Search in sources :

Example 1 with HttpServletResponse

use of jakarta.servlet.http.HttpServletResponse in project atmosphere by Atmosphere.

the class MeteorTest method testMeteor.

@Test
public void testMeteor() throws IOException, ServletException {
    final AtomicReference<Meteor> meteor = new AtomicReference<Meteor>();
    final Servlet s = new HttpServlet() {

        @Override
        protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
            meteor.set(Meteor.lookup(req));
        }
    };
    framework.addAtmosphereHandler("/a", new ReflectorServletProcessor(s));
    AtmosphereRequest request = new AtmosphereRequestImpl.Builder().pathInfo("/a").build();
    framework.interceptor(new AtmosphereInterceptorAdapter() {

        @Override
        public Action inspect(AtmosphereResource r) {
            Meteor m = Meteor.build(r.getRequest());
            return Action.CONTINUE;
        }
    });
    framework.doCometSupport(request, AtmosphereResponseImpl.newInstance());
    assertNotNull(meteor.get());
}
Also used : HttpServlet(jakarta.servlet.http.HttpServlet) HttpServletResponse(jakarta.servlet.http.HttpServletResponse) AtomicReference(java.util.concurrent.atomic.AtomicReference) HttpServletRequest(jakarta.servlet.http.HttpServletRequest) HttpServlet(jakarta.servlet.http.HttpServlet) Servlet(jakarta.servlet.Servlet) ReflectorServletProcessor(org.atmosphere.handler.ReflectorServletProcessor) Test(org.testng.annotations.Test)

Example 2 with HttpServletResponse

use of jakarta.servlet.http.HttpServletResponse in project atmosphere by Atmosphere.

the class MeteorTest method testMeteorNull.

@Test
public void testMeteorNull() throws IOException, ServletException {
    final AtomicReference<Meteor> meteor = new AtomicReference<Meteor>();
    final Servlet s = new HttpServlet() {

        @Override
        protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
            meteor.set(Meteor.lookup(req));
        }
    };
    framework.addAtmosphereHandler("/a", new ReflectorServletProcessor(s));
    AtmosphereRequest request = new AtmosphereRequestImpl.Builder().pathInfo("/a").build();
    framework.interceptor(new AtmosphereInterceptorAdapter() {

        @Override
        public Action inspect(AtmosphereResource r) {
            return Action.CONTINUE;
        }
    });
    framework.doCometSupport(request, AtmosphereResponseImpl.newInstance());
    assertNull(meteor.get());
}
Also used : HttpServlet(jakarta.servlet.http.HttpServlet) HttpServletResponse(jakarta.servlet.http.HttpServletResponse) AtomicReference(java.util.concurrent.atomic.AtomicReference) HttpServletRequest(jakarta.servlet.http.HttpServletRequest) HttpServlet(jakarta.servlet.http.HttpServlet) Servlet(jakarta.servlet.Servlet) ReflectorServletProcessor(org.atmosphere.handler.ReflectorServletProcessor) Test(org.testng.annotations.Test)

Example 3 with HttpServletResponse

use of jakarta.servlet.http.HttpServletResponse in project spring-security by spring-projects.

the class Saml2WebSsoAuthenticationRequestFilterTests method setup.

@BeforeEach
public void setup() {
    this.filter = new Saml2WebSsoAuthenticationRequestFilter(this.resolver, this.factory);
    this.request = new MockHttpServletRequest();
    this.response = new MockHttpServletResponse();
    this.request.setPathInfo("/saml2/authenticate/registration-id");
    this.filterChain = new MockFilterChain() {

        @Override
        public void doFilter(ServletRequest request, ServletResponse response) {
            ((HttpServletResponse) response).setStatus(HttpServletResponse.SC_UNAUTHORIZED);
        }
    };
    this.rpBuilder = RelyingPartyRegistration.withRegistrationId("registration-id").providerDetails((c) -> c.entityId("idp-entity-id")).providerDetails((c) -> c.webSsoUrl(IDP_SSO_URL)).assertionConsumerServiceUrlTemplate("template").credentials((c) -> c.add(TestSaml2X509Credentials.assertingPartyPrivateCredential()));
    this.filter.setAuthenticationRequestRepository(this.authenticationRequestRepository);
}
Also used : Saml2AuthenticationRequestRepository(org.springframework.security.saml2.provider.service.web.Saml2AuthenticationRequestRepository) ArgumentMatchers.any(org.mockito.ArgumentMatchers.any) BeforeEach(org.junit.jupiter.api.BeforeEach) MockFilterChain(org.springframework.mock.web.MockFilterChain) ArgumentMatchers.eq(org.mockito.ArgumentMatchers.eq) RelyingPartyRegistrationRepository(org.springframework.security.saml2.provider.service.registration.RelyingPartyRegistrationRepository) Assertions.assertThat(org.assertj.core.api.Assertions.assertThat) Saml2AuthenticationRequestResolver(org.springframework.security.saml2.provider.service.web.authentication.Saml2AuthenticationRequestResolver) DefaultSaml2AuthenticationRequestContextResolver(org.springframework.security.saml2.provider.service.web.DefaultSaml2AuthenticationRequestContextResolver) ServletException(jakarta.servlet.ServletException) MockHttpServletResponse(org.springframework.mock.web.MockHttpServletResponse) RelyingPartyRegistration(org.springframework.security.saml2.provider.service.registration.RelyingPartyRegistration) HtmlUtils(org.springframework.web.util.HtmlUtils) Saml2MessageBinding(org.springframework.security.saml2.provider.service.registration.Saml2MessageBinding) Mockito.verifyNoInteractions(org.mockito.Mockito.verifyNoInteractions) Saml2AuthenticationRequestContextResolver(org.springframework.security.saml2.provider.service.web.Saml2AuthenticationRequestContextResolver) BDDMockito.given(org.mockito.BDDMockito.given) AbstractSaml2AuthenticationRequest(org.springframework.security.saml2.provider.service.authentication.AbstractSaml2AuthenticationRequest) Saml2AuthenticationRequestContext(org.springframework.security.saml2.provider.service.authentication.Saml2AuthenticationRequestContext) Saml2PostAuthenticationRequest(org.springframework.security.saml2.provider.service.authentication.Saml2PostAuthenticationRequest) Saml2RedirectAuthenticationRequest(org.springframework.security.saml2.provider.service.authentication.Saml2RedirectAuthenticationRequest) DefaultRelyingPartyRegistrationResolver(org.springframework.security.saml2.provider.service.web.DefaultRelyingPartyRegistrationResolver) Saml2AuthenticationRequestFactory(org.springframework.security.saml2.provider.service.authentication.Saml2AuthenticationRequestFactory) ServletRequest(jakarta.servlet.ServletRequest) RelyingPartyRegistrationResolver(org.springframework.security.saml2.provider.service.web.RelyingPartyRegistrationResolver) IOException(java.io.IOException) MockHttpServletRequest(org.springframework.mock.web.MockHttpServletRequest) RequestMatcher(org.springframework.security.web.util.matcher.RequestMatcher) StandardCharsets(java.nio.charset.StandardCharsets) Mockito.verify(org.mockito.Mockito.verify) Test(org.junit.jupiter.api.Test) TestSaml2X509Credentials(org.springframework.security.saml2.credentials.TestSaml2X509Credentials) ServletResponse(jakarta.servlet.ServletResponse) Assertions.assertThatIllegalArgumentException(org.assertj.core.api.Assertions.assertThatIllegalArgumentException) UriUtils(org.springframework.web.util.UriUtils) HttpServletResponse(jakarta.servlet.http.HttpServletResponse) TestSaml2AuthenticationRequestContexts(org.springframework.security.saml2.provider.service.authentication.TestSaml2AuthenticationRequestContexts) TestRelyingPartyRegistrations(org.springframework.security.saml2.provider.service.registration.TestRelyingPartyRegistrations) AntPathRequestMatcher(org.springframework.security.web.util.matcher.AntPathRequestMatcher) Mockito.mock(org.mockito.Mockito.mock) ServletRequest(jakarta.servlet.ServletRequest) MockHttpServletRequest(org.springframework.mock.web.MockHttpServletRequest) MockHttpServletResponse(org.springframework.mock.web.MockHttpServletResponse) ServletResponse(jakarta.servlet.ServletResponse) HttpServletResponse(jakarta.servlet.http.HttpServletResponse) MockHttpServletRequest(org.springframework.mock.web.MockHttpServletRequest) MockFilterChain(org.springframework.mock.web.MockFilterChain) MockHttpServletResponse(org.springframework.mock.web.MockHttpServletResponse) BeforeEach(org.junit.jupiter.api.BeforeEach)

Example 4 with HttpServletResponse

use of jakarta.servlet.http.HttpServletResponse in project spring-security by spring-projects.

the class Saml2LogoutRequestFilter method doFilterInternal.

@Override
protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain chain) throws ServletException, IOException {
    if (!this.logoutRequestMatcher.matches(request)) {
        chain.doFilter(request, response);
        return;
    }
    if (request.getParameter(Saml2ParameterNames.SAML_REQUEST) == null) {
        chain.doFilter(request, response);
        return;
    }
    Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
    RelyingPartyRegistration registration = this.relyingPartyRegistrationResolver.resolve(request, getRegistrationId(authentication));
    if (registration == null) {
        this.logger.trace("Did not process logout request since failed to find associated RelyingPartyRegistration");
        response.sendError(HttpServletResponse.SC_BAD_REQUEST);
        return;
    }
    if (registration.getSingleLogoutServiceLocation() == null) {
        this.logger.trace("Did not process logout request since RelyingPartyRegistration has not been configured with a logout request endpoint");
        response.sendError(HttpServletResponse.SC_UNAUTHORIZED);
        return;
    }
    if (!isCorrectBinding(request, registration)) {
        this.logger.trace("Did not process logout request since used incorrect binding");
        response.sendError(HttpServletResponse.SC_UNAUTHORIZED);
        return;
    }
    String serialized = request.getParameter(Saml2ParameterNames.SAML_REQUEST);
    Saml2LogoutRequest logoutRequest = Saml2LogoutRequest.withRelyingPartyRegistration(registration).samlRequest(serialized).relayState(request.getParameter(Saml2ParameterNames.RELAY_STATE)).binding(registration.getSingleLogoutServiceBinding()).location(registration.getSingleLogoutServiceLocation()).parameters((params) -> params.put(Saml2ParameterNames.SIG_ALG, request.getParameter(Saml2ParameterNames.SIG_ALG))).parameters((params) -> params.put(Saml2ParameterNames.SIGNATURE, request.getParameter(Saml2ParameterNames.SIGNATURE))).build();
    Saml2LogoutRequestValidatorParameters parameters = new Saml2LogoutRequestValidatorParameters(logoutRequest, registration, authentication);
    Saml2LogoutValidatorResult result = this.logoutRequestValidator.validate(parameters);
    if (result.hasErrors()) {
        response.sendError(HttpServletResponse.SC_UNAUTHORIZED, result.getErrors().iterator().next().toString());
        this.logger.debug(LogMessage.format("Failed to validate LogoutRequest: %s", result.getErrors()));
        return;
    }
    this.handler.logout(request, response, authentication);
    Saml2LogoutResponse logoutResponse = this.logoutResponseResolver.resolve(request, authentication);
    if (logoutResponse == null) {
        this.logger.trace("Returning 401 since no logout response generated");
        response.setStatus(HttpServletResponse.SC_UNAUTHORIZED);
        return;
    }
    if (logoutResponse.getBinding() == Saml2MessageBinding.REDIRECT) {
        doRedirect(request, response, logoutResponse);
    } else {
        doPost(response, logoutResponse);
    }
}
Also used : RelyingPartyRegistration(org.springframework.security.saml2.provider.service.registration.RelyingPartyRegistration) UriComponentsBuilder(org.springframework.web.util.UriComponentsBuilder) HttpServletRequest(jakarta.servlet.http.HttpServletRequest) DefaultRedirectStrategy(org.springframework.security.web.DefaultRedirectStrategy) OncePerRequestFilter(org.springframework.web.filter.OncePerRequestFilter) ServletException(jakarta.servlet.ServletException) Saml2LogoutResponse(org.springframework.security.saml2.provider.service.authentication.logout.Saml2LogoutResponse) Function(java.util.function.Function) RelyingPartyRegistration(org.springframework.security.saml2.provider.service.registration.RelyingPartyRegistration) RedirectStrategy(org.springframework.security.web.RedirectStrategy) HtmlUtils(org.springframework.web.util.HtmlUtils) Saml2MessageBinding(org.springframework.security.saml2.provider.service.registration.Saml2MessageBinding) LogMessage(org.springframework.core.log.LogMessage) Saml2LogoutRequestValidator(org.springframework.security.saml2.provider.service.authentication.logout.Saml2LogoutRequestValidator) CompositeLogoutHandler(org.springframework.security.web.authentication.logout.CompositeLogoutHandler) SecurityContextHolder(org.springframework.security.core.context.SecurityContextHolder) RelyingPartyRegistrationResolver(org.springframework.security.saml2.provider.service.web.RelyingPartyRegistrationResolver) MediaType(org.springframework.http.MediaType) FilterChain(jakarta.servlet.FilterChain) IOException(java.io.IOException) RequestMatcher(org.springframework.security.web.util.matcher.RequestMatcher) StandardCharsets(java.nio.charset.StandardCharsets) Saml2LogoutValidatorResult(org.springframework.security.saml2.provider.service.authentication.logout.Saml2LogoutValidatorResult) Saml2ParameterNames(org.springframework.security.saml2.core.Saml2ParameterNames) LogoutHandler(org.springframework.security.web.authentication.logout.LogoutHandler) UriUtils(org.springframework.web.util.UriUtils) Log(org.apache.commons.logging.Log) Saml2LogoutRequestValidatorParameters(org.springframework.security.saml2.provider.service.authentication.logout.Saml2LogoutRequestValidatorParameters) HttpServletResponse(jakarta.servlet.http.HttpServletResponse) LogFactory(org.apache.commons.logging.LogFactory) Authentication(org.springframework.security.core.Authentication) Saml2AuthenticatedPrincipal(org.springframework.security.saml2.provider.service.authentication.Saml2AuthenticatedPrincipal) Saml2LogoutRequest(org.springframework.security.saml2.provider.service.authentication.logout.Saml2LogoutRequest) AntPathRequestMatcher(org.springframework.security.web.util.matcher.AntPathRequestMatcher) Assert(org.springframework.util.Assert) StringUtils(org.springframework.util.StringUtils) Saml2LogoutValidatorResult(org.springframework.security.saml2.provider.service.authentication.logout.Saml2LogoutValidatorResult) Saml2LogoutRequestValidatorParameters(org.springframework.security.saml2.provider.service.authentication.logout.Saml2LogoutRequestValidatorParameters) Authentication(org.springframework.security.core.Authentication) Saml2LogoutRequest(org.springframework.security.saml2.provider.service.authentication.logout.Saml2LogoutRequest) Saml2LogoutResponse(org.springframework.security.saml2.provider.service.authentication.logout.Saml2LogoutResponse)

Example 5 with HttpServletResponse

use of jakarta.servlet.http.HttpServletResponse in project spring-security by spring-projects.

the class MiscHttpConfigTests method getWhenUsingCustomHttpFirewallThenFirewallIsInvoked.

@Test
public void getWhenUsingCustomHttpFirewallThenFirewallIsInvoked() throws Exception {
    this.spring.configLocations(xml("HttpFirewall")).autowire();
    FirewalledRequest request = new FirewalledRequest(new MockHttpServletRequest()) {

        @Override
        public void reset() {
        }
    };
    HttpServletResponse response = new MockHttpServletResponse();
    HttpFirewall firewall = this.spring.getContext().getBean(HttpFirewall.class);
    given(firewall.getFirewalledRequest(any(HttpServletRequest.class))).willReturn(request);
    given(firewall.getFirewalledResponse(any(HttpServletResponse.class))).willReturn(response);
    this.mvc.perform(get("/unprotected"));
    verify(firewall).getFirewalledRequest(any(HttpServletRequest.class));
    verify(firewall).getFirewalledResponse(any(HttpServletResponse.class));
}
Also used : MockHttpServletRequest(org.springframework.mock.web.MockHttpServletRequest) HttpServletRequest(jakarta.servlet.http.HttpServletRequest) MockHttpServletRequest(org.springframework.mock.web.MockHttpServletRequest) HttpFirewall(org.springframework.security.web.firewall.HttpFirewall) FirewalledRequest(org.springframework.security.web.firewall.FirewalledRequest) MockHttpServletResponse(org.springframework.mock.web.MockHttpServletResponse) HttpServletResponse(jakarta.servlet.http.HttpServletResponse) MockHttpServletResponse(org.springframework.mock.web.MockHttpServletResponse) Test(org.junit.jupiter.api.Test)

Aggregations

HttpServletResponse (jakarta.servlet.http.HttpServletResponse)118 HttpServletRequest (jakarta.servlet.http.HttpServletRequest)76 Test (org.junit.jupiter.api.Test)47 MockHttpServletResponse (org.springframework.web.testfixture.servlet.MockHttpServletResponse)34 MockHttpServletRequest (org.springframework.web.testfixture.servlet.MockHttpServletRequest)31 FilterChain (jakarta.servlet.FilterChain)22 Assertions.assertThat (org.assertj.core.api.Assertions.assertThat)18 MockHttpServletRequest (org.springframework.mock.web.MockHttpServletRequest)16 MockHttpServletResponse (org.springframework.mock.web.MockHttpServletResponse)15 ServletException (jakarta.servlet.ServletException)14 StandardCharsets (java.nio.charset.StandardCharsets)14 HttpServlet (jakarta.servlet.http.HttpServlet)13 IOException (java.io.IOException)12 HashMap (java.util.HashMap)12 TomcatBaseTest (org.apache.catalina.startup.TomcatBaseTest)10 Test (org.junit.Test)10 Authentication (org.springframework.security.core.Authentication)10 FileCopyUtils (org.springframework.util.FileCopyUtils)9 BeforeEach (org.junit.jupiter.api.BeforeEach)8 Collections (java.util.Collections)7