Browse Source
Added JavaConfig for Headers. In the process, more HeaderWriter instances were added so that we can reuse logic between the XML and JavaConfig. This also prompted repackaging the writers.pull/38/head
Rob Winch
13 years ago
38 changed files with 1038 additions and 156 deletions
@ -0,0 +1,98 @@
@@ -0,0 +1,98 @@
|
||||
/* |
||||
* Copyright 2002-2013 the original author or authors. |
||||
* |
||||
* Licensed under the Apache License, Version 2.0 (the "License"); |
||||
* you may not use this file except in compliance with the License. |
||||
* You may obtain a copy of the License at |
||||
* |
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
* |
||||
* Unless required by applicable law or agreed to in writing, software |
||||
* distributed under the License is distributed on an "AS IS" BASIS, |
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
||||
* See the License for the specific language governing permissions and |
||||
* limitations under the License. |
||||
*/ |
||||
package org.springframework.security.config.annotation.web.configurers; |
||||
|
||||
import java.util.ArrayList; |
||||
import java.util.List; |
||||
|
||||
import org.springframework.security.config.annotation.web.HttpSecurityBuilder; |
||||
import org.springframework.security.config.annotation.web.builders.HttpSecurity; |
||||
import org.springframework.security.web.header.HeaderWriter; |
||||
import org.springframework.security.web.header.HeaderWriterFilter; |
||||
import org.springframework.security.web.header.writers.CacheControlHeadersWriter; |
||||
import org.springframework.security.web.header.writers.HstsHeaderWriter; |
||||
import org.springframework.security.web.header.writers.XContentTypeOptionsHeaderWriter; |
||||
import org.springframework.security.web.header.writers.XXssProtectionHeaderWriter; |
||||
import org.springframework.security.web.header.writers.frameoptions.XFrameOptionsHeaderWriter; |
||||
import org.springframework.util.Assert; |
||||
|
||||
/** |
||||
* @author Rob Winch |
||||
* @since 3.2 |
||||
* @see RememberMeConfigurer |
||||
*/ |
||||
public final class HeadersConfigurer<H extends HttpSecurityBuilder<H>> extends AbstractHttpConfigurer<H> { |
||||
private List<HeaderWriter> headerWriters = new ArrayList<HeaderWriter>(); |
||||
|
||||
/** |
||||
* Creates a new instance |
||||
* @see HttpSecurity#headers() |
||||
*/ |
||||
public HeadersConfigurer() { |
||||
} |
||||
|
||||
/** |
||||
* Adds a {@link HeaderWriter} instance |
||||
* @param headerWriter the {@link HeaderWriter} instance to add |
||||
* @return the {@link HeadersConfigurer} for additional customizations |
||||
*/ |
||||
public HeadersConfigurer<H> addHeaderWriter(HeaderWriter headerWriter) { |
||||
Assert.notNull(headerWriter, "headerWriter cannot be null"); |
||||
this.headerWriters.add(headerWriter); |
||||
return this; |
||||
} |
||||
|
||||
@Override |
||||
public void configure(H http) throws Exception { |
||||
HeaderWriterFilter headersFilter = createHeaderWriterFilter(); |
||||
http.addFilter(headersFilter); |
||||
} |
||||
|
||||
/** |
||||
* Creates the {@link HeaderWriter} |
||||
* @return the {@link HeaderWriter} |
||||
*/ |
||||
private HeaderWriterFilter createHeaderWriterFilter() { |
||||
HeaderWriterFilter headersFilter = new HeaderWriterFilter(getHeaderWriters()); |
||||
headersFilter = postProcess(headersFilter); |
||||
return headersFilter; |
||||
} |
||||
|
||||
/** |
||||
* Gets the {@link HeaderWriter} instances and possibly initializes with the defaults. |
||||
* @return |
||||
*/ |
||||
private List<HeaderWriter> getHeaderWriters() { |
||||
if(headerWriters.isEmpty()) { |
||||
addDefaultHeaderWriters(); |
||||
} |
||||
return headerWriters; |
||||
} |
||||
|
||||
/** |
||||
* Explicitly adds the default {@link HeaderWriter} instances. If no, |
||||
* {@link HeaderWriter} instances have been added this is automatically |
||||
* invoked. |
||||
* |
||||
*/ |
||||
private void addDefaultHeaderWriters() { |
||||
headerWriters.add(new XContentTypeOptionsHeaderWriter()); |
||||
headerWriters.add(new XXssProtectionHeaderWriter()); |
||||
headerWriters.add(new CacheControlHeadersWriter()); |
||||
headerWriters.add(new HstsHeaderWriter()); |
||||
headerWriters.add(new XFrameOptionsHeaderWriter()); |
||||
} |
||||
} |
||||
@ -0,0 +1,248 @@
@@ -0,0 +1,248 @@
|
||||
/* |
||||
* Copyright 2002-2013 the original author or authors. |
||||
* |
||||
* Licensed under the Apache License, Version 2.0 (the "License"); |
||||
* you may not use this file except in compliance with the License. |
||||
* You may obtain a copy of the License at |
||||
* |
||||
* http://www.apache.org/licenses/LICENSE-2.0 |
||||
* |
||||
* Unless required by applicable law or agreed to in writing, software |
||||
* distributed under the License is distributed on an "AS IS" BASIS, |
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
||||
* See the License for the specific language governing permissions and |
||||
* limitations under the License. |
||||
*/ |
||||
package org.springframework.security.config.annotation.web.configurers; |
||||
|
||||
import org.springframework.context.annotation.Configuration |
||||
import org.springframework.security.config.annotation.BaseSpringSpec |
||||
import org.springframework.security.config.annotation.web.builders.HttpSecurity |
||||
import org.springframework.security.config.annotation.web.configuration.BaseWebConfig |
||||
import org.springframework.security.web.header.writers.CacheControlHeadersWriter |
||||
import org.springframework.security.web.header.writers.HstsHeaderWriter |
||||
import org.springframework.security.web.header.writers.StaticHeadersWriter |
||||
import org.springframework.security.web.header.writers.XContentTypeOptionsHeaderWriter |
||||
import org.springframework.security.web.header.writers.XXssProtectionHeaderWriter |
||||
import org.springframework.security.web.header.writers.frameoptions.StaticAllowFromStrategy |
||||
import org.springframework.security.web.header.writers.frameoptions.XFrameOptionsHeaderWriter |
||||
import org.springframework.security.web.header.writers.frameoptions.XFrameOptionsHeaderWriter.XFrameOptionsMode |
||||
import org.springframework.security.web.util.AnyRequestMatcher |
||||
|
||||
/** |
||||
* Tests to verify that all the functionality of <headers> attributes is present |
||||
* |
||||
* @author Rob Winch |
||||
* |
||||
*/ |
||||
public class NamespaceHttpHeadersTests extends BaseSpringSpec { |
||||
def "http/headers"() { |
||||
setup: |
||||
loadConfig(HeadersDefaultConfig) |
||||
request.secure = true |
||||
when: |
||||
springSecurityFilterChain.doFilter(request,response,chain) |
||||
then: |
||||
responseHeaders == ['X-Content-Type-Options':'nosniff', |
||||
'X-Frame-Options':'DENY', |
||||
'Strict-Transport-Security': 'max-age=31536000 ; includeSubDomains', |
||||
'Cache-Control': 'no-cache,no-store,max-age=0,must-revalidate', |
||||
'Pragma':'no-cache', |
||||
'X-XSS-Protection' : '1; mode=block'] |
||||
} |
||||
|
||||
@Configuration |
||||
static class HeadersDefaultConfig extends BaseWebConfig { |
||||
@Override |
||||
protected void configure(HttpSecurity http) { |
||||
http |
||||
.headers() |
||||
} |
||||
} |
||||
|
||||
def "http/headers/cache-control"() { |
||||
setup: |
||||
loadConfig(HeadersCacheControlConfig) |
||||
request.secure = true |
||||
when: |
||||
springSecurityFilterChain.doFilter(request,response,chain) |
||||
then: |
||||
responseHeaders == ['Cache-Control': 'no-cache,no-store,max-age=0,must-revalidate', |
||||
'Pragma':'no-cache'] |
||||
} |
||||
|
||||
@Configuration |
||||
static class HeadersCacheControlConfig extends BaseWebConfig { |
||||
@Override |
||||
protected void configure(HttpSecurity http) { |
||||
http |
||||
.headers() |
||||
.addHeaderWriter(new CacheControlHeadersWriter()) |
||||
} |
||||
} |
||||
|
||||
def "http/headers/hsts"() { |
||||
setup: |
||||
loadConfig(HstsConfig) |
||||
request.secure = true |
||||
when: |
||||
springSecurityFilterChain.doFilter(request,response,chain) |
||||
then: |
||||
responseHeaders == ['Strict-Transport-Security': 'max-age=31536000 ; includeSubDomains'] |
||||
} |
||||
|
||||
@Configuration |
||||
static class HstsConfig extends BaseWebConfig { |
||||
@Override |
||||
protected void configure(HttpSecurity http) { |
||||
http |
||||
.headers() |
||||
.addHeaderWriter(new HstsHeaderWriter()) |
||||
} |
||||
} |
||||
|
||||
def "http/headers/hsts custom"() { |
||||
setup: |
||||
loadConfig(HstsCustomConfig) |
||||
when: |
||||
springSecurityFilterChain.doFilter(request,response,chain) |
||||
then: |
||||
responseHeaders == ['Strict-Transport-Security': 'max-age=15768000'] |
||||
} |
||||
|
||||
@Configuration |
||||
static class HstsCustomConfig extends BaseWebConfig { |
||||
@Override |
||||
protected void configure(HttpSecurity http) { |
||||
http |
||||
.headers() |
||||
// hsts@request-matcher-ref, hsts@max-age-seconds, hsts@include-subdomains |
||||
// Additional Constructors are provided to leverage default values |
||||
.addHeaderWriter(new HstsHeaderWriter(new AnyRequestMatcher(), 15768000, false)) |
||||
} |
||||
} |
||||
|
||||
def "http/headers/frame-options@policy=SAMEORIGIN"() { |
||||
setup: |
||||
loadConfig(FrameOptionsSameOriginConfig) |
||||
when: |
||||
springSecurityFilterChain.doFilter(request,response,chain) |
||||
then: |
||||
responseHeaders == ['X-Frame-Options': 'SAMEORIGIN'] |
||||
} |
||||
|
||||
@Configuration |
||||
static class FrameOptionsSameOriginConfig extends BaseWebConfig { |
||||
@Override |
||||
protected void configure(HttpSecurity http) { |
||||
http |
||||
.headers() |
||||
// frame-options@policy=SAMEORIGIN |
||||
.addHeaderWriter(new XFrameOptionsHeaderWriter(XFrameOptionsMode.SAMEORIGIN)) |
||||
} |
||||
} |
||||
|
||||
// frame-options@strategy, frame-options@value, frame-options@parameter are not provided instead use frame-options@ref |
||||
|
||||
def "http/headers/frame-options"() { |
||||
setup: |
||||
loadConfig(FrameOptionsAllowFromConfig) |
||||
when: |
||||
springSecurityFilterChain.doFilter(request,response,chain) |
||||
then: |
||||
responseHeaders == ['X-Frame-Options': 'ALLOW-FROM https://example.com'] |
||||
} |
||||
|
||||
|
||||
@Configuration |
||||
static class FrameOptionsAllowFromConfig extends BaseWebConfig { |
||||
@Override |
||||
protected void configure(HttpSecurity http) { |
||||
http |
||||
.headers() |
||||
// frame-options@ref |
||||
.addHeaderWriter(new XFrameOptionsHeaderWriter(new StaticAllowFromStrategy(new URI("https://example.com")))) |
||||
} |
||||
} |
||||
|
||||
def "http/headers/xss-protection"() { |
||||
setup: |
||||
loadConfig(XssProtectionConfig) |
||||
when: |
||||
springSecurityFilterChain.doFilter(request,response,chain) |
||||
then: |
||||
responseHeaders == ['X-XSS-Protection': '1; mode=block'] |
||||
} |
||||
|
||||
@Configuration |
||||
static class XssProtectionConfig extends BaseWebConfig { |
||||
@Override |
||||
protected void configure(HttpSecurity http) { |
||||
http |
||||
.headers() |
||||
// xss-protection |
||||
.addHeaderWriter(new XXssProtectionHeaderWriter()) |
||||
} |
||||
} |
||||
|
||||
def "http/headers/xss-protection custom"() { |
||||
setup: |
||||
loadConfig(XssProtectionCustomConfig) |
||||
when: |
||||
springSecurityFilterChain.doFilter(request,response,chain) |
||||
then: |
||||
responseHeaders == ['X-XSS-Protection': '1'] |
||||
} |
||||
|
||||
@Configuration |
||||
static class XssProtectionCustomConfig extends BaseWebConfig { |
||||
@Override |
||||
protected void configure(HttpSecurity http) { |
||||
http |
||||
.headers() |
||||
// xss-protection@enabled and xss-protection@block |
||||
.addHeaderWriter(new XXssProtectionHeaderWriter(enabled:true,block:false)) |
||||
} |
||||
} |
||||
|
||||
def "http/headers/content-type-options"() { |
||||
setup: |
||||
loadConfig(ContentTypeOptionsConfig) |
||||
when: |
||||
springSecurityFilterChain.doFilter(request,response,chain) |
||||
then: |
||||
responseHeaders == ['X-Content-Type-Options': 'nosniff'] |
||||
} |
||||
|
||||
@Configuration |
||||
static class ContentTypeOptionsConfig extends BaseWebConfig { |
||||
@Override |
||||
protected void configure(HttpSecurity http) { |
||||
http |
||||
.headers() |
||||
// content-type-options |
||||
.addHeaderWriter(new XContentTypeOptionsHeaderWriter()) |
||||
} |
||||
} |
||||
|
||||
// header@name / header@value are not provided instead use header@ref |
||||
|
||||
def "http/headers/header@ref"() { |
||||
setup: |
||||
loadConfig(HeaderRefConfig) |
||||
when: |
||||
springSecurityFilterChain.doFilter(request,response,chain) |
||||
then: |
||||
responseHeaders == ['customHeaderName': 'customHeaderValue'] |
||||
} |
||||
|
||||
@Configuration |
||||
static class HeaderRefConfig extends BaseWebConfig { |
||||
@Override |
||||
protected void configure(HttpSecurity http) { |
||||
http |
||||
.headers() |
||||
.addHeaderWriter(new StaticHeadersWriter("customHeaderName", "customHeaderValue")) |
||||
} |
||||
} |
||||
} |
||||
@ -1,4 +1,4 @@
@@ -1,4 +1,4 @@
|
||||
package org.springframework.security.web.headers; |
||||
package org.springframework.security.web.header; |
||||
|
||||
import java.util.Arrays; |
||||
import java.util.List; |
||||
@ -0,0 +1,49 @@
@@ -0,0 +1,49 @@
|
||||
/* |
||||
* Copyright 2002-2013 the original author or authors. |
||||
* |
||||
* Licensed under the Apache License, Version 2.0 (the "License"); |
||||
* you may not use this file except in compliance with the License. |
||||
* You may obtain a copy of the License at |
||||
* |
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
* |
||||
* Unless required by applicable law or agreed to in writing, software |
||||
* distributed under the License is distributed on an "AS IS" BASIS, |
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
||||
* See the License for the specific language governing permissions and |
||||
* limitations under the License. |
||||
*/ |
||||
package org.springframework.security.web.header.writers; |
||||
|
||||
import java.util.ArrayList; |
||||
import java.util.List; |
||||
|
||||
import org.springframework.security.web.header.Header; |
||||
|
||||
/** |
||||
* A {@link StaticHeadersWriter} that inserts headers to prevent caching. |
||||
* Specifically it adds the following headers: |
||||
* <ul> |
||||
* <li>Cache-Control: no-cache, no-store, max-age=0, must-revalidate</li> |
||||
* <li>Pragma: no-cache</li> |
||||
* </ul> |
||||
* |
||||
* @author Rob Winch |
||||
* @since 3.2 |
||||
*/ |
||||
public final class CacheControlHeadersWriter extends StaticHeadersWriter { |
||||
|
||||
/** |
||||
* Creates a new instance |
||||
*/ |
||||
public CacheControlHeadersWriter() { |
||||
super(createHeaders()); |
||||
} |
||||
|
||||
private static List<Header> createHeaders() { |
||||
List<Header> headers = new ArrayList<Header>(2); |
||||
headers.add(new Header("Cache-Control","no-cache","no-store","max-age=0","must-revalidate")); |
||||
headers.add(new Header("Pragma","no-cache")); |
||||
return headers; |
||||
} |
||||
} |
||||
@ -0,0 +1,37 @@
@@ -0,0 +1,37 @@
|
||||
/* |
||||
* Copyright 2002-2013 the original author or authors. |
||||
* |
||||
* Licensed under the Apache License, Version 2.0 (the "License"); |
||||
* you may not use this file except in compliance with the License. |
||||
* You may obtain a copy of the License at |
||||
* |
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
* |
||||
* Unless required by applicable law or agreed to in writing, software |
||||
* distributed under the License is distributed on an "AS IS" BASIS, |
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
||||
* See the License for the specific language governing permissions and |
||||
* limitations under the License. |
||||
*/ |
||||
package org.springframework.security.web.header.writers; |
||||
|
||||
|
||||
/** |
||||
* A {@link StaticHeadersWriter} that inserts headers to prevent content |
||||
* sniffing. Specifically the following headers are set: |
||||
* <ul> |
||||
* <li>X-Content-Type-Options: nosniff</li> |
||||
* </ul> |
||||
* |
||||
* @author Rob Winch |
||||
* @since 3.2 |
||||
*/ |
||||
public final class XContentTypeOptionsHeaderWriter extends StaticHeadersWriter { |
||||
|
||||
/** |
||||
* Creates a new instance |
||||
*/ |
||||
public XContentTypeOptionsHeaderWriter() { |
||||
super("X-Content-Type-Options","nosniff"); |
||||
} |
||||
} |
||||
@ -0,0 +1,118 @@
@@ -0,0 +1,118 @@
|
||||
/* |
||||
* Copyright 2002-2013 the original author or authors. |
||||
* |
||||
* Licensed under the Apache License, Version 2.0 (the "License"); |
||||
* you may not use this file except in compliance with the License. |
||||
* You may obtain a copy of the License at |
||||
* |
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
* |
||||
* Unless required by applicable law or agreed to in writing, software |
||||
* distributed under the License is distributed on an "AS IS" BASIS, |
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
||||
* See the License for the specific language governing permissions and |
||||
* limitations under the License. |
||||
*/ |
||||
package org.springframework.security.web.header.writers; |
||||
|
||||
import javax.servlet.http.HttpServletRequest; |
||||
import javax.servlet.http.HttpServletResponse; |
||||
|
||||
import org.springframework.security.web.header.HeaderWriter; |
||||
|
||||
/** |
||||
* Renders the <a href= |
||||
* "http://blogs.msdn.com/b/ieinternals/archive/2011/01/31/controlling-the-internet-explorer-xss-filter-with-the-x-xss-protection-http-header.aspx" |
||||
* >X-XSS-Protection header</a>. |
||||
* |
||||
* @author Rob Winch |
||||
* @since 3.2 |
||||
*/ |
||||
public final class XXssProtectionHeaderWriter implements HeaderWriter { |
||||
private static final String XSS_PROTECTION_HEADER = "X-XSS-Protection"; |
||||
|
||||
private boolean enabled; |
||||
|
||||
private boolean block; |
||||
|
||||
private String headerValue; |
||||
|
||||
/** |
||||
* Create a new instance |
||||
*/ |
||||
public XXssProtectionHeaderWriter() { |
||||
this.enabled = true; |
||||
this.block = true; |
||||
updateHeaderValue(); |
||||
} |
||||
|
||||
@Override |
||||
public void writeHeaders(HttpServletRequest request, |
||||
HttpServletResponse response) { |
||||
response.setHeader(XSS_PROTECTION_HEADER, headerValue); |
||||
} |
||||
|
||||
/** |
||||
* If true, will contain a value of 1. For example: |
||||
* |
||||
* <pre> |
||||
* X-XSS-Protection: 1 |
||||
* </pre> |
||||
* |
||||
* or if {@link #setBlock(boolean)} is true |
||||
* |
||||
* |
||||
* <pre> |
||||
* X-XSS-Protection: 1; mode=block |
||||
* </pre> |
||||
* |
||||
* If false, will explicitly disable specify that X-XSS-Protection is |
||||
* disabled. For example: |
||||
* |
||||
* <pre> |
||||
* X-XSS-Protection: 0 |
||||
* </pre> |
||||
* |
||||
* @param enabled the new value |
||||
*/ |
||||
public void setEnabled(boolean enabled) { |
||||
if(!enabled) { |
||||
setBlock(false); |
||||
} |
||||
this.enabled = enabled; |
||||
updateHeaderValue(); |
||||
} |
||||
|
||||
|
||||
/** |
||||
* If false, will not specify the mode as blocked. In this instance, any |
||||
* content will be attempted to be fixed. If true, the content will be |
||||
* replaced with "#". |
||||
* |
||||
* @param enabled |
||||
* the new value |
||||
*/ |
||||
public void setBlock(boolean block) { |
||||
if(!enabled && block) { |
||||
throw new IllegalArgumentException("Cannot set block to true with enabled false"); |
||||
} |
||||
this.block = block; |
||||
updateHeaderValue(); |
||||
} |
||||
|
||||
private void updateHeaderValue() { |
||||
if(!enabled) { |
||||
this.headerValue = "0"; |
||||
return; |
||||
} |
||||
this.headerValue = "1"; |
||||
if(block) { |
||||
this.headerValue += "; mode=block"; |
||||
} |
||||
} |
||||
|
||||
@Override |
||||
public String toString() { |
||||
return getClass().getName() + " [headerValue=" + headerValue + "]"; |
||||
} |
||||
} |
||||
@ -1,4 +1,4 @@
@@ -1,4 +1,4 @@
|
||||
package org.springframework.security.web.headers.frameoptions; |
||||
package org.springframework.security.web.header.writers.frameoptions; |
||||
|
||||
import org.apache.commons.logging.Log; |
||||
import org.apache.commons.logging.LogFactory; |
||||
@ -1,4 +1,4 @@
@@ -1,4 +1,4 @@
|
||||
package org.springframework.security.web.headers.frameoptions; |
||||
package org.springframework.security.web.header.writers.frameoptions; |
||||
|
||||
import javax.servlet.http.HttpServletRequest; |
||||
|
||||
@ -1,4 +1,4 @@
@@ -1,4 +1,4 @@
|
||||
package org.springframework.security.web.headers.frameoptions; |
||||
package org.springframework.security.web.header.writers.frameoptions; |
||||
|
||||
import org.springframework.util.Assert; |
||||
|
||||
@ -1,4 +1,4 @@
@@ -1,4 +1,4 @@
|
||||
package org.springframework.security.web.headers.frameoptions; |
||||
package org.springframework.security.web.header.writers.frameoptions; |
||||
|
||||
import javax.servlet.http.HttpServletRequest; |
||||
import java.net.URI; |
||||
@ -1,4 +1,4 @@
@@ -1,4 +1,4 @@
|
||||
package org.springframework.security.web.headers.frameoptions; |
||||
package org.springframework.security.web.header.writers.frameoptions; |
||||
|
||||
import java.util.Collection; |
||||
|
||||
@ -0,0 +1,54 @@
@@ -0,0 +1,54 @@
|
||||
/* |
||||
* Copyright 2002-2013 the original author or authors. |
||||
* |
||||
* Licensed under the Apache License, Version 2.0 (the "License"); |
||||
* you may not use this file except in compliance with the License. |
||||
* You may obtain a copy of the License at |
||||
* |
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
* |
||||
* Unless required by applicable law or agreed to in writing, software |
||||
* distributed under the License is distributed on an "AS IS" BASIS, |
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
||||
* See the License for the specific language governing permissions and |
||||
* limitations under the License. |
||||
*/ |
||||
package org.springframework.security.web.header.writers; |
||||
|
||||
import static org.fest.assertions.Assertions.assertThat; |
||||
|
||||
import java.util.Arrays; |
||||
|
||||
import org.junit.Before; |
||||
import org.junit.Test; |
||||
import org.springframework.mock.web.MockHttpServletRequest; |
||||
import org.springframework.mock.web.MockHttpServletResponse; |
||||
|
||||
/** |
||||
* @author Rob Winch |
||||
* |
||||
*/ |
||||
public class CacheControlHeadersWriterTests { |
||||
|
||||
private MockHttpServletRequest request; |
||||
|
||||
private MockHttpServletResponse response; |
||||
|
||||
private CacheControlHeadersWriter writer; |
||||
|
||||
@Before |
||||
public void setup() { |
||||
request = new MockHttpServletRequest(); |
||||
response = new MockHttpServletResponse(); |
||||
writer = new CacheControlHeadersWriter(); |
||||
} |
||||
|
||||
@Test |
||||
public void writeHeaders() { |
||||
writer.writeHeaders(request, response); |
||||
|
||||
assertThat(response.getHeaderNames().size()).isEqualTo(2); |
||||
assertThat(response.getHeaderValues("Cache-Control")).isEqualTo(Arrays.asList("no-cache","no-store","max-age=0","must-revalidate")); |
||||
assertThat(response.getHeaderValues("Pragma")).isEqualTo(Arrays.asList("no-cache")); |
||||
} |
||||
} |
||||
@ -0,0 +1,145 @@
@@ -0,0 +1,145 @@
|
||||
/* |
||||
* Copyright 2002-2013 the original author or authors. |
||||
* |
||||
* Licensed under the Apache License, Version 2.0 (the "License"); |
||||
* you may not use this file except in compliance with the License. |
||||
* You may obtain a copy of the License at |
||||
* |
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
* |
||||
* Unless required by applicable law or agreed to in writing, software |
||||
* distributed under the License is distributed on an "AS IS" BASIS, |
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
||||
* See the License for the specific language governing permissions and |
||||
* limitations under the License. |
||||
*/ |
||||
package org.springframework.security.web.header.writers; |
||||
|
||||
import static org.fest.assertions.Assertions.assertThat; |
||||
|
||||
import org.junit.Before; |
||||
import org.junit.Test; |
||||
import org.springframework.mock.web.MockHttpServletRequest; |
||||
import org.springframework.mock.web.MockHttpServletResponse; |
||||
import org.springframework.security.web.header.writers.HstsHeaderWriter; |
||||
import org.springframework.security.web.util.AnyRequestMatcher; |
||||
|
||||
/** |
||||
* @author Rob Winch |
||||
* |
||||
*/ |
||||
public class HstsHeaderWriterTests { |
||||
private MockHttpServletRequest request; |
||||
private MockHttpServletResponse response; |
||||
|
||||
private HstsHeaderWriter writer; |
||||
|
||||
@Before |
||||
public void setup() { |
||||
request = new MockHttpServletRequest(); |
||||
request.setSecure(true); |
||||
response = new MockHttpServletResponse(); |
||||
|
||||
writer = new HstsHeaderWriter(); |
||||
} |
||||
|
||||
@Test |
||||
public void allArgsCustomConstructorWriteHeaders() { |
||||
request.setSecure(false); |
||||
writer = new HstsHeaderWriter(new AnyRequestMatcher(), 15768000, false); |
||||
|
||||
writer.writeHeaders(request, response); |
||||
|
||||
assertThat(response.getHeaderNames().size()).isEqualTo(1); |
||||
assertThat(response.getHeader("Strict-Transport-Security")).isEqualTo("max-age=15768000"); |
||||
} |
||||
|
||||
@Test |
||||
public void maxAgeAndIncludeSubdomainsCustomConstructorWriteHeaders() { |
||||
request.setSecure(false); |
||||
writer = new HstsHeaderWriter(new AnyRequestMatcher(), 15768000, false); |
||||
|
||||
writer.writeHeaders(request, response); |
||||
|
||||
assertThat(response.getHeaderNames().size()).isEqualTo(1); |
||||
assertThat(response.getHeader("Strict-Transport-Security")).isEqualTo("max-age=15768000"); |
||||
} |
||||
|
||||
@Test |
||||
public void maxAgeCustomConstructorWriteHeaders() { |
||||
writer = new HstsHeaderWriter(15768000); |
||||
|
||||
writer.writeHeaders(request, response); |
||||
|
||||
assertThat(response.getHeaderNames().size()).isEqualTo(1); |
||||
assertThat(response.getHeader("Strict-Transport-Security")).isEqualTo("max-age=15768000 ; includeSubDomains"); |
||||
} |
||||
|
||||
@Test |
||||
public void includeSubDomainsCustomConstructorWriteHeaders() { |
||||
writer = new HstsHeaderWriter(false); |
||||
|
||||
writer.writeHeaders(request, response); |
||||
|
||||
assertThat(response.getHeaderNames().size()).isEqualTo(1); |
||||
assertThat(response.getHeader("Strict-Transport-Security")).isEqualTo("max-age=31536000"); |
||||
} |
||||
|
||||
@Test |
||||
public void writeHeadersDefaultValues() { |
||||
writer.writeHeaders(request, response); |
||||
|
||||
assertThat(response.getHeaderNames().size()).isEqualTo(1); |
||||
assertThat(response.getHeader("Strict-Transport-Security")).isEqualTo("max-age=31536000 ; includeSubDomains"); |
||||
} |
||||
|
||||
@Test |
||||
public void writeHeadersIncludeSubDomainsFalse() { |
||||
writer.setIncludeSubDomains(false); |
||||
|
||||
writer.writeHeaders(request, response); |
||||
|
||||
assertThat(response.getHeaderNames().size()).isEqualTo(1); |
||||
assertThat(response.getHeader("Strict-Transport-Security")).isEqualTo("max-age=31536000"); |
||||
} |
||||
|
||||
@Test |
||||
public void writeHeadersCustomMaxAgeInSeconds() { |
||||
writer.setMaxAgeInSeconds(1); |
||||
|
||||
writer.writeHeaders(request, response); |
||||
|
||||
assertThat(response.getHeaderNames().size()).isEqualTo(1); |
||||
assertThat(response.getHeader("Strict-Transport-Security")).isEqualTo("max-age=1 ; includeSubDomains"); |
||||
} |
||||
|
||||
@Test |
||||
public void writeHeadersInsecureRequestDoesNotWriteHeader() { |
||||
request.setSecure(false); |
||||
|
||||
writer.writeHeaders(request, response); |
||||
|
||||
assertThat(response.getHeaderNames().isEmpty()).isTrue(); |
||||
} |
||||
|
||||
@Test |
||||
public void writeHeadersAnyRequestMatcher() { |
||||
writer.setRequestMatcher(new AnyRequestMatcher()); |
||||
request.setSecure(false); |
||||
|
||||
writer.writeHeaders(request, response); |
||||
|
||||
assertThat(response.getHeaderNames().size()).isEqualTo(1); |
||||
assertThat(response.getHeader("Strict-Transport-Security")).isEqualTo("max-age=31536000 ; includeSubDomains"); |
||||
} |
||||
|
||||
@Test(expected = IllegalArgumentException.class) |
||||
public void setMaxAgeInSecondsToNegative() { |
||||
writer.setMaxAgeInSeconds(-1); |
||||
} |
||||
|
||||
@Test(expected = IllegalArgumentException.class) |
||||
public void setRequestMatcherToNull() { |
||||
writer.setRequestMatcher(null); |
||||
} |
||||
} |
||||
@ -0,0 +1,53 @@
@@ -0,0 +1,53 @@
|
||||
/* |
||||
* Copyright 2002-2013 the original author or authors. |
||||
* |
||||
* Licensed under the Apache License, Version 2.0 (the "License"); |
||||
* you may not use this file except in compliance with the License. |
||||
* You may obtain a copy of the License at |
||||
* |
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
* |
||||
* Unless required by applicable law or agreed to in writing, software |
||||
* distributed under the License is distributed on an "AS IS" BASIS, |
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
||||
* See the License for the specific language governing permissions and |
||||
* limitations under the License. |
||||
*/ |
||||
package org.springframework.security.web.header.writers; |
||||
|
||||
import static org.fest.assertions.Assertions.assertThat; |
||||
|
||||
import java.util.Arrays; |
||||
|
||||
import org.junit.Before; |
||||
import org.junit.Test; |
||||
import org.springframework.mock.web.MockHttpServletRequest; |
||||
import org.springframework.mock.web.MockHttpServletResponse; |
||||
|
||||
/** |
||||
* @author Rob Winch |
||||
* |
||||
*/ |
||||
public class XContentTypeOptionsHeaderWriterTests { |
||||
|
||||
private MockHttpServletRequest request; |
||||
|
||||
private MockHttpServletResponse response; |
||||
|
||||
private XContentTypeOptionsHeaderWriter writer; |
||||
|
||||
@Before |
||||
public void setup() { |
||||
request = new MockHttpServletRequest(); |
||||
response = new MockHttpServletResponse(); |
||||
writer = new XContentTypeOptionsHeaderWriter(); |
||||
} |
||||
|
||||
@Test |
||||
public void writeHeaders() { |
||||
writer.writeHeaders(request, response); |
||||
|
||||
assertThat(response.getHeaderNames().size()).isEqualTo(1); |
||||
assertThat(response.getHeaderValues("X-Content-Type-Options")).isEqualTo(Arrays.asList("nosniff")); |
||||
} |
||||
} |
||||
@ -1,7 +1,8 @@
@@ -1,7 +1,8 @@
|
||||
package org.springframework.security.web.headers.frameoptions; |
||||
package org.springframework.security.web.header.writers.frameoptions; |
||||
|
||||
import org.junit.Test; |
||||
import org.springframework.mock.web.MockHttpServletRequest; |
||||
import org.springframework.security.web.header.writers.frameoptions.StaticAllowFromStrategy; |
||||
|
||||
import java.net.URI; |
||||
|
||||
@ -1,7 +1,8 @@
@@ -1,7 +1,8 @@
|
||||
package org.springframework.security.web.headers.frameoptions; |
||||
package org.springframework.security.web.header.writers.frameoptions; |
||||
|
||||
import org.junit.Test; |
||||
import org.springframework.mock.web.MockHttpServletRequest; |
||||
import org.springframework.security.web.header.writers.frameoptions.WhiteListedAllowFromStrategy; |
||||
|
||||
import java.util.ArrayList; |
||||
import java.util.List; |
||||
Loading…
Reference in new issue