Examples with SecurityWebFilterChain org.springframework.security.web.server.SecurityWebFilterChain used on opensource projects

Example 26 with SecurityWebFilterChain

use of org.springframework.security.web.server.SecurityWebFilterChain in project spring-security by spring-projects.

the class ServerHttpSecurityTests method postWhenCustomCsrfTokenRepositoryThenUsed.

@Test
public void postWhenCustomCsrfTokenRepositoryThenUsed() {
    ServerCsrfTokenRepository customServerCsrfTokenRepository = mock(ServerCsrfTokenRepository.class);
    given(customServerCsrfTokenRepository.loadToken(any(ServerWebExchange.class))).willReturn(Mono.empty());
    SecurityWebFilterChain securityFilterChain = this.http.csrf((csrf) -> csrf.csrfTokenRepository(customServerCsrfTokenRepository)).build();
    WebFilterChainProxy springSecurityFilterChain = new WebFilterChainProxy(securityFilterChain);
    WebTestClient client = WebTestClientBuilder.bindToWebFilters(springSecurityFilterChain).build();
    client.post().uri("/").exchange().expectStatus().isForbidden();
    verify(customServerCsrfTokenRepository).loadToken(any());
}

Example 27 with SecurityWebFilterChain

use of org.springframework.security.web.server.SecurityWebFilterChain in project spring-security by spring-projects.

the class ServerHttpSecurityTests method shouldConfigureAuthorizationRequestRepositoryForOAuth2Login.

@Test
public void shouldConfigureAuthorizationRequestRepositoryForOAuth2Login() {
    ServerAuthorizationRequestRepository<OAuth2AuthorizationRequest> authorizationRequestRepository = mock(ServerAuthorizationRequestRepository.class);
    ReactiveClientRegistrationRepository clientRegistrationRepository = mock(ReactiveClientRegistrationRepository.class);
    OAuth2AuthorizationRequest authorizationRequest = TestOAuth2AuthorizationRequests.request().build();
    given(authorizationRequestRepository.removeAuthorizationRequest(any())).willReturn(Mono.just(authorizationRequest));
    SecurityWebFilterChain securityFilterChain = this.http.oauth2Login().clientRegistrationRepository(clientRegistrationRepository).authorizationRequestRepository(authorizationRequestRepository).and().build();
    WebTestClient client = WebTestClientBuilder.bindToWebFilters(securityFilterChain).build();
    client.get().uri("/login/oauth2/code/registration-id").exchange();
    verify(authorizationRequestRepository).removeAuthorizationRequest(any());
}

Example 28 with SecurityWebFilterChain

use of org.springframework.security.web.server.SecurityWebFilterChain in project spring-security by spring-projects.

the class ServerHttpSecurityTests method buildWhenServerWebExchangeFromContextThenFound.

@Test
public void buildWhenServerWebExchangeFromContextThenFound() {
    SecurityWebFilterChain filter = this.http.build();
    // @formatter:off
    WebTestClient client = WebTestClient.bindToController(new SubscriberContextController()).webFilter(new WebFilterChainProxy(filter)).build();
    client.get().uri("/foo/bar").exchange().expectBody(String.class).isEqualTo("/foo/bar");
// @formatter:on
}

Example 29 with SecurityWebFilterChain

use of org.springframework.security.web.server.SecurityWebFilterChain in project spring-security by spring-projects.

the class ServerHttpSecurityTests method x509WhenCustomizedThenAddsX509Filter.

@Test
public void x509WhenCustomizedThenAddsX509Filter() {
    X509PrincipalExtractor mockExtractor = mock(X509PrincipalExtractor.class);
    ReactiveAuthenticationManager mockAuthenticationManager = mock(ReactiveAuthenticationManager.class);
    this.http.x509((x509) -> x509.principalExtractor(mockExtractor).authenticationManager(mockAuthenticationManager));
    SecurityWebFilterChain securityWebFilterChain = this.http.build();
    WebFilter x509WebFilter = securityWebFilterChain.getWebFilters().filter(this::isX509Filter).blockFirst();
    assertThat(x509WebFilter).isNotNull();
}

Example 30 with SecurityWebFilterChain

use of org.springframework.security.web.server.SecurityWebFilterChain in project spring-security by spring-projects.

the class ServerHttpSecurityTests method csrfServerLogoutHandlerAppliedIfCsrfIsEnabled.

@Test
public void csrfServerLogoutHandlerAppliedIfCsrfIsEnabled() {
    SecurityWebFilterChain securityWebFilterChain = this.http.csrf().csrfTokenRepository(this.csrfTokenRepository).and().build();
    assertThat(getWebFilter(securityWebFilterChain, CsrfWebFilter.class)).get().extracting((csrfWebFilter) -> ReflectionTestUtils.getField(csrfWebFilter, "csrfTokenRepository")).isEqualTo(this.csrfTokenRepository);
    Optional<ServerLogoutHandler> logoutHandler = getWebFilter(securityWebFilterChain, LogoutWebFilter.class).map((logoutWebFilter) -> (ServerLogoutHandler) ReflectionTestUtils.getField(logoutWebFilter, LogoutWebFilter.class, "logoutHandler"));
    assertThat(logoutHandler).get().isExactlyInstanceOf(DelegatingServerLogoutHandler.class).extracting((delegatingLogoutHandler) -> ((List<ServerLogoutHandler>) ReflectionTestUtils.getField(delegatingLogoutHandler, DelegatingServerLogoutHandler.class, "delegates")).stream().map(ServerLogoutHandler::getClass).collect(Collectors.toList())).isEqualTo(Arrays.asList(SecurityContextServerLogoutHandler.class, CsrfServerLogoutHandler.class));
}