Examples with SessionFixationProtectionStrategy org.springframework.security.web.authentication.session.SessionFixationProtectionStrategy used on opensource projects

Example 1 with SessionFixationProtectionStrategy

use of org.springframework.security.web.authentication.session.SessionFixationProtectionStrategy in project spring-security by spring-projects.

the class DefaultSessionAuthenticationStrategyTests method newSessionShouldNotBeCreatedIfNoSessionExistsAndAlwaysCreateIsFalse.

@Test
public void newSessionShouldNotBeCreatedIfNoSessionExistsAndAlwaysCreateIsFalse() {
    SessionFixationProtectionStrategy strategy = new SessionFixationProtectionStrategy();
    HttpServletRequest request = new MockHttpServletRequest();
    strategy.onAuthentication(mock(Authentication.class), request, new MockHttpServletResponse());
    assertThat(request.getSession(false)).isNull();
}

Example 2 with SessionFixationProtectionStrategy

use of org.springframework.security.web.authentication.session.SessionFixationProtectionStrategy in project spring-security by spring-projects.

the class DefaultSessionAuthenticationStrategyTests method newSessionIsCreatedIfSessionAlreadyExists.

@Test
public void newSessionIsCreatedIfSessionAlreadyExists() {
    SessionFixationProtectionStrategy strategy = new SessionFixationProtectionStrategy();
    HttpServletRequest request = new MockHttpServletRequest();
    String sessionId = request.getSession().getId();
    strategy.onAuthentication(mock(Authentication.class), request, new MockHttpServletResponse());
    assertThat(sessionId.equals(request.getSession().getId())).isFalse();
}

Example 3 with SessionFixationProtectionStrategy

use of org.springframework.security.web.authentication.session.SessionFixationProtectionStrategy in project spring-security by spring-projects.

the class DefaultSessionAuthenticationStrategyTests method onAuthenticationWhenMigrateSessionAttributesTrueThenMaxInactiveIntervalIsMigrated.

@Test
public void onAuthenticationWhenMigrateSessionAttributesTrueThenMaxInactiveIntervalIsMigrated() {
    SessionFixationProtectionStrategy strategy = new SessionFixationProtectionStrategy();
    HttpServletRequest request = new MockHttpServletRequest();
    HttpSession session = request.getSession();
    session.setMaxInactiveInterval(1);
    Authentication mockAuthentication = mock(Authentication.class);
    strategy.onAuthentication(mockAuthentication, request, new MockHttpServletResponse());
    assertThat(request.getSession().getMaxInactiveInterval()).isEqualTo(1);
}

Example 4 with SessionFixationProtectionStrategy

use of org.springframework.security.web.authentication.session.SessionFixationProtectionStrategy in project spring-security by spring-projects.

the class DefaultSessionAuthenticationStrategyTests method onlySavedRequestAttributeIsMigratedIfMigrateAttributesIsFalse.

// See SEC-1077
@Test
public void onlySavedRequestAttributeIsMigratedIfMigrateAttributesIsFalse() {
    SessionFixationProtectionStrategy strategy = new SessionFixationProtectionStrategy();
    strategy.setMigrateSessionAttributes(false);
    HttpServletRequest request = new MockHttpServletRequest();
    HttpSession session = request.getSession();
    session.setAttribute("blah", "blah");
    session.setAttribute("SPRING_SECURITY_SAVED_REQUEST_KEY", "DefaultSavedRequest");
    strategy.onAuthentication(mock(Authentication.class), request, new MockHttpServletResponse());
    assertThat(request.getSession().getAttribute("blah")).isNull();
    assertThat(request.getSession().getAttribute("SPRING_SECURITY_SAVED_REQUEST_KEY")).isNotNull();
}

Example 5 with SessionFixationProtectionStrategy

use of org.springframework.security.web.authentication.session.SessionFixationProtectionStrategy in project spring-security by spring-projects.

the class DefaultSessionAuthenticationStrategyTests method onlySavedRequestAttributeIsMigratedIfMigrateAttributesIsFalseWithEventPublisher.

// SEC-2002
@Test
public void onlySavedRequestAttributeIsMigratedIfMigrateAttributesIsFalseWithEventPublisher() {
    SessionFixationProtectionStrategy strategy = new SessionFixationProtectionStrategy();
    strategy.setMigrateSessionAttributes(false);
    HttpServletRequest request = new MockHttpServletRequest();
    HttpSession session = request.getSession();
    session.setAttribute("blah", "blah");
    session.setAttribute("SPRING_SECURITY_SAVED_REQUEST_KEY", "DefaultSavedRequest");
    String oldSessionId = session.getId();
    ApplicationEventPublisher eventPublisher = mock(ApplicationEventPublisher.class);
    strategy.setApplicationEventPublisher(eventPublisher);
    Authentication mockAuthentication = mock(Authentication.class);
    strategy.onAuthentication(mockAuthentication, request, new MockHttpServletResponse());
    ArgumentCaptor<ApplicationEvent> eventArgumentCaptor = ArgumentCaptor.forClass(ApplicationEvent.class);
    verify(eventPublisher).publishEvent(eventArgumentCaptor.capture());
    assertThat(request.getSession().getAttribute("blah")).isNull();
    assertThat(request.getSession().getAttribute("SPRING_SECURITY_SAVED_REQUEST_KEY")).isNotNull();
    assertThat(eventArgumentCaptor.getValue()).isNotNull();
    assertThat(eventArgumentCaptor.getValue() instanceof SessionFixationProtectionEvent).isTrue();
    SessionFixationProtectionEvent event = (SessionFixationProtectionEvent) eventArgumentCaptor.getValue();
    assertThat(event.getOldSessionId()).isEqualTo(oldSessionId);
    assertThat(event.getNewSessionId()).isEqualTo(request.getSession().getId());
    assertThat(event.getAuthentication()).isSameAs(mockAuthentication);
}