Examples with ConcurrentSessionFilter org.springframework.security.web.session.ConcurrentSessionFilter used on opensource projects

Example 11 with ConcurrentSessionFilter

use of org.springframework.security.web.session.ConcurrentSessionFilter in project spring-security by spring-projects.

the class ConcurrentSessionFilterTests method detectsExpiredSessions.

@Test
public void detectsExpiredSessions() throws Exception {
    // Setup our HTTP request
    MockHttpServletRequest request = new MockHttpServletRequest();
    MockHttpSession session = new MockHttpSession();
    request.setSession(session);
    MockHttpServletResponse response = new MockHttpServletResponse();
    SessionRegistry registry = new SessionRegistryImpl();
    registry.registerNewSession(session.getId(), "principal");
    registry.getSessionInformation(session.getId()).expireNow();
    // Setup our test fixture and registry to want this session to be expired
    SimpleRedirectSessionInformationExpiredStrategy expiredSessionStrategy = new SimpleRedirectSessionInformationExpiredStrategy("/expired.jsp");
    ConcurrentSessionFilter filter = new ConcurrentSessionFilter(registry, expiredSessionStrategy);
    filter.setLogoutHandlers(new LogoutHandler[] { new SecurityContextLogoutHandler() });
    filter.afterPropertiesSet();
    FilterChain fc = mock(FilterChain.class);
    filter.doFilter(request, response, fc);
    // Expect that the filter chain will not be invoked, as we redirect to expiredUrl
    verifyZeroInteractions(fc);
    assertThat(response.getRedirectedUrl()).isEqualTo("/expired.jsp");
}

Example 12 with ConcurrentSessionFilter

use of org.springframework.security.web.session.ConcurrentSessionFilter in project spring-security by spring-projects.

the class ConcurrentSessionFilterTests method doFilterWhenNoExpiredUrlThenResponseWritten.

@Test
public void doFilterWhenNoExpiredUrlThenResponseWritten() throws Exception {
    MockHttpServletRequest request = new MockHttpServletRequest();
    MockHttpSession session = new MockHttpSession();
    request.setSession(session);
    MockHttpServletResponse response = new MockHttpServletResponse();
    SessionRegistry registry = mock(SessionRegistry.class);
    SessionInformation information = new SessionInformation("user", "sessionId", new Date(System.currentTimeMillis() - 1000));
    information.expireNow();
    when(registry.getSessionInformation(anyString())).thenReturn(information);
    ConcurrentSessionFilter filter = new ConcurrentSessionFilter(registry);
    filter.doFilter(request, response, new MockFilterChain());
    assertThat(response.getContentAsString()).contains("This session has been expired (possibly due to multiple concurrent logins being attempted as the same user).");
}

Example 13 with ConcurrentSessionFilter

use of org.springframework.security.web.session.ConcurrentSessionFilter in project spring-security by spring-projects.

the class ConcurrentSessionFilterTests method setLogoutHandlersWhenNullThenThrowsException.

@Test(expected = IllegalArgumentException.class)
public void setLogoutHandlersWhenNullThenThrowsException() {
    ConcurrentSessionFilter filter = new ConcurrentSessionFilter(new SessionRegistryImpl());
    filter.setLogoutHandlers(null);
}