Examples with SessionAuthenticationStrategy org.springframework.security.web.authentication.session.SessionAuthenticationStrategy used on opensource projects

Example 11 with SessionAuthenticationStrategy

use of org.springframework.security.web.authentication.session.SessionAuthenticationStrategy in project spring-security by spring-projects.

the class SessionManagementFilterTests method responseIsRedirectedToRequestedUrlIfSetAndSessionIsInvalid.

@Test
public void responseIsRedirectedToRequestedUrlIfSetAndSessionIsInvalid() throws Exception {
    SecurityContextRepository repo = mock(SecurityContextRepository.class);
    // repo will return false to containsContext()
    SessionAuthenticationStrategy strategy = mock(SessionAuthenticationStrategy.class);
    SessionManagementFilter filter = new SessionManagementFilter(repo, strategy);
    MockHttpServletRequest request = new MockHttpServletRequest();
    request.setRequestedSessionId("xxx");
    request.setRequestedSessionIdValid(false);
    MockHttpServletResponse response = new MockHttpServletResponse();
    filter.doFilter(request, response, new MockFilterChain());
    assertThat(response.getRedirectedUrl()).isNull();
    // Now set a redirect URL
    request = new MockHttpServletRequest();
    request.setRequestedSessionId("xxx");
    request.setRequestedSessionIdValid(false);
    request.setRequestURI("/requested");
    RequestedUrlRedirectInvalidSessionStrategy iss = new RequestedUrlRedirectInvalidSessionStrategy();
    iss.setCreateNewSession(true);
    filter.setInvalidSessionStrategy(iss);
    FilterChain fc = mock(FilterChain.class);
    filter.doFilter(request, response, fc);
    verifyZeroInteractions(fc);
    assertThat(response.getRedirectedUrl()).isEqualTo("/requested");
}