Rob Winch
4 years ago
30 changed files with 421 additions and 329 deletions
@ -1,76 +0,0 @@
@@ -1,76 +0,0 @@
|
||||
/* |
||||
* Copyright 2002-2016 the original author or authors. |
||||
* |
||||
* Licensed under the Apache License, Version 2.0 (the "License"); |
||||
* you may not use this file except in compliance with the License. |
||||
* You may obtain a copy of the License at |
||||
* |
||||
* https://www.apache.org/licenses/LICENSE-2.0
|
||||
* |
||||
* Unless required by applicable law or agreed to in writing, software |
||||
* distributed under the License is distributed on an "AS IS" BASIS, |
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
||||
* See the License for the specific language governing permissions and |
||||
* limitations under the License. |
||||
*/ |
||||
|
||||
package org.springframework.security.test.web.servlet.request; |
||||
|
||||
import org.junit.jupiter.api.Test; |
||||
import org.junit.jupiter.api.extension.ExtendWith; |
||||
|
||||
import org.springframework.beans.factory.annotation.Autowired; |
||||
import org.springframework.context.annotation.Configuration; |
||||
import org.springframework.mock.web.MockHttpServletRequest; |
||||
import org.springframework.security.config.annotation.web.builders.HttpSecurity; |
||||
import org.springframework.security.config.annotation.web.builders.WebSecurity; |
||||
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity; |
||||
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter; |
||||
import org.springframework.security.test.web.support.WebTestUtils; |
||||
import org.springframework.security.web.csrf.CookieCsrfTokenRepository; |
||||
import org.springframework.security.web.csrf.CsrfTokenRepository; |
||||
import org.springframework.test.context.ContextConfiguration; |
||||
import org.springframework.test.context.junit.jupiter.SpringExtension; |
||||
import org.springframework.test.context.web.WebAppConfiguration; |
||||
import org.springframework.web.context.WebApplicationContext; |
||||
|
||||
import static org.assertj.core.api.Assertions.assertThat; |
||||
import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.post; |
||||
|
||||
@ExtendWith(SpringExtension.class) |
||||
@ContextConfiguration |
||||
@WebAppConfiguration |
||||
public class SecurityMockMvcRequestPostProcessorsCsrfDebugFilterTests { |
||||
|
||||
@Autowired |
||||
private WebApplicationContext wac; |
||||
|
||||
// SEC-3836
|
||||
@Test |
||||
public void findCookieCsrfTokenRepository() { |
||||
MockHttpServletRequest request = post("/").buildRequest(this.wac.getServletContext()); |
||||
CsrfTokenRepository csrfTokenRepository = WebTestUtils.getCsrfTokenRepository(request); |
||||
assertThat(csrfTokenRepository).isNotNull(); |
||||
assertThat(csrfTokenRepository).isEqualTo(Config.cookieCsrfTokenRepository); |
||||
} |
||||
|
||||
@Configuration |
||||
@EnableWebSecurity |
||||
static class Config extends WebSecurityConfigurerAdapter { |
||||
|
||||
static CsrfTokenRepository cookieCsrfTokenRepository = new CookieCsrfTokenRepository(); |
||||
|
||||
@Override |
||||
protected void configure(HttpSecurity http) throws Exception { |
||||
http.csrf().csrfTokenRepository(cookieCsrfTokenRepository); |
||||
} |
||||
|
||||
@Override |
||||
public void configure(WebSecurity web) { |
||||
// Enable the DebugFilter
|
||||
web.debug(true); |
||||
} |
||||
|
||||
} |
||||
|
||||
} |
||||
@ -0,0 +1,41 @@
@@ -0,0 +1,41 @@
|
||||
/* |
||||
* Copyright 2002-2022 the original author or authors. |
||||
* |
||||
* Licensed under the Apache License, Version 2.0 (the "License"); |
||||
* you may not use this file except in compliance with the License. |
||||
* You may obtain a copy of the License at |
||||
* |
||||
* https://www.apache.org/licenses/LICENSE-2.0
|
||||
* |
||||
* Unless required by applicable law or agreed to in writing, software |
||||
* distributed under the License is distributed on an "AS IS" BASIS, |
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
||||
* See the License for the specific language governing permissions and |
||||
* limitations under the License. |
||||
*/ |
||||
|
||||
package org.springframework.security.web.csrf; |
||||
|
||||
/** |
||||
* An interface that allows delayed access to a {@link CsrfToken} that may be generated. |
||||
* |
||||
* @author Rob Winch |
||||
* @since 5.8 |
||||
*/ |
||||
public interface DeferredCsrfToken { |
||||
|
||||
/*** |
||||
* Gets the {@link CsrfToken} |
||||
* @return a non-null {@link CsrfToken} |
||||
*/ |
||||
CsrfToken get(); |
||||
|
||||
/** |
||||
* Returns true if {@link #get()} refers to a generated {@link CsrfToken} or false if |
||||
* it already existed. |
||||
* @return true if {@link #get()} refers to a generated {@link CsrfToken} or false if |
||||
* it already existed. |
||||
*/ |
||||
boolean isGenerated(); |
||||
|
||||
} |
||||
@ -0,0 +1,48 @@
@@ -0,0 +1,48 @@
|
||||
/* |
||||
* Copyright 2002-2022 the original author or authors. |
||||
* |
||||
* Licensed under the Apache License, Version 2.0 (the "License"); |
||||
* you may not use this file except in compliance with the License. |
||||
* You may obtain a copy of the License at |
||||
* |
||||
* https://www.apache.org/licenses/LICENSE-2.0
|
||||
* |
||||
* Unless required by applicable law or agreed to in writing, software |
||||
* distributed under the License is distributed on an "AS IS" BASIS, |
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
||||
* See the License for the specific language governing permissions and |
||||
* limitations under the License. |
||||
*/ |
||||
|
||||
package org.springframework.security.web.csrf; |
||||
|
||||
import org.assertj.core.api.AbstractAssert; |
||||
import org.assertj.core.api.Assertions; |
||||
|
||||
/** |
||||
* Assertion for validating the properties on CsrfToken are the same. |
||||
*/ |
||||
public class CsrfTokenAssert extends AbstractAssert<CsrfTokenAssert, CsrfToken> { |
||||
|
||||
protected CsrfTokenAssert(CsrfToken csrfToken) { |
||||
super(csrfToken, CsrfTokenAssert.class); |
||||
} |
||||
|
||||
public static CsrfTokenAssert assertThatCsrfToken(Object csrfToken) { |
||||
return new CsrfTokenAssert((CsrfToken) csrfToken); |
||||
} |
||||
|
||||
public static CsrfTokenAssert assertThat(CsrfToken csrfToken) { |
||||
return new CsrfTokenAssert(csrfToken); |
||||
} |
||||
|
||||
public CsrfTokenAssert isEqualTo(CsrfToken csrfToken) { |
||||
isNotNull(); |
||||
assertThat(csrfToken).isNotNull(); |
||||
Assertions.assertThat(this.actual.getHeaderName()).isEqualTo(csrfToken.getHeaderName()); |
||||
Assertions.assertThat(this.actual.getParameterName()).isEqualTo(csrfToken.getParameterName()); |
||||
Assertions.assertThat(this.actual.getToken()).isEqualTo(csrfToken.getToken()); |
||||
return this; |
||||
} |
||||
|
||||
} |
||||
Loading…
Reference in new issue