Examples with FilterInvocation org.springframework.security.web.FilterInvocation used on opensource projects

Example 36 with FilterInvocation

use of org.springframework.security.web.FilterInvocation in project spring-security by spring-projects.

the class FilterSecurityInterceptorTests method testSuccessfulInvocation.

/**
	 * We just test invocation works in a success event. There is no need to test access
	 * denied events as the abstract parent enforces that logic, which is extensively
	 * tested separately.
	 */
@Test
public void testSuccessfulInvocation() throws Throwable {
    // Setup a Context
    Authentication token = new TestingAuthenticationToken("Test", "Password", "NOT_USED");
    SecurityContextHolder.getContext().setAuthentication(token);
    FilterInvocation fi = createinvocation();
    when(ods.getAttributes(fi)).thenReturn(SecurityConfig.createList("MOCK_OK"));
    interceptor.invoke(fi);
    // SEC-1697
    verify(publisher, never()).publishEvent(any(AuthorizedEvent.class));
}

Example 37 with FilterInvocation

use of org.springframework.security.web.FilterInvocation in project spring-security by spring-projects.

the class FilterSecurityInterceptorTests method afterInvocationIsNotInvokedIfExceptionThrown.

@Test
public void afterInvocationIsNotInvokedIfExceptionThrown() throws Exception {
    Authentication token = new TestingAuthenticationToken("Test", "Password", "NOT_USED");
    SecurityContextHolder.getContext().setAuthentication(token);
    FilterInvocation fi = createinvocation();
    FilterChain chain = fi.getChain();
    doThrow(new RuntimeException()).when(chain).doFilter(any(HttpServletRequest.class), any(HttpServletResponse.class));
    when(ods.getAttributes(fi)).thenReturn(SecurityConfig.createList("MOCK_OK"));
    AfterInvocationManager aim = mock(AfterInvocationManager.class);
    interceptor.setAfterInvocationManager(aim);
    try {
        interceptor.invoke(fi);
        fail("Expected exception");
    } catch (RuntimeException expected) {
    }
    verifyZeroInteractions(aim);
}

Example 38 with FilterInvocation

use of org.springframework.security.web.FilterInvocation in project spring-security by spring-projects.

the class FilterSecurityInterceptorTests method createinvocation.

private FilterInvocation createinvocation() {
    MockHttpServletResponse response = new MockHttpServletResponse();
    MockHttpServletRequest request = new MockHttpServletRequest();
    request.setServletPath("/secure/page.html");
    FilterChain chain = mock(FilterChain.class);
    FilterInvocation fi = new FilterInvocation(request, response, chain);
    return fi;
}

Example 39 with FilterInvocation

use of org.springframework.security.web.FilterInvocation in project spring-security by spring-projects.

the class ExpressionBasedFilterInvocationSecurityMetadataSourceTests method expectedAttributeIsReturned.

@Test
public void expectedAttributeIsReturned() {
    final String expression = "hasRole('X')";
    LinkedHashMap<RequestMatcher, Collection<ConfigAttribute>> requestMap = new LinkedHashMap<RequestMatcher, Collection<ConfigAttribute>>();
    requestMap.put(AnyRequestMatcher.INSTANCE, SecurityConfig.createList(expression));
    ExpressionBasedFilterInvocationSecurityMetadataSource mds = new ExpressionBasedFilterInvocationSecurityMetadataSource(requestMap, new DefaultWebSecurityExpressionHandler());
    assertThat(mds.getAllConfigAttributes()).hasSize(1);
    Collection<ConfigAttribute> attrs = mds.getAttributes(new FilterInvocation("/path", "GET"));
    assertThat(attrs).hasSize(1);
    WebExpressionConfigAttribute attribute = (WebExpressionConfigAttribute) attrs.toArray()[0];
    assertThat(attribute.getAttribute()).isNull();
    assertThat(attribute.getAuthorizeExpression().getExpressionString()).isEqualTo(expression);
    assertThat(attribute.toString()).isEqualTo(expression);
}

Example 40 with FilterInvocation

use of org.springframework.security.web.FilterInvocation in project spring-security by spring-projects.

the class WebExpressionVoterTests method abstainsIfNoAttributeFound.

@Test
public void abstainsIfNoAttributeFound() {
    WebExpressionVoter voter = new WebExpressionVoter();
    assertThat(voter.vote(user, new FilterInvocation("/path", "GET"), SecurityConfig.createList("A", "B", "C"))).isEqualTo(AccessDecisionVoter.ACCESS_ABSTAIN);
}