diff --git a/config/src/test/groovy/org/springframework/security/config/annotation/web/builders/HttpConfigurationTests.groovy b/config/src/test/groovy/org/springframework/security/config/annotation/web/builders/HttpConfigurationTests.groovy deleted file mode 100644 index 2c85dde39b..0000000000 --- a/config/src/test/groovy/org/springframework/security/config/annotation/web/builders/HttpConfigurationTests.groovy +++ /dev/null @@ -1,121 +0,0 @@ -/* - * Copyright 2002-2013 the original author or authors. - * - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - */ -package org.springframework.security.config.annotation.web.builders - -import javax.servlet.Filter -import javax.servlet.FilterChain -import javax.servlet.ServletException -import javax.servlet.http.HttpServletRequest -import javax.servlet.http.HttpServletResponse - -import org.springframework.beans.factory.BeanCreationException -import org.springframework.context.annotation.Configuration -import org.springframework.mock.web.MockFilterChain -import org.springframework.mock.web.MockHttpServletRequest -import org.springframework.mock.web.MockHttpServletResponse -import org.springframework.security.cas.web.CasAuthenticationFilter -import org.springframework.security.config.annotation.BaseSpringSpec -import org.springframework.security.config.annotation.web.configuration.BaseWebConfig -import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity; -import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter -import org.springframework.web.filter.OncePerRequestFilter - -import spock.lang.Unroll; -/** - * HttpSecurity tests - * - * @author Rob Winch - * - */ -public class HttpConfigurationTests extends BaseSpringSpec { - def "addFilter with unregistered Filter"() { - when: - loadConfig(UnregisteredFilterConfig) - then: - BeanCreationException success = thrown() - success.message.contains "The Filter class ${UnregisteredFilter.name} does not have a registered order and cannot be added without a specified order. Consider using addFilterBefore or addFilterAfter instead." - } - - @Configuration - static class UnregisteredFilterConfig extends BaseWebConfig { - protected void configure(HttpSecurity http) throws Exception { - http - .addFilter(new UnregisteredFilter()) - } - } - - static class UnregisteredFilter extends OncePerRequestFilter { - @Override - protected void doFilterInternal(HttpServletRequest request, - HttpServletResponse response, FilterChain filterChain) - throws ServletException, IOException { - filterChain.doFilter(request, response); - } - } - - // https://github.com/SpringSource/spring-security-javaconfig/issues/104 - def "#104 addFilter CasAuthenticationFilter"() { - when: - loadConfig(CasAuthenticationFilterConfig) - then: - findFilter(CasAuthenticationFilter) - } - - @Configuration - static class CasAuthenticationFilterConfig extends BaseWebConfig { - protected void configure(HttpSecurity http) throws Exception { - http - .addFilter(new CasAuthenticationFilter()) - } - } - - - @Unroll - def "requestMatchers javadoc"() { - setup: "load configuration like the config on the requestMatchers() javadoc" - loadConfig(RequestMatcherRegistryConfigs) - when: - super.setup() - request.servletPath = "/oauth/a" - springSecurityFilterChain.doFilter(request, response, chain) - then: - response.status == HttpServletResponse.SC_UNAUTHORIZED - where: - servletPath | _ - "/oauth/a" | _ - "/oauth/b" | _ - "/api/a" | _ - "/api/b" | _ - "/oauth2/b" | _ - "/api2/b" | _ - } - - @EnableWebSecurity - static class RequestMatcherRegistryConfigs extends BaseWebConfig { - @Override - protected void configure(HttpSecurity http) throws Exception { - http - .requestMatchers() - .antMatchers("/api/**") - .antMatchers("/oauth/**") - .and() - .authorizeRequests() - .antMatchers("/**").hasRole("USER") - .and() - .httpBasic() - } - } -} diff --git a/config/src/test/java/org/springframework/security/config/annotation/web/builders/HttpConfigurationTests.java b/config/src/test/java/org/springframework/security/config/annotation/web/builders/HttpConfigurationTests.java new file mode 100644 index 0000000000..d732445b1a --- /dev/null +++ b/config/src/test/java/org/springframework/security/config/annotation/web/builders/HttpConfigurationTests.java @@ -0,0 +1,152 @@ +/* + * Copyright 2002-2018 the original author or authors. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package org.springframework.security.config.annotation.web.builders; + +import org.junit.Rule; +import org.junit.Test; +import org.springframework.beans.factory.BeanCreationException; +import org.springframework.beans.factory.annotation.Autowired; +import org.springframework.security.cas.web.CasAuthenticationFilter; +import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder; +import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity; +import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter; +import org.springframework.security.config.test.SpringTestRule; +import org.springframework.security.core.userdetails.PasswordEncodedUser; +import org.springframework.security.web.FilterChainProxy; +import org.springframework.test.web.servlet.MockMvc; +import org.springframework.web.filter.OncePerRequestFilter; + +import javax.servlet.Filter; +import javax.servlet.FilterChain; +import javax.servlet.ServletException; +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; +import java.io.IOException; + +import static org.assertj.core.api.Assertions.assertThat; +import static org.assertj.core.api.ThrowableAssert.catchThrowable; +import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get; +import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status; + +/** + * Tests for {@link HttpSecurity}. + * + * @author Rob Winch + * @author Joe Grandja + */ +public class HttpConfigurationTests { + @Rule + public final SpringTestRule spring = new SpringTestRule(); + + @Autowired + private FilterChainProxy springSecurityFilterChain; + + @Autowired + private MockMvc mockMvc; + + @Test + public void configureWhenAddFilterUnregisteredThenThrowsBeanCreationException() throws Exception { + Throwable thrown = catchThrowable(() -> this.spring.register(UnregisteredFilterConfig.class).autowire() ); + assertThat(thrown).isInstanceOf(BeanCreationException.class); + assertThat(thrown.getMessage()).contains("The Filter class " + UnregisteredFilter.class.getName() + + " does not have a registered order and cannot be added without a specified order." + + " Consider using addFilterBefore or addFilterAfter instead."); + } + + @EnableWebSecurity + static class UnregisteredFilterConfig extends WebSecurityConfigurerAdapter { + + protected void configure(HttpSecurity http) throws Exception { + http + .addFilter(new UnregisteredFilter()); + } + + protected void configure(AuthenticationManagerBuilder auth) throws Exception { + auth + .inMemoryAuthentication() + .withUser(PasswordEncodedUser.user()); + } + } + + static class UnregisteredFilter extends OncePerRequestFilter { + @Override + protected void doFilterInternal(HttpServletRequest request, + HttpServletResponse response, + FilterChain filterChain) throws ServletException, IOException { + filterChain.doFilter(request, response); + } + } + + // https://github.com/SpringSource/spring-security-javaconfig/issues/104 + @Test + public void configureWhenAddFilterCasAuthenticationFilterThenFilterAdded() throws Exception { + this.spring.register(CasAuthenticationFilterConfig.class).autowire(); + + assertThat(this.findFilter(CasAuthenticationFilter.class, this.springSecurityFilterChain)).isNotNull(); + } + + @EnableWebSecurity + static class CasAuthenticationFilterConfig extends WebSecurityConfigurerAdapter { + protected void configure(HttpSecurity http) throws Exception { + http + .addFilter(new CasAuthenticationFilter()); + } + } + + @Test + public void configureWhenConfigIsRequestMatchersJavadocThenAuthorizationApplied() throws Exception { + this.spring.register(RequestMatcherRegistryConfigs.class).autowire(); + + this.mockMvc.perform(get("/oauth/a")).andExpect(status().isUnauthorized()); + this.mockMvc.perform(get("/oauth/b")).andExpect(status().isUnauthorized()); + this.mockMvc.perform(get("/api/a")).andExpect(status().isUnauthorized()); + this.mockMvc.perform(get("/api/b")).andExpect(status().isUnauthorized()); + } + + @EnableWebSecurity + static class RequestMatcherRegistryConfigs extends WebSecurityConfigurerAdapter { + @Override + protected void configure(HttpSecurity http) throws Exception { + http + .requestMatchers() + .antMatchers("/api/**") + .antMatchers("/oauth/**") + .and() + .authorizeRequests() + .antMatchers("/**").hasRole("USER") + .and() + .httpBasic(); + } + } + + private T findFilter(Class filterType, FilterChainProxy filterChainProxy) { + return this.findFilter(filterType, filterChainProxy, 0); + } + + private T findFilter(Class filterType, FilterChainProxy filterChainProxy, int filterChainIndex) { + if (filterChainIndex >= filterChainProxy.getFilterChains().size()) { + return null; + } + + Filter filter = filterChainProxy.getFilterChains().get(filterChainIndex).getFilters() + .stream() + .filter(f -> f.getClass().isAssignableFrom(filterType)) + .findFirst() + .orElse(null); + + return (T) filter; + } +}