Examples with SecurityFilterChain org.springframework.security.web.SecurityFilterChain used on opensource projects

Example 1 with SecurityFilterChain

use of org.springframework.security.web.SecurityFilterChain in project motech by motech.

the class SecurityRuleBuilderTest method testMinimalRequirements.

@Test
public void testMinimalRequirements() {
    MotechURLSecurityRule securityRule = new MotechURLSecurityRule();
    securityRule.setPattern("pattern");
    securityRule.setProtocol(HTTP);
    securityRule.setSupportedSchemes(Arrays.asList(USERNAME_PASSWORD));
    securityRule.setMethodsRequired(Arrays.asList(ANY));
    SecurityFilterChain filterChain = securityBuilder.buildSecurityChain(securityRule, GET);
    assertNotNull(filterChain);
    assertEquals(10, filterChain.getFilters().size());
}

Example 2 with SecurityFilterChain

use of org.springframework.security.web.SecurityFilterChain in project spring-security by spring-projects.

the class DefaultFilterChainValidator method validate.

@Override
public void validate(FilterChainProxy fcp) {
    for (SecurityFilterChain filterChain : fcp.getFilterChains()) {
        checkLoginPageIsntProtected(fcp, filterChain.getFilters());
        checkFilterStack(filterChain.getFilters());
    }
    checkPathOrder(new ArrayList<>(fcp.getFilterChains()));
    checkForDuplicateMatchers(new ArrayList<>(fcp.getFilterChains()));
}

Example 3 with SecurityFilterChain

use of org.springframework.security.web.SecurityFilterChain in project spring-security by spring-projects.

the class FilterChainProxyConfigTests method mixingPatternsAndPlaceholdersDoesntCauseOrderingIssues.

// SEC-1235
@Test
public void mixingPatternsAndPlaceholdersDoesntCauseOrderingIssues() {
    FilterChainProxy fcp = this.appCtx.getBean("sec1235FilterChainProxy", FilterChainProxy.class);
    List<SecurityFilterChain> chains = fcp.getFilterChains();
    assertThat(getPattern(chains.get(0))).isEqualTo("/login*");
    assertThat(getPattern(chains.get(1))).isEqualTo("/logout");
    assertThat(((DefaultSecurityFilterChain) chains.get(2)).getRequestMatcher() instanceof AnyRequestMatcher).isTrue();
}

Example 4 with SecurityFilterChain

use of org.springframework.security.web.SecurityFilterChain in project spring-security by spring-projects.

the class DefaultFiltersTests method filterChainProxyBuilderIgnoringResources.

@Test
public void filterChainProxyBuilderIgnoringResources() {
    this.spring.register(FilterChainProxyBuilderIgnoringConfig.class, UserDetailsServiceConfig.class);
    List<SecurityFilterChain> filterChains = this.spring.getContext().getBean(FilterChainProxy.class).getFilterChains();
    assertThat(filterChains.size()).isEqualTo(2);
    DefaultSecurityFilterChain firstFilter = (DefaultSecurityFilterChain) filterChains.get(0);
    DefaultSecurityFilterChain secondFilter = (DefaultSecurityFilterChain) filterChains.get(1);
    assertThat(firstFilter.getFilters().isEmpty()).isEqualTo(true);
    assertThat(secondFilter.getRequestMatcher()).isInstanceOf(AnyRequestMatcher.class);
    List<? extends Class<? extends Filter>> classes = secondFilter.getFilters().stream().map(Filter::getClass).collect(Collectors.toList());
    assertThat(classes.contains(WebAsyncManagerIntegrationFilter.class)).isTrue();
    assertThat(classes.contains(SecurityContextPersistenceFilter.class)).isTrue();
    assertThat(classes.contains(HeaderWriterFilter.class)).isTrue();
    assertThat(classes.contains(LogoutFilter.class)).isTrue();
    assertThat(classes.contains(CsrfFilter.class)).isTrue();
    assertThat(classes.contains(RequestCacheAwareFilter.class)).isTrue();
    assertThat(classes.contains(SecurityContextHolderAwareRequestFilter.class)).isTrue();
    assertThat(classes.contains(AnonymousAuthenticationFilter.class)).isTrue();
    assertThat(classes.contains(SessionManagementFilter.class)).isTrue();
    assertThat(classes.contains(ExceptionTranslationFilter.class)).isTrue();
    assertThat(classes.contains(FilterSecurityInterceptor.class)).isTrue();
}

Example 5 with SecurityFilterChain

use of org.springframework.security.web.SecurityFilterChain in project spring-security by spring-projects.

the class DefaultFiltersTests method nullWebInvocationPrivilegeEvaluator.

@Test
public void nullWebInvocationPrivilegeEvaluator() {
    this.spring.register(NullWebInvocationPrivilegeEvaluatorConfig.class, UserDetailsServiceConfig.class);
    List<SecurityFilterChain> filterChains = this.spring.getContext().getBean(FilterChainProxy.class).getFilterChains();
    assertThat(filterChains.size()).isEqualTo(1);
    DefaultSecurityFilterChain filterChain = (DefaultSecurityFilterChain) filterChains.get(0);
    assertThat(filterChain.getRequestMatcher()).isInstanceOf(AnyRequestMatcher.class);
    assertThat(filterChain.getFilters().size()).isEqualTo(1);
    long filter = filterChain.getFilters().stream().filter((it) -> it instanceof UsernamePasswordAuthenticationFilter).count();
    assertThat(filter).isEqualTo(1);
}