Examples with FilterChain jakarta.servlet.FilterChain used on opensource projects

Example 16 with FilterChain

use of jakarta.servlet.FilterChain in project spring-security by spring-projects.

the class ExceptionTranslationFilterTests method thrownIOExceptionServletExceptionAndRuntimeExceptionsAreRethrown.

@Test
public void thrownIOExceptionServletExceptionAndRuntimeExceptionsAreRethrown() throws Exception {
    ExceptionTranslationFilter filter = new ExceptionTranslationFilter(this.mockEntryPoint);
    filter.afterPropertiesSet();
    Exception[] exceptions = { new IOException(), new ServletException(), new RuntimeException() };
    for (Exception exception : exceptions) {
        FilterChain fc = mock(FilterChain.class);
        willThrow(exception).given(fc).doFilter(any(HttpServletRequest.class), any(HttpServletResponse.class));
        assertThatExceptionOfType(Exception.class).isThrownBy(() -> filter.doFilter(new MockHttpServletRequest(), new MockHttpServletResponse(), fc)).isSameAs(exception);
    }
}

Example 17 with FilterChain

use of jakarta.servlet.FilterChain in project spring-security by spring-projects.

the class ExceptionTranslationFilterTests method testAccessDeniedWhenAnonymous.

@Test
public void testAccessDeniedWhenAnonymous() throws Exception {
    // Setup our HTTP request
    MockHttpServletRequest request = new MockHttpServletRequest();
    request.setServletPath("/secure/page.html");
    request.setServerPort(80);
    request.setScheme("http");
    request.setServerName("localhost");
    request.setContextPath("/mycontext");
    request.setRequestURI("/mycontext/secure/page.html");
    // Setup the FilterChain to thrown an access denied exception
    FilterChain fc = mock(FilterChain.class);
    willThrow(new AccessDeniedException("")).given(fc).doFilter(any(HttpServletRequest.class), any(HttpServletResponse.class));
    // Setup SecurityContextHolder, as filter needs to check if user is
    // anonymous
    SecurityContextHolder.getContext().setAuthentication(new AnonymousAuthenticationToken("ignored", "ignored", AuthorityUtils.createAuthorityList("IGNORED")));
    // Test
    ExceptionTranslationFilter filter = new ExceptionTranslationFilter(this.mockEntryPoint);
    filter.setAuthenticationTrustResolver(new AuthenticationTrustResolverImpl());
    assertThat(filter.getAuthenticationTrustResolver()).isNotNull();
    MockHttpServletResponse response = new MockHttpServletResponse();
    filter.doFilter(request, response, fc);
    assertThat(response.getRedirectedUrl()).isEqualTo("/mycontext/login.jsp");
    assertThat(getSavedRequestUrl(request)).isEqualTo("http://localhost/mycontext/secure/page.html");
}

Example 18 with FilterChain

use of jakarta.servlet.FilterChain in project spring-security by spring-projects.

the class ExceptionTranslationFilterTests method testLocalizedErrorMessages.

@Test
public void testLocalizedErrorMessages() throws Exception {
    // Setup our HTTP request
    MockHttpServletRequest request = new MockHttpServletRequest();
    request.setServletPath("/secure/page.html");
    // Setup the FilterChain to thrown an access denied exception
    FilterChain fc = mock(FilterChain.class);
    willThrow(new AccessDeniedException("")).given(fc).doFilter(any(HttpServletRequest.class), any(HttpServletResponse.class));
    // Setup SecurityContextHolder, as filter needs to check if user is
    // anonymous
    SecurityContextHolder.getContext().setAuthentication(new AnonymousAuthenticationToken("ignored", "ignored", AuthorityUtils.createAuthorityList("IGNORED")));
    // Test
    ExceptionTranslationFilter filter = new ExceptionTranslationFilter((req, res, ae) -> res.sendError(403, ae.getMessage()));
    filter.setAuthenticationTrustResolver(new AuthenticationTrustResolverImpl());
    assertThat(filter.getAuthenticationTrustResolver()).isNotNull();
    LocaleContextHolder.setDefaultLocale(Locale.GERMAN);
    MockHttpServletResponse response = new MockHttpServletResponse();
    filter.doFilter(request, response, fc);
    assertThat(response.getErrorMessage()).isEqualTo("Vollst\u00e4ndige Authentifikation wird ben\u00f6tigt um auf diese Resource zuzugreifen");
}

Example 19 with FilterChain

use of jakarta.servlet.FilterChain in project spring-security by spring-projects.

the class ExceptionTranslationFilterTests method doFilterWhenResponseCommittedThenRethrowsException.

@Test
public void doFilterWhenResponseCommittedThenRethrowsException() {
    this.mockEntryPoint = mock(AuthenticationEntryPoint.class);
    FilterChain chain = (request, response) -> {
        HttpServletResponse httpResponse = (HttpServletResponse) response;
        httpResponse.sendError(HttpServletResponse.SC_BAD_REQUEST);
        throw new AccessDeniedException("Denied");
    };
    MockHttpServletRequest request = new MockHttpServletRequest();
    MockHttpServletResponse response = new MockHttpServletResponse();
    ExceptionTranslationFilter filter = new ExceptionTranslationFilter(this.mockEntryPoint);
    assertThatExceptionOfType(ServletException.class).isThrownBy(() -> filter.doFilter(request, response, chain)).withCauseInstanceOf(AccessDeniedException.class);
    verifyZeroInteractions(this.mockEntryPoint);
}

Example 20 with FilterChain

use of jakarta.servlet.FilterChain in project spring-security by spring-projects.

the class FilterChainProxyTests method doFilterClearsSecurityContextHolderOnceOnForwards.

// SEC-2027
@Test
public void doFilterClearsSecurityContextHolderOnceOnForwards() throws Exception {
    final FilterChain innerChain = mock(FilterChain.class);
    given(this.matcher.matches(any(HttpServletRequest.class))).willReturn(true);
    willAnswer((Answer<Object>) (inv) -> {
        TestingAuthenticationToken expected = new TestingAuthenticationToken("username", "password");
        SecurityContextHolder.getContext().setAuthentication(expected);
        willAnswer((Answer<Object>) (inv1) -> {
            innerChain.doFilter(this.request, this.response);
            return null;
        }).given(this.filter).doFilter(any(HttpServletRequest.class), any(HttpServletResponse.class), any(FilterChain.class));
        this.fcp.doFilter(this.request, this.response, innerChain);
        assertThat(SecurityContextHolder.getContext().getAuthentication()).isSameAs(expected);
        return null;
    }).given(this.filter).doFilter(any(HttpServletRequest.class), any(HttpServletResponse.class), any(FilterChain.class));
    this.fcp.doFilter(this.request, this.response, this.chain);
    verify(innerChain).doFilter(any(HttpServletRequest.class), any(HttpServletResponse.class));
    assertThat(SecurityContextHolder.getContext().getAuthentication()).isNull();
}