Examples with SecurityWebFilterChain org.springframework.security.web.server.SecurityWebFilterChain used on opensource projects

Example 1 with SecurityWebFilterChain

use of org.springframework.security.web.server.SecurityWebFilterChain in project spring-security by spring-projects.

the class WebFluxSecurityConfiguration method springSecurityFilterChain.

/**
 * The default {@link ServerHttpSecurity} configuration.
 * @param http
 * @return
 */
private SecurityWebFilterChain springSecurityFilterChain(ServerHttpSecurity http) {
    http.authorizeExchange().anyExchange().authenticated();
    if (isOAuth2Present && OAuth2ClasspathGuard.shouldConfigure(this.context)) {
        OAuth2ClasspathGuard.configure(this.context, http);
    } else {
        http.httpBasic();
        http.formLogin();
    }
    SecurityWebFilterChain result = http.build();
    return result;
}

Example 2 with SecurityWebFilterChain

use of org.springframework.security.web.server.SecurityWebFilterChain in project spring-security by spring-projects.

the class LogoutSpecTests method logoutWhenCustomSecurityContextRepositoryThenLogsOut.

@Test
public void logoutWhenCustomSecurityContextRepositoryThenLogsOut() {
    WebSessionServerSecurityContextRepository repository = new WebSessionServerSecurityContextRepository();
    repository.setSpringSecurityContextAttrName("CUSTOM_CONTEXT_ATTR");
    // @formatter:off
    SecurityWebFilterChain securityWebFilter = this.http.securityContextRepository(repository).authorizeExchange().anyExchange().authenticated().and().formLogin().and().logout().and().build();
    WebTestClient webTestClient = WebTestClientBuilder.bindToWebFilters(securityWebFilter).build();
    WebDriver driver = WebTestClientHtmlUnitDriverBuilder.webTestClientSetup(webTestClient).build();
    // @formatter:on
    FormLoginTests.DefaultLoginPage loginPage = FormLoginTests.HomePage.to(driver, FormLoginTests.DefaultLoginPage.class).assertAt();
    // @formatter:off
    FormLoginTests.HomePage homePage = loginPage.loginForm().username("user").password("password").submit(FormLoginTests.HomePage.class);
    // @formatter:on
    homePage.assertAt();
    FormLoginTests.DefaultLogoutPage.to(driver).assertAt().logout();
    FormLoginTests.HomePage.to(driver, FormLoginTests.DefaultLoginPage.class).assertAt();
}

Example 3 with SecurityWebFilterChain

use of org.springframework.security.web.server.SecurityWebFilterChain in project spring-security by spring-projects.

the class LogoutSpecTests method logoutWhenDisabledThenDefaultLogoutPageDoesNotExist.

@Test
public void logoutWhenDisabledThenDefaultLogoutPageDoesNotExist() {
    // @formatter:off
    SecurityWebFilterChain securityWebFilter = this.http.authorizeExchange().anyExchange().authenticated().and().formLogin().and().logout().disable().build();
    WebTestClient webTestClient = WebTestClientBuilder.bindToControllerAndWebFilters(HomeController.class, securityWebFilter).build();
    WebDriver driver = WebTestClientHtmlUnitDriverBuilder.webTestClientSetup(webTestClient).build();
    // @formatter:on
    FormLoginTests.DefaultLoginPage loginPage = FormLoginTests.HomePage.to(driver, FormLoginTests.DefaultLoginPage.class).assertAt();
    // @formatter:off
    FormLoginTests.HomePage homePage = loginPage.loginForm().username("user").password("password").submit(FormLoginTests.HomePage.class);
    // @formatter:on
    homePage.assertAt();
    FormLoginTests.DefaultLogoutPage.to(driver);
    assertThat(driver.getPageSource()).isEmpty();
}

Example 4 with SecurityWebFilterChain

use of org.springframework.security.web.server.SecurityWebFilterChain in project spring-security by spring-projects.

the class ServerHttpSecurityTests method basicWithCustomAuthenticationManager.

@Test
public void basicWithCustomAuthenticationManager() {
    ReactiveAuthenticationManager customAuthenticationManager = mock(ReactiveAuthenticationManager.class);
    given(customAuthenticationManager.authenticate(any())).willReturn(Mono.just(new TestingAuthenticationToken("rob", "rob", "ROLE_USER", "ROLE_ADMIN")));
    // @formatter:off
    SecurityWebFilterChain securityFilterChain = this.http.httpBasic().authenticationManager(customAuthenticationManager).and().build();
    // @formatter:on
    WebFilterChainProxy springSecurityFilterChain = new WebFilterChainProxy(securityFilterChain);
    // @formatter:off
    WebTestClient client = WebTestClientBuilder.bindToWebFilters(springSecurityFilterChain).build();
    client.get().uri("/").headers((headers) -> headers.setBasicAuth("rob", "rob")).exchange().expectStatus().isOk().expectBody(String.class).consumeWith((b) -> assertThat(b.getResponseBody()).isEqualTo("ok"));
    // @formatter:on
    verifyZeroInteractions(this.authenticationManager);
}

Example 5 with SecurityWebFilterChain

use of org.springframework.security.web.server.SecurityWebFilterChain in project spring-security by spring-projects.

the class ServerHttpSecurityTests method csrfServerLogoutHandlerNotAppliedIfCsrfIsntEnabled.

@Test
public void csrfServerLogoutHandlerNotAppliedIfCsrfIsntEnabled() {
    SecurityWebFilterChain securityWebFilterChain = this.http.csrf().disable().build();
    assertThat(getWebFilter(securityWebFilterChain, CsrfWebFilter.class)).isNotPresent();
    Optional<ServerLogoutHandler> logoutHandler = getWebFilter(securityWebFilterChain, LogoutWebFilter.class).map((logoutWebFilter) -> (ServerLogoutHandler) ReflectionTestUtils.getField(logoutWebFilter, LogoutWebFilter.class, "logoutHandler"));
    assertThat(logoutHandler).get().isExactlyInstanceOf(SecurityContextServerLogoutHandler.class);
}