Examples with HttpServletRequest jakarta.servlet.http.HttpServletRequest used on opensource projects

Example 11 with HttpServletRequest

use of jakarta.servlet.http.HttpServletRequest in project spring-security by spring-projects.

the class OpenSaml3LogoutRequestResolverTests method resolveWhenCustomParametersConsumerThenUses.

@Test
public void resolveWhenCustomParametersConsumerThenUses() {
    OpenSaml3LogoutRequestResolver logoutRequestResolver = new OpenSaml3LogoutRequestResolver(this.relyingPartyRegistrationResolver);
    logoutRequestResolver.setParametersConsumer((parameters) -> parameters.getLogoutRequest().setID("myid"));
    HttpServletRequest request = new MockHttpServletRequest();
    RelyingPartyRegistration registration = TestRelyingPartyRegistrations.relyingPartyRegistration().assertingPartyDetails((party) -> party.singleLogoutServiceLocation("https://ap.example.com/logout")).build();
    Authentication authentication = new TestingAuthenticationToken("user", "password");
    given(this.relyingPartyRegistrationResolver.resolve(any(), any())).willReturn(registration);
    Saml2LogoutRequest logoutRequest = logoutRequestResolver.resolve(request, authentication);
    assertThat(logoutRequest.getId()).isEqualTo("myid");
}

Example 12 with HttpServletRequest

use of jakarta.servlet.http.HttpServletRequest in project spring-security by spring-projects.

the class OpenSaml4LogoutRequestResolverTests method resolveWhenCustomParametersConsumerThenUses.

@Test
public void resolveWhenCustomParametersConsumerThenUses() {
    OpenSaml4LogoutRequestResolver logoutRequestResolver = new OpenSaml4LogoutRequestResolver(this.relyingPartyRegistrationResolver);
    logoutRequestResolver.setParametersConsumer((parameters) -> parameters.getLogoutRequest().setID("myid"));
    HttpServletRequest request = new MockHttpServletRequest();
    RelyingPartyRegistration registration = TestRelyingPartyRegistrations.relyingPartyRegistration().assertingPartyDetails((party) -> party.singleLogoutServiceLocation("https://ap.example.com/logout")).build();
    Authentication authentication = new TestingAuthenticationToken("user", "password");
    given(this.relyingPartyRegistrationResolver.resolve(any(), any())).willReturn(registration);
    Saml2LogoutRequest logoutRequest = logoutRequestResolver.resolve(request, authentication);
    assertThat(logoutRequest.getId()).isEqualTo("myid");
}

Example 13 with HttpServletRequest

use of jakarta.servlet.http.HttpServletRequest in project spring-security by spring-projects.

the class AbstractPreAuthenticatedProcessingFilterTests method requiresAuthenticationOverridePrincipalChangedFalse.

@Test
public void requiresAuthenticationOverridePrincipalChangedFalse() throws Exception {
    Object principal = new Object();
    SecurityContextHolder.getContext().setAuthentication(new TestingAuthenticationToken(principal, "something", "ROLE_USER"));
    MockHttpServletRequest request = new MockHttpServletRequest();
    MockHttpServletResponse response = new MockHttpServletResponse();
    MockFilterChain chain = new MockFilterChain();
    ConcretePreAuthenticatedProcessingFilter filter = new ConcretePreAuthenticatedProcessingFilter() {

        @Override
        protected boolean principalChanged(HttpServletRequest request, Authentication currentAuthentication) {
            return false;
        }
    };
    filter.setCheckForPrincipalChanges(true);
    filter.principal = principal;
    AuthenticationManager am = mock(AuthenticationManager.class);
    filter.setAuthenticationManager(am);
    filter.afterPropertiesSet();
    filter.doFilter(request, response, chain);
    verifyZeroInteractions(am);
}

Example 14 with HttpServletRequest

use of jakarta.servlet.http.HttpServletRequest in project spring-security by spring-projects.

the class AuthorizationFilterTests method filterWhenAuthorizationManagerVerifyThrowsAccessDeniedExceptionThenStopFilterChain.

@Test
public void filterWhenAuthorizationManagerVerifyThrowsAccessDeniedExceptionThenStopFilterChain() {
    AuthorizationManager<HttpServletRequest> mockAuthorizationManager = mock(AuthorizationManager.class);
    AuthorizationFilter filter = new AuthorizationFilter(mockAuthorizationManager);
    TestingAuthenticationToken authenticationToken = new TestingAuthenticationToken("user", "password");
    SecurityContext securityContext = new SecurityContextImpl();
    securityContext.setAuthentication(authenticationToken);
    SecurityContextHolder.setContext(securityContext);
    MockHttpServletRequest mockRequest = new MockHttpServletRequest(null, "/path");
    MockHttpServletResponse mockResponse = new MockHttpServletResponse();
    FilterChain mockFilterChain = mock(FilterChain.class);
    willThrow(new AccessDeniedException("Access Denied")).given(mockAuthorizationManager).verify(any(), eq(mockRequest));
    assertThatExceptionOfType(AccessDeniedException.class).isThrownBy(() -> filter.doFilter(mockRequest, mockResponse, mockFilterChain)).withMessage("Access Denied");
    ArgumentCaptor<Supplier<Authentication>> authenticationCaptor = ArgumentCaptor.forClass(Supplier.class);
    verify(mockAuthorizationManager).verify(authenticationCaptor.capture(), eq(mockRequest));
    Supplier<Authentication> authentication = authenticationCaptor.getValue();
    assertThat(authentication.get()).isEqualTo(authenticationToken);
    verifyNoInteractions(mockFilterChain);
}

Example 15 with HttpServletRequest

use of jakarta.servlet.http.HttpServletRequest in project spring-security by spring-projects.

the class GrantedAuthorityDefaultsXmlTests method doFilterIsUserInRole.

// SEC-2926
@Test
public void doFilterIsUserInRole() throws Exception {
    SecurityContext context = SecurityContextHolder.getContext();
    this.request.getSession().setAttribute(HttpSessionSecurityContextRepository.SPRING_SECURITY_CONTEXT_KEY, context);
    this.chain = new MockFilterChain() {

        @Override
        public void doFilter(ServletRequest request, ServletResponse response) throws IOException, ServletException {
            HttpServletRequest httpRequest = (HttpServletRequest) request;
            assertThat(httpRequest.isUserInRole("USER")).isTrue();
            assertThat(httpRequest.isUserInRole("INVALID")).isFalse();
            super.doFilter(request, response);
        }
    };
    this.springSecurityFilterChain.doFilter(this.request, this.response, this.chain);
    assertThat(this.chain.getRequest()).isNotNull();
}