Examples with FilterChain jakarta.servlet.FilterChain used on opensource projects

Example 31 with FilterChain

use of jakarta.servlet.FilterChain in project spring-security by spring-projects.

the class BasicAuthenticationFilterTests method doFilterWhenTokenAndFilterCharsetMatchDefaultThenAuthenticated.

@Test
public void doFilterWhenTokenAndFilterCharsetMatchDefaultThenAuthenticated() throws Exception {
    SecurityContextHolder.clearContext();
    UsernamePasswordAuthenticationToken rodRequest = new UsernamePasswordAuthenticationToken("rod", "äöü");
    rodRequest.setDetails(new WebAuthenticationDetails(new MockHttpServletRequest()));
    Authentication rod = new UsernamePasswordAuthenticationToken("rod", "äöü", AuthorityUtils.createAuthorityList("ROLE_1"));
    this.manager = mock(AuthenticationManager.class);
    given(this.manager.authenticate(rodRequest)).willReturn(rod);
    given(this.manager.authenticate(not(eq(rodRequest)))).willThrow(new BadCredentialsException(""));
    this.filter = new BasicAuthenticationFilter(this.manager, new BasicAuthenticationEntryPoint());
    String token = "rod:äöü";
    MockHttpServletRequest request = new MockHttpServletRequest();
    request.addHeader("Authorization", "Basic " + new String(Base64.encodeBase64(token.getBytes(StandardCharsets.UTF_8))));
    request.setServletPath("/some_file.html");
    MockHttpServletResponse response = new MockHttpServletResponse();
    // Test
    assertThat(SecurityContextHolder.getContext().getAuthentication()).isNull();
    FilterChain chain = mock(FilterChain.class);
    this.filter.doFilter(request, response, chain);
    assertThat(response.getStatus()).isEqualTo(HttpServletResponse.SC_OK);
    verify(chain).doFilter(any(ServletRequest.class), any(ServletResponse.class));
    assertThat(SecurityContextHolder.getContext().getAuthentication().getName()).isEqualTo("rod");
    assertThat(SecurityContextHolder.getContext().getAuthentication().getCredentials()).isEqualTo("äöü");
}

Example 32 with FilterChain

use of jakarta.servlet.FilterChain in project spring-security by spring-projects.

the class BasicAuthenticationFilterTests method doFilterWhenTokenAndFilterCharsetDoNotMatchThenUnauthorized.

@Test
public void doFilterWhenTokenAndFilterCharsetDoNotMatchThenUnauthorized() throws Exception {
    SecurityContextHolder.clearContext();
    UsernamePasswordAuthenticationToken rodRequest = new UsernamePasswordAuthenticationToken("rod", "äöü");
    rodRequest.setDetails(new WebAuthenticationDetails(new MockHttpServletRequest()));
    Authentication rod = new UsernamePasswordAuthenticationToken("rod", "äöü", AuthorityUtils.createAuthorityList("ROLE_1"));
    this.manager = mock(AuthenticationManager.class);
    given(this.manager.authenticate(rodRequest)).willReturn(rod);
    given(this.manager.authenticate(not(eq(rodRequest)))).willThrow(new BadCredentialsException(""));
    this.filter = new BasicAuthenticationFilter(this.manager, new BasicAuthenticationEntryPoint());
    this.filter.setCredentialsCharset("ISO-8859-1");
    String token = "rod:äöü";
    MockHttpServletRequest request = new MockHttpServletRequest();
    request.addHeader("Authorization", "Basic " + new String(Base64.encodeBase64(token.getBytes(StandardCharsets.UTF_8))));
    request.setServletPath("/some_file.html");
    MockHttpServletResponse response = new MockHttpServletResponse();
    // Test
    assertThat(SecurityContextHolder.getContext().getAuthentication()).isNull();
    FilterChain chain = mock(FilterChain.class);
    this.filter.doFilter(request, response, chain);
    assertThat(response.getStatus()).isEqualTo(HttpServletResponse.SC_UNAUTHORIZED);
    verify(chain, never()).doFilter(any(ServletRequest.class), any(ServletResponse.class));
    assertThat(SecurityContextHolder.getContext().getAuthentication()).isNull();
}

Example 33 with FilterChain

use of jakarta.servlet.FilterChain in project spring-security by spring-projects.

the class BasicAuthenticationFilterTests method testSuccessLoginThenFailureLoginResultsInSessionLosingToken.

@Test
public void testSuccessLoginThenFailureLoginResultsInSessionLosingToken() throws Exception {
    String token = "rod:koala";
    MockHttpServletRequest request = new MockHttpServletRequest();
    request.addHeader("Authorization", "Basic " + new String(Base64.encodeBase64(token.getBytes())));
    request.setServletPath("/some_file.html");
    final MockHttpServletResponse response1 = new MockHttpServletResponse();
    FilterChain chain = mock(FilterChain.class);
    this.filter.doFilter(request, response1, chain);
    verify(chain).doFilter(any(ServletRequest.class), any(ServletResponse.class));
    // Test
    assertThat(SecurityContextHolder.getContext().getAuthentication()).isNotNull();
    assertThat(SecurityContextHolder.getContext().getAuthentication().getName()).isEqualTo("rod");
    // NOW PERFORM FAILED AUTHENTICATION
    token = "otherUser:WRONG_PASSWORD";
    request = new MockHttpServletRequest();
    request.addHeader("Authorization", "Basic " + new String(Base64.encodeBase64(token.getBytes())));
    final MockHttpServletResponse response2 = new MockHttpServletResponse();
    chain = mock(FilterChain.class);
    this.filter.doFilter(request, response2, chain);
    verify(chain, never()).doFilter(any(ServletRequest.class), any(ServletResponse.class));
    request.setServletPath("/some_file.html");
    // Test - the filter chain will not be invoked, as we get a 401 forbidden response
    MockHttpServletResponse response = response2;
    assertThat(SecurityContextHolder.getContext().getAuthentication()).isNull();
    assertThat(response.getStatus()).isEqualTo(401);
}

Example 34 with FilterChain

use of jakarta.servlet.FilterChain in project spring-security by spring-projects.

the class BasicAuthenticationFilterTests method testWrongPasswordContinuesFilterChainIfIgnoreFailureIsTrue.

@Test
public void testWrongPasswordContinuesFilterChainIfIgnoreFailureIsTrue() throws Exception {
    String token = "rod:WRONG_PASSWORD";
    MockHttpServletRequest request = new MockHttpServletRequest();
    request.addHeader("Authorization", "Basic " + new String(Base64.encodeBase64(token.getBytes())));
    request.setServletPath("/some_file.html");
    request.setSession(new MockHttpSession());
    this.filter = new BasicAuthenticationFilter(this.manager);
    assertThat(this.filter.isIgnoreFailure()).isTrue();
    FilterChain chain = mock(FilterChain.class);
    this.filter.doFilter(request, new MockHttpServletResponse(), chain);
    verify(chain).doFilter(any(ServletRequest.class), any(ServletResponse.class));
    // Test - the filter chain will be invoked, as we've set ignoreFailure = true
    assertThat(SecurityContextHolder.getContext().getAuthentication()).isNull();
}

Example 35 with FilterChain

use of jakarta.servlet.FilterChain in project spring-security by spring-projects.

the class BasicAuthenticationFilterTests method doFilterWhenSchemeLowercaseThenCaseInsensitveMatchWorks.

// gh-5586
@Test
public void doFilterWhenSchemeLowercaseThenCaseInsensitveMatchWorks() throws Exception {
    String token = "rod:koala";
    MockHttpServletRequest request = new MockHttpServletRequest();
    request.addHeader("Authorization", "basic " + new String(Base64.encodeBase64(token.getBytes())));
    request.setServletPath("/some_file.html");
    // Test
    assertThat(SecurityContextHolder.getContext().getAuthentication()).isNull();
    FilterChain chain = mock(FilterChain.class);
    this.filter.doFilter(request, new MockHttpServletResponse(), chain);
    verify(chain).doFilter(any(ServletRequest.class), any(ServletResponse.class));
    assertThat(SecurityContextHolder.getContext().getAuthentication()).isNotNull();
    assertThat(SecurityContextHolder.getContext().getAuthentication().getName()).isEqualTo("rod");
}