Examples with AccessDeniedException org.springframework.security.access.AccessDeniedException used on opensource projects

Example 56 with AccessDeniedException

use of org.springframework.security.access.AccessDeniedException in project spring-security by spring-projects.

the class DelegatingAccessDeniedHandlerTests method matchesDoesNotInvokeDefault.

@Test
public void matchesDoesNotInvokeDefault() throws Exception {
    handlers.put(InvalidCsrfTokenException.class, handler1);
    handlers.put(MissingCsrfTokenException.class, handler2);
    handler = new DelegatingAccessDeniedHandler(handlers, handler3);
    AccessDeniedException accessDeniedException = new MissingCsrfTokenException("123");
    handler.handle(request, response, accessDeniedException);
    verify(handler1, never()).handle(any(HttpServletRequest.class), any(HttpServletResponse.class), any(AccessDeniedException.class));
    verify(handler2).handle(request, response, accessDeniedException);
    verify(handler3, never()).handle(any(HttpServletRequest.class), any(HttpServletResponse.class), any(AccessDeniedException.class));
}

Example 57 with AccessDeniedException

use of org.springframework.security.access.AccessDeniedException in project spring-security by spring-projects.

the class DelegatingAccessDeniedHandlerTests method moreSpecificDoesNotInvokeLessSpecific.

@Test
public void moreSpecificDoesNotInvokeLessSpecific() throws Exception {
    handlers.put(CsrfException.class, handler1);
    handler = new DelegatingAccessDeniedHandler(handlers, handler3);
    AccessDeniedException accessDeniedException = new AccessDeniedException("");
    handler.handle(request, response, accessDeniedException);
    verify(handler1, never()).handle(any(HttpServletRequest.class), any(HttpServletResponse.class), any(AccessDeniedException.class));
    verify(handler3).handle(request, response, accessDeniedException);
}

Example 58 with AccessDeniedException

use of org.springframework.security.access.AccessDeniedException in project spring-security by spring-projects.

the class ExceptionTranslationFilterTests method testAccessDeniedWithRememberMe.

@Test
public void testAccessDeniedWithRememberMe() throws Exception {
    // Setup our HTTP request
    MockHttpServletRequest request = new MockHttpServletRequest();
    request.setServletPath("/secure/page.html");
    request.setServerPort(80);
    request.setScheme("http");
    request.setServerName("www.example.com");
    request.setContextPath("/mycontext");
    request.setRequestURI("/mycontext/secure/page.html");
    // Setup the FilterChain to thrown an access denied exception
    FilterChain fc = mock(FilterChain.class);
    doThrow(new AccessDeniedException("")).when(fc).doFilter(any(HttpServletRequest.class), any(HttpServletResponse.class));
    // Setup SecurityContextHolder, as filter needs to check if user is remembered
    SecurityContext securityContext = SecurityContextHolder.createEmptyContext();
    securityContext.setAuthentication(new RememberMeAuthenticationToken("ignored", "ignored", AuthorityUtils.createAuthorityList("IGNORED")));
    SecurityContextHolder.setContext(securityContext);
    // Test
    ExceptionTranslationFilter filter = new ExceptionTranslationFilter(mockEntryPoint);
    MockHttpServletResponse response = new MockHttpServletResponse();
    filter.doFilter(request, response, fc);
    assertThat(response.getRedirectedUrl()).isEqualTo("/mycontext/login.jsp");
    assertThat(getSavedRequestUrl(request)).isEqualTo("http://www.example.com/mycontext/secure/page.html");
}

Example 59 with AccessDeniedException

use of org.springframework.security.access.AccessDeniedException in project spring-security by spring-projects.

the class ExceptionTranslationFilterTests method testAccessDeniedWhenNonAnonymous.

@Test
public void testAccessDeniedWhenNonAnonymous() throws Exception {
    // Setup our HTTP request
    MockHttpServletRequest request = new MockHttpServletRequest();
    request.setServletPath("/secure/page.html");
    // Setup the FilterChain to thrown an access denied exception
    FilterChain fc = mock(FilterChain.class);
    doThrow(new AccessDeniedException("")).when(fc).doFilter(any(HttpServletRequest.class), any(HttpServletResponse.class));
    // Setup SecurityContextHolder, as filter needs to check if user is
    // anonymous
    SecurityContextHolder.clearContext();
    // Setup a new AccessDeniedHandlerImpl that will do a "forward"
    AccessDeniedHandlerImpl adh = new AccessDeniedHandlerImpl();
    adh.setErrorPage("/error.jsp");
    // Test
    ExceptionTranslationFilter filter = new ExceptionTranslationFilter(mockEntryPoint);
    filter.setAccessDeniedHandler(adh);
    MockHttpServletResponse response = new MockHttpServletResponse();
    filter.doFilter(request, response, fc);
    assertThat(response.getStatus()).isEqualTo(403);
    assertThat(request.getAttribute(WebAttributes.ACCESS_DENIED_403)).isExactlyInstanceOf(AccessDeniedException.class);
}

Example 60 with AccessDeniedException

use of org.springframework.security.access.AccessDeniedException in project head by mifos.

the class UncaughtExceptionHandler method doResolveException.

@Override
protected ModelAndView doResolveException(HttpServletRequest request, HttpServletResponse response, Object handler, Exception ex) {
    ModelAndView modelAndView = checkForAccessDenied(ex, request);
    if (modelAndView == null) {
        modelAndView = checkForPageJndiException(ex, request);
    }
    if (modelAndView == null) {
        modelAndView = checkForPageExpiredException(ex, request);
    }
    if (modelAndView == null) {
        modelAndView = checkForMaxUploadSizeExceededException(ex, request);
    }
    if (request.getRequestURI().endsWith("json")) {
        if (modelAndView == null && ex instanceof RESTCallInterruptException) {
            // should move to explicit @ExceptionHandler(RESTCallInterruptException) controller method
            modelAndView = new ModelAndView();
            modelAndView.addObject("status", "interrupt");
            modelAndView.addObject("approvalId", ((RESTCallInterruptException) ex).getApprovalId());
            modelAndView.addObject("cause", "The call has been interrupt for approval");
            return modelAndView;
        }
        if (modelAndView == null || ex instanceof AccessDeniedException) {
            // should move to explicit @ExceptionHandler(Exception) controller method
            modelAndView = new ModelAndView();
            modelAndView.addObject("status", "error");
            modelAndView.addObject("cause", ex.getMessage());
            logger.error("REST API exception : URI '" + request.getRequestURI() + "'", ex);
            return modelAndView;
        }
    }
    if (modelAndView == null) {
        modelAndView = super.doResolveException(request, response, handler, ex);
    }
    if (modelAndView != null && !"HEAD".equals(request.getMethod())) {
        String requestUri = request.getRequestURI();
        logger.error("Uncaught exception while accessing '" + requestUri + "'", ex);
        modelAndView.addObject("uncaughtException", ex);
        modelAndView.addObject("requestUri", requestUri);
        if (ex != null) {
            Writer result = new StringWriter();
            ex.printStackTrace(new PrintWriter(result));
            modelAndView.addObject("stackString", result.toString());
        }
    }
    return modelAndView;
}