Examples with HttpServletRequest jakarta.servlet.http.HttpServletRequest used on opensource projects

Example 56 with HttpServletRequest

use of jakarta.servlet.http.HttpServletRequest in project spring-security by spring-projects.

the class CsrfTokenHandshakeInterceptor method beforeHandshake.

@Override
public boolean beforeHandshake(ServerHttpRequest request, ServerHttpResponse response, WebSocketHandler wsHandler, Map<String, Object> attributes) {
    HttpServletRequest httpRequest = ((ServletServerHttpRequest) request).getServletRequest();
    CsrfToken token = (CsrfToken) httpRequest.getAttribute(CsrfToken.class.getName());
    if (token == null) {
        return true;
    }
    attributes.put(CsrfToken.class.getName(), token);
    return true;
}

Example 57 with HttpServletRequest

use of jakarta.servlet.http.HttpServletRequest in project spring-security by spring-projects.

the class DefaultOAuth2AuthorizedClientManagerTests method authorizeWhenRequestParameterUsernamePasswordThenMappedToContext.

@Test
public void authorizeWhenRequestParameterUsernamePasswordThenMappedToContext() {
    given(this.clientRegistrationRepository.findByRegistrationId(eq(this.clientRegistration.getRegistrationId()))).willReturn(this.clientRegistration);
    given(this.authorizedClientProvider.authorize(any(OAuth2AuthorizationContext.class))).willReturn(this.authorizedClient);
    // Set custom contextAttributesMapper
    this.authorizedClientManager.setContextAttributesMapper((authorizeRequest) -> {
        Map<String, Object> contextAttributes = new HashMap<>();
        HttpServletRequest servletRequest = authorizeRequest.getAttribute(HttpServletRequest.class.getName());
        String username = servletRequest.getParameter(OAuth2ParameterNames.USERNAME);
        String password = servletRequest.getParameter(OAuth2ParameterNames.PASSWORD);
        if (StringUtils.hasText(username) && StringUtils.hasText(password)) {
            contextAttributes.put(OAuth2AuthorizationContext.USERNAME_ATTRIBUTE_NAME, username);
            contextAttributes.put(OAuth2AuthorizationContext.PASSWORD_ATTRIBUTE_NAME, password);
        }
        return contextAttributes;
    });
    this.request.addParameter(OAuth2ParameterNames.USERNAME, "username");
    this.request.addParameter(OAuth2ParameterNames.PASSWORD, "password");
    // @formatter:off
    OAuth2AuthorizeRequest authorizeRequest = OAuth2AuthorizeRequest.withClientRegistrationId(this.clientRegistration.getRegistrationId()).principal(this.principal).attributes((attrs) -> {
        attrs.put(HttpServletRequest.class.getName(), this.request);
        attrs.put(HttpServletResponse.class.getName(), this.response);
    }).build();
    // @formatter:on
    this.authorizedClientManager.authorize(authorizeRequest);
    verify(this.authorizedClientProvider).authorize(this.authorizationContextCaptor.capture());
    OAuth2AuthorizationContext authorizationContext = this.authorizationContextCaptor.getValue();
    String username = authorizationContext.getAttribute(OAuth2AuthorizationContext.USERNAME_ATTRIBUTE_NAME);
    assertThat(username).isEqualTo("username");
    String password = authorizationContext.getAttribute(OAuth2AuthorizationContext.PASSWORD_ATTRIBUTE_NAME);
    assertThat(password).isEqualTo("password");
}

Example 58 with HttpServletRequest

use of jakarta.servlet.http.HttpServletRequest in project spring-security by spring-projects.

the class DefaultOAuth2AuthorizedClientManagerTests method setup.

@SuppressWarnings("unchecked")
@BeforeEach
public void setup() {
    this.clientRegistrationRepository = mock(ClientRegistrationRepository.class);
    this.authorizedClientRepository = mock(OAuth2AuthorizedClientRepository.class);
    this.authorizedClientProvider = mock(OAuth2AuthorizedClientProvider.class);
    this.contextAttributesMapper = mock(Function.class);
    this.authorizationSuccessHandler = spy(new OAuth2AuthorizationSuccessHandler() {

        @Override
        public void onAuthorizationSuccess(OAuth2AuthorizedClient authorizedClient, Authentication principal, Map<String, Object> attributes) {
            DefaultOAuth2AuthorizedClientManagerTests.this.authorizedClientRepository.saveAuthorizedClient(authorizedClient, principal, (HttpServletRequest) attributes.get(HttpServletRequest.class.getName()), (HttpServletResponse) attributes.get(HttpServletResponse.class.getName()));
        }
    });
    this.authorizationFailureHandler = spy(new RemoveAuthorizedClientOAuth2AuthorizationFailureHandler((clientRegistrationId, principal, attributes) -> this.authorizedClientRepository.removeAuthorizedClient(clientRegistrationId, principal, (HttpServletRequest) attributes.get(HttpServletRequest.class.getName()), (HttpServletResponse) attributes.get(HttpServletResponse.class.getName()))));
    this.authorizedClientManager = new DefaultOAuth2AuthorizedClientManager(this.clientRegistrationRepository, this.authorizedClientRepository);
    this.authorizedClientManager.setAuthorizedClientProvider(this.authorizedClientProvider);
    this.authorizedClientManager.setContextAttributesMapper(this.contextAttributesMapper);
    this.authorizedClientManager.setAuthorizationSuccessHandler(this.authorizationSuccessHandler);
    this.authorizedClientManager.setAuthorizationFailureHandler(this.authorizationFailureHandler);
    this.clientRegistration = TestClientRegistrations.clientRegistration().build();
    this.principal = new TestingAuthenticationToken("principal", "password");
    this.authorizedClient = new OAuth2AuthorizedClient(this.clientRegistration, this.principal.getName(), TestOAuth2AccessTokens.scopes("read", "write"), TestOAuth2RefreshTokens.refreshToken());
    this.request = new MockHttpServletRequest();
    this.response = new MockHttpServletResponse();
    this.authorizationContextCaptor = ArgumentCaptor.forClass(OAuth2AuthorizationContext.class);
}

Example 59 with HttpServletRequest

use of jakarta.servlet.http.HttpServletRequest in project spring-security by spring-projects.

the class HttpSessionSecurityContextRepositoryTests method startAsyncRequestResponseDisablesSaveOnCommit.

@Test
public void startAsyncRequestResponseDisablesSaveOnCommit() throws Exception {
    HttpSessionSecurityContextRepository repo = new HttpSessionSecurityContextRepository();
    HttpServletRequest request = mock(HttpServletRequest.class);
    MockHttpServletResponse response = new MockHttpServletResponse();
    HttpRequestResponseHolder holder = new HttpRequestResponseHolder(request, response);
    repo.loadContext(holder);
    reset(request);
    holder.getRequest().startAsync(request, response);
    holder.getResponse().sendError(HttpServletResponse.SC_BAD_REQUEST);
    // ensure that sendError did cause interaction with the HttpSession
    verify(request, never()).getSession(anyBoolean());
    verify(request, never()).getSession();
}

Example 60 with HttpServletRequest

use of jakarta.servlet.http.HttpServletRequest in project spring-security by spring-projects.

the class ConcurrentSessionFilterTests method doFilterWhenOverrideThenCustomRedirectStrategyUsed.

@Test
public void doFilterWhenOverrideThenCustomRedirectStrategyUsed() throws Exception {
    MockHttpServletRequest request = new MockHttpServletRequest();
    MockHttpSession session = new MockHttpSession();
    request.setSession(session);
    MockHttpServletResponse response = new MockHttpServletResponse();
    RedirectStrategy redirect = mock(RedirectStrategy.class);
    SessionRegistry registry = mock(SessionRegistry.class);
    SessionInformation information = new SessionInformation("user", "sessionId", new Date(System.currentTimeMillis() - 1000));
    information.expireNow();
    given(registry.getSessionInformation(anyString())).willReturn(information);
    final String expiredUrl = "/expired";
    ConcurrentSessionFilter filter = new ConcurrentSessionFilter(registry, expiredUrl + "will-be-overrridden") {

        @Override
        protected String determineExpiredUrl(HttpServletRequest request, SessionInformation info) {
            return expiredUrl;
        }
    };
    filter.setRedirectStrategy(redirect);
    filter.doFilter(request, response, new MockFilterChain());
    verify(redirect).sendRedirect(request, response, expiredUrl);
}