Examples with HttpSessionCsrfTokenRepository org.springframework.security.web.csrf.HttpSessionCsrfTokenRepository used on opensource projects

Example 1 with HttpSessionCsrfTokenRepository

use of org.springframework.security.web.csrf.HttpSessionCsrfTokenRepository in project spring-security by spring-projects.

the class WebTestUtilsTests method findFilterNoSpringSecurityFilterChainInContext.

@Test
public void findFilterNoSpringSecurityFilterChainInContext() {
    loadConfig(NoSecurityConfig.class);
    CsrfFilter toFind = new CsrfFilter(new HttpSessionCsrfTokenRepository());
    FilterChainProxy springSecurityFilterChain = new FilterChainProxy(new DefaultSecurityFilterChain(AnyRequestMatcher.INSTANCE, toFind));
    this.request.getServletContext().setAttribute(BeanIds.SPRING_SECURITY_FILTER_CHAIN, springSecurityFilterChain);
    assertThat(WebTestUtils.findFilter(this.request, toFind.getClass())).isEqualTo(toFind);
}

Example 2 with HttpSessionCsrfTokenRepository

use of org.springframework.security.web.csrf.HttpSessionCsrfTokenRepository in project spring-security by spring-projects.

the class SessionManagementConfigurerServlet31Tests method changeSessionIdDefaultsInServlet31Plus.

@Test
public void changeSessionIdDefaultsInServlet31Plus() throws Exception {
    spy(ReflectionUtils.class);
    Method method = mock(Method.class);
    MockHttpServletRequest request = new MockHttpServletRequest();
    request.getSession();
    request.setServletPath("/login");
    request.setMethod("POST");
    request.setParameter("username", "user");
    request.setParameter("password", "password");
    HttpSessionCsrfTokenRepository repository = new HttpSessionCsrfTokenRepository();
    CsrfToken token = repository.generateToken(request);
    repository.saveToken(token, request, response);
    request.setParameter(token.getParameterName(), token.getToken());
    when(ReflectionUtils.findMethod(HttpServletRequest.class, "changeSessionId")).thenReturn(method);
    loadConfig(SessionManagementDefaultSessionFixationServlet31Config.class);
    springSecurityFilterChain.doFilter(request, response, chain);
    verifyStatic();
    ReflectionUtils.invokeMethod(same(method), any(HttpServletRequest.class));
}

Example 3 with HttpSessionCsrfTokenRepository

use of org.springframework.security.web.csrf.HttpSessionCsrfTokenRepository in project spring-security by spring-projects.

the class WebTestUtilsTests method findFilterExplicitWithSecurityFilterInContext.

@Test
public void findFilterExplicitWithSecurityFilterInContext() {
    loadConfig(SecurityConfigWithDefaults.class);
    CsrfFilter toFind = new CsrfFilter(new HttpSessionCsrfTokenRepository());
    FilterChainProxy springSecurityFilterChain = new FilterChainProxy(new DefaultSecurityFilterChain(AnyRequestMatcher.INSTANCE, toFind));
    this.request.getServletContext().setAttribute(BeanIds.SPRING_SECURITY_FILTER_CHAIN, springSecurityFilterChain);
    assertThat(WebTestUtils.findFilter(this.request, toFind.getClass())).isSameAs(toFind);
}

Example 4 with HttpSessionCsrfTokenRepository

use of org.springframework.security.web.csrf.HttpSessionCsrfTokenRepository in project spring-security by spring-projects.

the class SecurityMockMvcRequestPostProcessorsCsrfTests method csrfWhenUsedThenDoesNotImpactOriginalRepository.

// gh-4016
@Test
public void csrfWhenUsedThenDoesNotImpactOriginalRepository() throws Exception {
    // @formatter:off
    this.mockMvc.perform(post("/").with(csrf()));
    MockHttpServletRequest request = new MockHttpServletRequest();
    HttpSessionCsrfTokenRepository repo = new HttpSessionCsrfTokenRepository();
    CsrfToken token = repo.generateToken(request);
    repo.saveToken(token, request, new MockHttpServletResponse());
    MockHttpServletRequestBuilder requestWithCsrf = post("/").param(token.getParameterName(), token.getToken()).session((MockHttpSession) request.getSession());
    this.mockMvc.perform(requestWithCsrf).andExpect(status().isOk());
// @formatter:on
}