Examples with SecurityWebFilterChain org.springframework.security.web.server.SecurityWebFilterChain used on opensource projects

Example 31 with SecurityWebFilterChain

use of org.springframework.security.web.server.SecurityWebFilterChain in project spring-security by spring-projects.

the class ServerHttpSecurityTests method x509WhenCustomizedThenAddsX509Filter.

@Test
public void x509WhenCustomizedThenAddsX509Filter() {
    X509PrincipalExtractor mockExtractor = mock(X509PrincipalExtractor.class);
    ReactiveAuthenticationManager mockAuthenticationManager = mock(ReactiveAuthenticationManager.class);
    this.http.x509((x509) -> x509.principalExtractor(mockExtractor).authenticationManager(mockAuthenticationManager));
    SecurityWebFilterChain securityWebFilterChain = this.http.build();
    WebFilter x509WebFilter = securityWebFilterChain.getWebFilters().filter(this::isX509Filter).blockFirst();
    assertThat(x509WebFilter).isNotNull();
}

Example 32 with SecurityWebFilterChain

use of org.springframework.security.web.server.SecurityWebFilterChain in project spring-security by spring-projects.

the class ServerHttpSecurityTests method csrfServerLogoutHandlerAppliedIfCsrfIsEnabled.

@Test
public void csrfServerLogoutHandlerAppliedIfCsrfIsEnabled() {
    SecurityWebFilterChain securityWebFilterChain = this.http.csrf().csrfTokenRepository(this.csrfTokenRepository).and().build();
    assertThat(getWebFilter(securityWebFilterChain, CsrfWebFilter.class)).get().extracting((csrfWebFilter) -> ReflectionTestUtils.getField(csrfWebFilter, "csrfTokenRepository")).isEqualTo(this.csrfTokenRepository);
    Optional<ServerLogoutHandler> logoutHandler = getWebFilter(securityWebFilterChain, LogoutWebFilter.class).map((logoutWebFilter) -> (ServerLogoutHandler) ReflectionTestUtils.getField(logoutWebFilter, LogoutWebFilter.class, "logoutHandler"));
    assertThat(logoutHandler).get().isExactlyInstanceOf(DelegatingServerLogoutHandler.class).extracting((delegatingLogoutHandler) -> ((List<ServerLogoutHandler>) ReflectionTestUtils.getField(delegatingLogoutHandler, DelegatingServerLogoutHandler.class, "delegates")).stream().map(ServerLogoutHandler::getClass).collect(Collectors.toList())).isEqualTo(Arrays.asList(SecurityContextServerLogoutHandler.class, CsrfServerLogoutHandler.class));
}

Example 33 with SecurityWebFilterChain

use of org.springframework.security.web.server.SecurityWebFilterChain in project spring-security by spring-projects.

the class ServerHttpSecurityTests method requestWhenBasicWithAuthenticationManagerInLambdaThenAuthenticationManagerUsed.

@Test
public void requestWhenBasicWithAuthenticationManagerInLambdaThenAuthenticationManagerUsed() {
    ReactiveAuthenticationManager customAuthenticationManager = mock(ReactiveAuthenticationManager.class);
    given(customAuthenticationManager.authenticate(any())).willReturn(Mono.just(new TestingAuthenticationToken("rob", "rob", "ROLE_USER", "ROLE_ADMIN")));
    // @formatter:off
    SecurityWebFilterChain securityFilterChain = this.http.httpBasic((httpBasic) -> httpBasic.authenticationManager(customAuthenticationManager)).build();
    // @formatter:on
    WebFilterChainProxy springSecurityFilterChain = new WebFilterChainProxy(securityFilterChain);
    // @formatter:off
    WebTestClient client = WebTestClientBuilder.bindToWebFilters(springSecurityFilterChain).build();
    client.get().uri("/").headers((headers) -> headers.setBasicAuth("rob", "rob")).exchange().expectStatus().isOk().expectBody(String.class).consumeWith((b) -> assertThat(b.getResponseBody()).isEqualTo("ok"));
    // @formatter:on
    verifyZeroInteractions(this.authenticationManager);
    verify(customAuthenticationManager).authenticate(any(Authentication.class));
}

Example 34 with SecurityWebFilterChain

use of org.springframework.security.web.server.SecurityWebFilterChain in project spring-security by spring-projects.

the class FormLoginTests method formLoginSecurityContextRepository.

@Test
public void formLoginSecurityContextRepository() {
    ServerSecurityContextRepository defaultSecContextRepository = mock(ServerSecurityContextRepository.class);
    ServerSecurityContextRepository formLoginSecContextRepository = mock(ServerSecurityContextRepository.class);
    TestingAuthenticationToken token = new TestingAuthenticationToken("rob", "rob", "ROLE_USER");
    given(defaultSecContextRepository.save(any(), any())).willReturn(Mono.empty());
    given(defaultSecContextRepository.load(any())).willReturn(authentication(token));
    given(formLoginSecContextRepository.save(any(), any())).willReturn(Mono.empty());
    given(formLoginSecContextRepository.load(any())).willReturn(authentication(token));
    // @formatter:off
    SecurityWebFilterChain securityWebFilter = this.http.authorizeExchange().anyExchange().authenticated().and().securityContextRepository(defaultSecContextRepository).formLogin().securityContextRepository(formLoginSecContextRepository).and().build();
    WebTestClient webTestClient = WebTestClientBuilder.bindToWebFilters(securityWebFilter).build();
    WebDriver driver = WebTestClientHtmlUnitDriverBuilder.webTestClientSetup(webTestClient).build();
    // @formatter:on
    DefaultLoginPage loginPage = DefaultLoginPage.to(driver).assertAt();
    // @formatter:off
    HomePage homePage = loginPage.loginForm().username("user").password("password").submit(HomePage.class);
    // @formatter:on
    homePage.assertAt();
    verify(defaultSecContextRepository, atLeastOnce()).load(any());
    verify(formLoginSecContextRepository).save(any(), any());
}

Example 35 with SecurityWebFilterChain

use of org.springframework.security.web.server.SecurityWebFilterChain in project spring-security by spring-projects.

the class FormLoginTests method formLoginWhenCustomAuthenticationFailureHandlerThenUsed.

@Test
public void formLoginWhenCustomAuthenticationFailureHandlerThenUsed() {
    // @formatter:off
    SecurityWebFilterChain securityWebFilter = this.http.authorizeExchange().pathMatchers("/login", "/failure").permitAll().anyExchange().authenticated().and().formLogin().authenticationFailureHandler(new RedirectServerAuthenticationFailureHandler("/failure")).and().build();
    WebTestClient webTestClient = WebTestClientBuilder.bindToWebFilters(securityWebFilter).build();
    WebDriver driver = WebTestClientHtmlUnitDriverBuilder.webTestClientSetup(webTestClient).build();
    // @formatter:on
    DefaultLoginPage loginPage = HomePage.to(driver, DefaultLoginPage.class).assertAt();
    // @formatter:off
    loginPage.loginForm().username("invalid").password("invalid").submit(HomePage.class);
    // @formatter:on
    assertThat(driver.getCurrentUrl()).endsWith("/failure");
}