Examples with DefaultSecurityFilterChain org.springframework.security.web.DefaultSecurityFilterChain used on opensource projects

Example 1 with DefaultSecurityFilterChain

use of org.springframework.security.web.DefaultSecurityFilterChain in project spring-security by spring-projects.

the class FilterChainProxyConfigTests method mixingPatternsAndPlaceholdersDoesntCauseOrderingIssues.

// SEC-1235
@Test
public void mixingPatternsAndPlaceholdersDoesntCauseOrderingIssues() {
    FilterChainProxy fcp = this.appCtx.getBean("sec1235FilterChainProxy", FilterChainProxy.class);
    List<SecurityFilterChain> chains = fcp.getFilterChains();
    assertThat(getPattern(chains.get(0))).isEqualTo("/login*");
    assertThat(getPattern(chains.get(1))).isEqualTo("/logout");
    assertThat(((DefaultSecurityFilterChain) chains.get(2)).getRequestMatcher() instanceof AnyRequestMatcher).isTrue();
}

Example 2 with DefaultSecurityFilterChain

use of org.springframework.security.web.DefaultSecurityFilterChain in project spring-security by spring-projects.

the class DefaultFilterChainValidatorTests method setUp.

@BeforeEach
public void setUp() {
    AnonymousAuthenticationFilter aaf = new AnonymousAuthenticationFilter("anonymous");
    this.fsi = new FilterSecurityInterceptor();
    this.fsi.setAccessDecisionManager(this.accessDecisionManager);
    this.fsi.setSecurityMetadataSource(this.metadataSource);
    AuthenticationEntryPoint authenticationEntryPoint = new LoginUrlAuthenticationEntryPoint("/login");
    ExceptionTranslationFilter etf = new ExceptionTranslationFilter(authenticationEntryPoint);
    DefaultSecurityFilterChain securityChain = new DefaultSecurityFilterChain(AnyRequestMatcher.INSTANCE, aaf, etf, this.fsi);
    this.fcp = new FilterChainProxy(securityChain);
    this.validator = new DefaultFilterChainValidator();
    ReflectionTestUtils.setField(this.validator, "logger", this.logger);
}

Example 3 with DefaultSecurityFilterChain

use of org.springframework.security.web.DefaultSecurityFilterChain in project spring-security by spring-projects.

the class DefaultFiltersTests method filterChainProxyBuilderIgnoringResources.

@Test
public void filterChainProxyBuilderIgnoringResources() {
    this.spring.register(FilterChainProxyBuilderIgnoringConfig.class, UserDetailsServiceConfig.class);
    List<SecurityFilterChain> filterChains = this.spring.getContext().getBean(FilterChainProxy.class).getFilterChains();
    assertThat(filterChains.size()).isEqualTo(2);
    DefaultSecurityFilterChain firstFilter = (DefaultSecurityFilterChain) filterChains.get(0);
    DefaultSecurityFilterChain secondFilter = (DefaultSecurityFilterChain) filterChains.get(1);
    assertThat(firstFilter.getFilters().isEmpty()).isEqualTo(true);
    assertThat(secondFilter.getRequestMatcher()).isInstanceOf(AnyRequestMatcher.class);
    List<? extends Class<? extends Filter>> classes = secondFilter.getFilters().stream().map(Filter::getClass).collect(Collectors.toList());
    assertThat(classes.contains(WebAsyncManagerIntegrationFilter.class)).isTrue();
    assertThat(classes.contains(SecurityContextPersistenceFilter.class)).isTrue();
    assertThat(classes.contains(HeaderWriterFilter.class)).isTrue();
    assertThat(classes.contains(LogoutFilter.class)).isTrue();
    assertThat(classes.contains(CsrfFilter.class)).isTrue();
    assertThat(classes.contains(RequestCacheAwareFilter.class)).isTrue();
    assertThat(classes.contains(SecurityContextHolderAwareRequestFilter.class)).isTrue();
    assertThat(classes.contains(AnonymousAuthenticationFilter.class)).isTrue();
    assertThat(classes.contains(SessionManagementFilter.class)).isTrue();
    assertThat(classes.contains(ExceptionTranslationFilter.class)).isTrue();
    assertThat(classes.contains(FilterSecurityInterceptor.class)).isTrue();
}

Example 4 with DefaultSecurityFilterChain

use of org.springframework.security.web.DefaultSecurityFilterChain in project spring-security by spring-projects.

the class DefaultFiltersTests method nullWebInvocationPrivilegeEvaluator.

@Test
public void nullWebInvocationPrivilegeEvaluator() {
    this.spring.register(NullWebInvocationPrivilegeEvaluatorConfig.class, UserDetailsServiceConfig.class);
    List<SecurityFilterChain> filterChains = this.spring.getContext().getBean(FilterChainProxy.class).getFilterChains();
    assertThat(filterChains.size()).isEqualTo(1);
    DefaultSecurityFilterChain filterChain = (DefaultSecurityFilterChain) filterChains.get(0);
    assertThat(filterChain.getRequestMatcher()).isInstanceOf(AnyRequestMatcher.class);
    assertThat(filterChain.getFilters().size()).isEqualTo(1);
    long filter = filterChain.getFilters().stream().filter((it) -> it instanceof UsernamePasswordAuthenticationFilter).count();
    assertThat(filter).isEqualTo(1);
}

Example 5 with DefaultSecurityFilterChain

use of org.springframework.security.web.DefaultSecurityFilterChain in project spring-security by spring-projects.

the class NamespaceHttpTests method configureWhenIgnoredAntPatternsThenAntPathRequestMatcherUsedWithNoFilters.

// http@security=none
@Test
public void configureWhenIgnoredAntPatternsThenAntPathRequestMatcherUsedWithNoFilters() {
    this.spring.register(SecurityNoneConfig.class).autowire();
    FilterChainProxy filterChainProxy = this.spring.getContext().getBean(FilterChainProxy.class);
    assertThat(filterChainProxy.getFilterChains().get(0)).isInstanceOf(DefaultSecurityFilterChain.class);
    DefaultSecurityFilterChain securityFilterChain = (DefaultSecurityFilterChain) filterChainProxy.getFilterChains().get(0);
    assertThat(securityFilterChain.getRequestMatcher()).isInstanceOf(AntPathRequestMatcher.class);
    assertThat(((AntPathRequestMatcher) securityFilterChain.getRequestMatcher()).getPattern()).isEqualTo("/resources/**");
    assertThat(securityFilterChain.getFilters()).isEmpty();
    assertThat(filterChainProxy.getFilterChains().get(1)).isInstanceOf(DefaultSecurityFilterChain.class);
    securityFilterChain = (DefaultSecurityFilterChain) filterChainProxy.getFilterChains().get(1);
    assertThat(securityFilterChain.getRequestMatcher()).isInstanceOf(AntPathRequestMatcher.class);
    assertThat(((AntPathRequestMatcher) securityFilterChain.getRequestMatcher()).getPattern()).isEqualTo("/public/**");
    assertThat(securityFilterChain.getFilters()).isEmpty();
}