Examples with HttpServletRequest jakarta.servlet.http.HttpServletRequest used on opensource projects

Example 36 with HttpServletRequest

use of jakarta.servlet.http.HttpServletRequest in project spring-security by spring-projects.

the class CookieRequestCacheTests method requestWhenDoesNotMatchSavedRequestThenDoesNotClearCookie.

@Test
public void requestWhenDoesNotMatchSavedRequestThenDoesNotClearCookie() {
    CookieRequestCache cookieRequestCache = new CookieRequestCache();
    MockHttpServletRequest request = new MockHttpServletRequest();
    request.setServerPort(443);
    request.setSecure(true);
    request.setScheme("https");
    request.setServerName("abc.com");
    request.setRequestURI("/destination");
    String redirectUrl = "https://abc.com/api";
    request.setCookies(new Cookie(DEFAULT_COOKIE_NAME, encodeCookie(redirectUrl)));
    MockHttpServletResponse response = new MockHttpServletResponse();
    final HttpServletRequest matchingRequest = cookieRequestCache.getMatchingRequest(request, response);
    assertThat(matchingRequest).isNull();
    Cookie expiredCookie = response.getCookie(DEFAULT_COOKIE_NAME);
    assertThat(expiredCookie).isNull();
}

Example 37 with HttpServletRequest

use of jakarta.servlet.http.HttpServletRequest in project spring-security by spring-projects.

the class OpenSamlLogoutRequestResolverTests method resolvePostWhenAuthenticatedThenIncludesName.

@Test
public void resolvePostWhenAuthenticatedThenIncludesName() {
    RelyingPartyRegistration registration = TestRelyingPartyRegistrations.full().assertingPartyDetails((party) -> party.singleLogoutServiceBinding(Saml2MessageBinding.POST)).build();
    Saml2Authentication authentication = authentication(registration);
    HttpServletRequest request = new MockHttpServletRequest();
    given(this.relyingPartyRegistrationResolver.resolve(any(), any())).willReturn(registration);
    Saml2LogoutRequest saml2LogoutRequest = this.logoutRequestResolver.resolve(request, authentication);
    assertThat(saml2LogoutRequest.getParameter(Saml2ParameterNames.SIG_ALG)).isNull();
    assertThat(saml2LogoutRequest.getParameter(Saml2ParameterNames.SIGNATURE)).isNull();
    assertThat(saml2LogoutRequest.getParameter(Saml2ParameterNames.RELAY_STATE)).isNotNull();
    Saml2MessageBinding binding = registration.getAssertingPartyDetails().getSingleLogoutServiceBinding();
    LogoutRequest logoutRequest = getLogoutRequest(saml2LogoutRequest.getSamlRequest(), binding);
    assertThat(logoutRequest.getNameID().getValue()).isEqualTo(authentication.getName());
    assertThat(logoutRequest.getSessionIndexes()).hasSize(1);
    assertThat(logoutRequest.getSessionIndexes().get(0).getSessionIndex()).isEqualTo("session-index");
}

Example 38 with HttpServletRequest

use of jakarta.servlet.http.HttpServletRequest in project spring-security by spring-projects.

the class OpenSamlLogoutRequestResolverTests method resolveRedirectWhenAuthenticatedThenIncludesName.

@Test
public void resolveRedirectWhenAuthenticatedThenIncludesName() {
    RelyingPartyRegistration registration = TestRelyingPartyRegistrations.full().build();
    Saml2Authentication authentication = authentication(registration);
    HttpServletRequest request = new MockHttpServletRequest();
    given(this.relyingPartyRegistrationResolver.resolve(any(), any())).willReturn(registration);
    Saml2LogoutRequest saml2LogoutRequest = this.logoutRequestResolver.resolve(request, authentication);
    assertThat(saml2LogoutRequest.getParameter(Saml2ParameterNames.SIG_ALG)).isNotNull();
    assertThat(saml2LogoutRequest.getParameter(Saml2ParameterNames.SIGNATURE)).isNotNull();
    assertThat(saml2LogoutRequest.getParameter(Saml2ParameterNames.RELAY_STATE)).isNotNull();
    Saml2MessageBinding binding = registration.getAssertingPartyDetails().getSingleLogoutServiceBinding();
    LogoutRequest logoutRequest = getLogoutRequest(saml2LogoutRequest.getSamlRequest(), binding);
    assertThat(logoutRequest.getNameID().getValue()).isEqualTo(authentication.getName());
}

Example 39 with HttpServletRequest

use of jakarta.servlet.http.HttpServletRequest in project spring-security by spring-projects.

the class RequestMatcherDelegatingWebInvocationPrivilegeEvaluatorTests method isAllowedWhenServletContextIsSetThenPassedFilterInvocationHttpServletRequestHasServletContext.

@Test
void isAllowedWhenServletContextIsSetThenPassedFilterInvocationHttpServletRequestHasServletContext() {
    Authentication token = new TestingAuthenticationToken("test", "Password", "MOCK_INDEX");
    MockServletContext servletContext = new MockServletContext();
    ArgumentCaptor<HttpServletRequest> argumentCaptor = ArgumentCaptor.forClass(HttpServletRequest.class);
    RequestMatcher requestMatcher = mock(RequestMatcher.class);
    WebInvocationPrivilegeEvaluator wipe = mock(WebInvocationPrivilegeEvaluator.class);
    RequestMatcherEntry<List<WebInvocationPrivilegeEvaluator>> delegate = new RequestMatcherEntry<>(requestMatcher, Collections.singletonList(wipe));
    RequestMatcherDelegatingWebInvocationPrivilegeEvaluator requestMatcherWipe = new RequestMatcherDelegatingWebInvocationPrivilegeEvaluator(Collections.singletonList(delegate));
    requestMatcherWipe.setServletContext(servletContext);
    requestMatcherWipe.isAllowed("/foo/index.jsp", token);
    verify(requestMatcher).matches(argumentCaptor.capture());
    assertThat(argumentCaptor.getValue().getServletContext()).isNotNull();
}

Example 40 with HttpServletRequest

use of jakarta.servlet.http.HttpServletRequest in project spring-security by spring-projects.

the class FilterChainProxyTests method setup.

@BeforeEach
public void setup() throws Exception {
    this.matcher = mock(RequestMatcher.class);
    this.filter = mock(Filter.class);
    willAnswer((Answer<Object>) (inv) -> {
        Object[] args = inv.getArguments();
        FilterChain fc = (FilterChain) args[2];
        HttpServletRequestWrapper extraWrapper = new HttpServletRequestWrapper((HttpServletRequest) args[0]);
        fc.doFilter(extraWrapper, (HttpServletResponse) args[1]);
        return null;
    }).given(this.filter).doFilter(any(), any(), any());
    this.fcp = new FilterChainProxy(new DefaultSecurityFilterChain(this.matcher, Arrays.asList(this.filter)));
    this.fcp.setFilterChainValidator(mock(FilterChainProxy.FilterChainValidator.class));
    this.request = new MockHttpServletRequest("GET", "");
    this.request.setServletPath("/path");
    this.response = new MockHttpServletResponse();
    this.chain = mock(FilterChain.class);
}