Examples with HttpSession jakarta.servlet.http.HttpSession used on opensource projects

Example 11 with HttpSession

use of jakarta.servlet.http.HttpSession in project spring-security by spring-projects.

the class SessionManagementConfigurerTests method sessionManagementWhenInvokedTwiceThenUsesOriginalSessionCreationPolicy.

@Test
public void sessionManagementWhenInvokedTwiceThenUsesOriginalSessionCreationPolicy() throws Exception {
    this.spring.register(InvokeTwiceDoesNotOverride.class).autowire();
    MvcResult mvcResult = this.mvc.perform(get("/")).andReturn();
    HttpSession session = mvcResult.getRequest().getSession(false);
    assertThat(session).isNull();
}

Example 12 with HttpSession

use of jakarta.servlet.http.HttpSession in project spring-security by spring-projects.

the class RememberMeConfigurerTests method getWhenRememberMeCookieAndLoggedOutThenRedirectsToLogin.

@Test
public void getWhenRememberMeCookieAndLoggedOutThenRedirectsToLogin() throws Exception {
    this.spring.register(RememberMeConfig.class).autowire();
    // @formatter:off
    MockHttpServletRequestBuilder loginRequest = post("/login").with(csrf()).param("username", "user").param("password", "password").param("remember-me", "true");
    // @formatter:on
    MvcResult loginMvcResult = this.mvc.perform(loginRequest).andReturn();
    Cookie rememberMeCookie = loginMvcResult.getResponse().getCookie("remember-me");
    HttpSession session = loginMvcResult.getRequest().getSession();
    // @formatter:off
    MockHttpServletRequestBuilder logoutRequest = post("/logout").with(csrf()).cookie(rememberMeCookie).session((MockHttpSession) session);
    // @formatter:on
    MvcResult logoutMvcResult = this.mvc.perform(logoutRequest).andReturn();
    Cookie expiredRememberMeCookie = logoutMvcResult.getResponse().getCookie("remember-me");
    // @formatter:off
    MockHttpServletRequestBuilder expiredRequest = get("/abc").with(csrf()).cookie(expiredRememberMeCookie);
    // @formatter:on
    this.mvc.perform(expiredRequest).andExpect(redirectedUrl("http://localhost/login"));
}

Example 13 with HttpSession

use of jakarta.servlet.http.HttpSession in project spring-security by spring-projects.

the class NamespaceHttpRequestCacheTests method requestWhenDefaultConfigurationThenUsesHttpSessionRequestCache.

@Test
public void requestWhenDefaultConfigurationThenUsesHttpSessionRequestCache() throws Exception {
    this.spring.register(DefaultRequestCacheRefConfig.class).autowire();
    MvcResult result = this.mvc.perform(get("/")).andExpect(status().isForbidden()).andReturn();
    HttpSession session = result.getRequest().getSession(false);
    assertThat(session).isNotNull();
    assertThat(session.getAttribute("SPRING_SECURITY_SAVED_REQUEST")).isNotNull();
}

Example 14 with HttpSession

use of jakarta.servlet.http.HttpSession in project spring-security by spring-projects.

the class HttpSessionDestroyedEvent method getSecurityContexts.

@SuppressWarnings("unchecked")
@Override
public List<SecurityContext> getSecurityContexts() {
    HttpSession session = getSession();
    Enumeration<String> attributes = session.getAttributeNames();
    ArrayList<SecurityContext> contexts = new ArrayList<>();
    while (attributes.hasMoreElements()) {
        String attributeName = attributes.nextElement();
        Object attributeValue = session.getAttribute(attributeName);
        if (attributeValue instanceof SecurityContext) {
            contexts.add((SecurityContext) attributeValue);
        }
    }
    return contexts;
}

Example 15 with HttpSession

use of jakarta.servlet.http.HttpSession in project spring-security by spring-projects.

the class DefaultSessionAuthenticationStrategyTests method onAuthenticationWhenMigrateSessionAttributesTrueThenMaxInactiveIntervalIsMigrated.

@Test
public void onAuthenticationWhenMigrateSessionAttributesTrueThenMaxInactiveIntervalIsMigrated() {
    SessionFixationProtectionStrategy strategy = new SessionFixationProtectionStrategy();
    HttpServletRequest request = new MockHttpServletRequest();
    HttpSession session = request.getSession();
    session.setMaxInactiveInterval(1);
    Authentication mockAuthentication = mock(Authentication.class);
    strategy.onAuthentication(mockAuthentication, request, new MockHttpServletResponse());
    assertThat(request.getSession().getMaxInactiveInterval()).isEqualTo(1);
}