Examples with ServerWebExchangeMatcher org.springframework.security.web.server.util.matcher.ServerWebExchangeMatcher used on opensource projects

Example 6 with ServerWebExchangeMatcher

use of org.springframework.security.web.server.util.matcher.ServerWebExchangeMatcher in project spring-security by spring-projects.

the class SwitchUserWebFilterTests method setExitUserMatcherWhenDefinedThenChangeDefaultValue.

@Test
public void setExitUserMatcherWhenDefinedThenChangeDefaultValue() {
    final MockServerWebExchange exchange = MockServerWebExchange.from(MockServerHttpRequest.post("/logout/impersonate"));
    final ServerWebExchangeMatcher oldExitUserMatcher = (ServerWebExchangeMatcher) ReflectionTestUtils.getField(this.switchUserWebFilter, "exitUserMatcher");
    assertThat(oldExitUserMatcher.matches(exchange).block().isMatch()).isTrue();
    final ServerWebExchangeMatcher newExitUserMatcher = ServerWebExchangeMatchers.pathMatchers(HttpMethod.POST, "/exit-url");
    this.switchUserWebFilter.setExitUserMatcher(newExitUserMatcher);
    final ServerWebExchangeMatcher currentExitUserMatcher = (ServerWebExchangeMatcher) ReflectionTestUtils.getField(this.switchUserWebFilter, "exitUserMatcher");
    assertThat(currentExitUserMatcher).isSameAs(newExitUserMatcher);
}

Example 7 with ServerWebExchangeMatcher

use of org.springframework.security.web.server.util.matcher.ServerWebExchangeMatcher in project spring-security by spring-projects.

the class ServerWebExchangeDelegatingServerAccessDeniedHandlerTests method handleWhenNothingMatchesThenOnlyDefaultHandlerInvoked.

@Test
public void handleWhenNothingMatchesThenOnlyDefaultHandlerInvoked() {
    ServerAccessDeniedHandler handler = mock(ServerAccessDeniedHandler.class);
    ServerWebExchangeMatcher matcher = mock(ServerWebExchangeMatcher.class);
    given(matcher.matches(this.exchange)).willReturn(MatchResult.notMatch());
    given(handler.handle(this.exchange, null)).willReturn(Mono.empty());
    given(this.accessDeniedHandler.handle(this.exchange, null)).willReturn(Mono.empty());
    this.entries.add(new DelegateEntry(matcher, handler));
    this.delegator = new ServerWebExchangeDelegatingServerAccessDeniedHandler(this.entries);
    this.delegator.setDefaultAccessDeniedHandler(this.accessDeniedHandler);
    this.delegator.handle(this.exchange, null).block();
    verify(this.accessDeniedHandler).handle(this.exchange, null);
    verify(handler, never()).handle(this.exchange, null);
}

Example 8 with ServerWebExchangeMatcher

use of org.springframework.security.web.server.util.matcher.ServerWebExchangeMatcher in project spring-security by spring-projects.

the class CsrfWebFilterTests method matchesRequireCsrfProtectionWhenNonStandardHTTPMethodIsUsed.

@Test
public // gh-8452
void matchesRequireCsrfProtectionWhenNonStandardHTTPMethodIsUsed() {
    MockServerWebExchange nonStandardHttpExchange = MockServerWebExchange.from(MockServerHttpRequest.method("non-standard-http-method", "/"));
    ServerWebExchangeMatcher serverWebExchangeMatcher = CsrfWebFilter.DEFAULT_CSRF_MATCHER;
    assertThat(serverWebExchangeMatcher.matches(nonStandardHttpExchange).map(MatchResult::isMatch).block()).isTrue();
}

Example 9 with ServerWebExchangeMatcher

use of org.springframework.security.web.server.util.matcher.ServerWebExchangeMatcher in project spring-security by spring-projects.

the class CsrfWebFilterTests method doFilterWhenSkipExchangeInvokedThenSkips.

@Test
public void doFilterWhenSkipExchangeInvokedThenSkips() {
    PublisherProbe<Void> chainResult = PublisherProbe.empty();
    given(this.chain.filter(any())).willReturn(chainResult.mono());
    ServerWebExchangeMatcher matcher = mock(ServerWebExchangeMatcher.class);
    this.csrfFilter.setRequireCsrfProtectionMatcher(matcher);
    MockServerWebExchange exchange = MockServerWebExchange.from(MockServerHttpRequest.post("/post").build());
    CsrfWebFilter.skipExchange(exchange);
    this.csrfFilter.filter(exchange, this.chain).block();
    verifyZeroInteractions(matcher);
}

Example 10 with ServerWebExchangeMatcher

use of org.springframework.security.web.server.util.matcher.ServerWebExchangeMatcher in project spring-security by spring-projects.

the class HttpsRedirectWebFilterTests method filterWhenExchangeMatchesAndRequestIsInsecureThenRedirects.

@Test
public void filterWhenExchangeMatchesAndRequestIsInsecureThenRedirects() {
    given(this.chain.filter(any(ServerWebExchange.class))).willReturn(Mono.empty());
    ServerWebExchangeMatcher matcher = mock(ServerWebExchangeMatcher.class);
    given(matcher.matches(any(ServerWebExchange.class))).willReturn(ServerWebExchangeMatcher.MatchResult.match());
    this.filter.setRequiresHttpsRedirectMatcher(matcher);
    ServerWebExchange exchange = get("http://localhost:8080");
    this.filter.filter(exchange, this.chain).block();
    assertThat(statusCode(exchange)).isEqualTo(302);
    assertThat(redirectedUrl(exchange)).isEqualTo("https://localhost:8443");
    verify(matcher).matches(any(ServerWebExchange.class));
}