; |
||||
import static org.assertj.core.api.Assertions.assertThatIllegalArgumentException; |
||||
|
||||
class CrossOriginOpenerPolicyServerHttpHeadersWriterTests { |
||||
|
||||
private ServerWebExchange exchange; |
||||
|
||||
private CrossOriginOpenerPolicyServerHttpHeadersWriter writer; |
||||
|
||||
@BeforeEach |
||||
void setup() { |
||||
this.exchange = MockServerWebExchange.from(MockServerHttpRequest.get("/")); |
||||
this.writer = new CrossOriginOpenerPolicyServerHttpHeadersWriter(); |
||||
} |
||||
|
||||
@Test |
||||
void setOpenerPolicyWhenNullOpenerPolicyThenThrowsIllegalArgument() { |
||||
assertThatIllegalArgumentException().isThrownBy(() -> this.writer.setPolicy(null)) |
||||
.withMessage("openerPolicy cannot be null"); |
||||
} |
||||
|
||||
@Test |
||||
void writeHeadersWhenNoValuesThenDoesNotWriteHeaders() { |
||||
this.writer.writeHttpHeaders(this.exchange); |
||||
HttpHeaders headers = this.exchange.getResponse().getHeaders(); |
||||
assertThat(headers).isEmpty(); |
||||
} |
||||
|
||||
@Test |
||||
void writeHeadersWhenResponseHeaderExistsThenDontOverride() { |
||||
this.exchange.getResponse().getHeaders().add(CrossOriginOpenerPolicyServerHttpHeadersWriter.OPENER_POLICY, |
||||
"same-origin"); |
||||
this.writer.writeHttpHeaders(this.exchange); |
||||
HttpHeaders headers = this.exchange.getResponse().getHeaders(); |
||||
assertThat(headers).hasSize(1); |
||||
assertThat(headers.get(CrossOriginOpenerPolicyServerHttpHeadersWriter.OPENER_POLICY)) |
||||
.containsOnly("same-origin"); |
||||
} |
||||
|
||||
@Test |
||||
void writeHeadersWhenSetHeaderValuesThenWrites() { |
||||
this.writer.setPolicy( |
||||
CrossOriginOpenerPolicyServerHttpHeadersWriter.CrossOriginOpenerPolicy.SAME_ORIGIN_ALLOW_POPUPS); |
||||
this.writer.writeHttpHeaders(this.exchange); |
||||
HttpHeaders headers = this.exchange.getResponse().getHeaders(); |
||||
assertThat(headers).hasSize(1); |
||||
assertThat(headers.get(CrossOriginOpenerPolicyServerHttpHeadersWriter.OPENER_POLICY)) |
||||
.containsOnly("same-origin-allow-popups"); |
||||
} |
||||
|
||||
} |
||||
@ -0,0 +1,76 @@
@@ -0,0 +1,76 @@
|
||||
/* |
||||
* Copyright 2002-2021 the original author or authors. |
||||
* |
||||
* Licensed under the Apache License, Version 2.0 (the "License"); |
||||
* you may not use this file except in compliance with the License. |
||||
* You may obtain a copy of the License at |
||||
* |
||||
* https://www.apache.org/licenses/LICENSE-2.0
|
||||
* |
||||
* Unless required by applicable law or agreed to in writing, software |
||||
* distributed under the License is distributed on an "AS IS" BASIS, |
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
||||
* See the License for the specific language governing permissions and |
||||
* limitations under the License. |
||||
*/ |
||||
|
||||
package org.springframework.security.web.server.header; |
||||
|
||||
import org.junit.jupiter.api.BeforeEach; |
||||
import org.junit.jupiter.api.Test; |
||||
|
||||
import org.springframework.http.HttpHeaders; |
||||
import org.springframework.mock.http.server.reactive.MockServerHttpRequest; |
||||
import org.springframework.mock.web.server.MockServerWebExchange; |
||||
import org.springframework.web.server.ServerWebExchange; |
||||
|
||||
import static org.assertj.core.api.Assertions.assertThat; |
||||
import static org.assertj.core.api.Assertions.assertThatIllegalArgumentException; |
||||
|
||||
class CrossOriginResourcePolicyServerHttpHeadersWriterTests { |
||||
|
||||
private ServerWebExchange exchange; |
||||
|
||||
private CrossOriginResourcePolicyServerHttpHeadersWriter writer; |
||||
|
||||
@BeforeEach |
||||
void setup() { |
||||
this.exchange = MockServerWebExchange.from(MockServerHttpRequest.get("/")); |
||||
this.writer = new CrossOriginResourcePolicyServerHttpHeadersWriter(); |
||||
} |
||||
|
||||
@Test |
||||
void setResourcePolicyWhenNullThenThrowsIllegalArgument() { |
||||
assertThatIllegalArgumentException().isThrownBy(() -> this.writer.setPolicy(null)) |
||||
.withMessage("resourcePolicy cannot be null"); |
||||
} |
||||
|
||||
@Test |
||||
void writeHeadersWhenNoValuesThenDoesNotWriteHeaders() { |
||||
this.writer.writeHttpHeaders(this.exchange); |
||||
HttpHeaders headers = this.exchange.getResponse().getHeaders(); |
||||
assertThat(headers).isEmpty(); |
||||
} |
||||
|
||||
@Test |
||||
void writeHeadersWhenResponseHeaderExistsThenDontOverride() { |
||||
this.exchange.getResponse().getHeaders().add(CrossOriginResourcePolicyServerHttpHeadersWriter.RESOURCE_POLICY, |
||||
"same-origin"); |
||||
this.writer.writeHttpHeaders(this.exchange); |
||||
HttpHeaders headers = this.exchange.getResponse().getHeaders(); |
||||
assertThat(headers).hasSize(1); |
||||
assertThat(headers.get(CrossOriginResourcePolicyServerHttpHeadersWriter.RESOURCE_POLICY)) |
||||
.containsOnly("same-origin"); |
||||
} |
||||
|
||||
@Test |
||||
void writeHeadersWhenSetHeaderValuesThenWrites() { |
||||
this.writer.setPolicy(CrossOriginResourcePolicyServerHttpHeadersWriter.CrossOriginResourcePolicy.SAME_ORIGIN); |
||||
this.writer.writeHttpHeaders(this.exchange); |
||||
HttpHeaders headers = this.exchange.getResponse().getHeaders(); |
||||
assertThat(headers).hasSize(1); |
||||
assertThat(headers.get(CrossOriginResourcePolicyServerHttpHeadersWriter.RESOURCE_POLICY)) |
||||
.containsOnly("same-origin"); |
||||
} |
||||
|
||||
} |
||||
Loading…
Reference in new issue