Examples with RequestMatcher org.springframework.security.web.util.matcher.RequestMatcher used on opensource projects

Example 81 with RequestMatcher

use of org.springframework.security.web.util.matcher.RequestMatcher in project spring-security by spring-projects.

the class DefaultFilterInvocationSecurityMetadataSourceTests method createFids.

private void createFids(String pattern, String method) {
    LinkedHashMap<RequestMatcher, Collection<ConfigAttribute>> requestMap = new LinkedHashMap<>();
    requestMap.put(new AntPathRequestMatcher(pattern, method), this.def);
    this.fids = new DefaultFilterInvocationSecurityMetadataSource(requestMap);
}

Example 82 with RequestMatcher

use of org.springframework.security.web.util.matcher.RequestMatcher in project spring-security by spring-projects.

the class RequestMatcherDelegatingAccessDeniedHandlerTests method handleWhenFirstMatchesThenOnlyFirstInvoked.

@Test
public void handleWhenFirstMatchesThenOnlyFirstInvoked() throws Exception {
    AccessDeniedHandler firstHandler = mock(AccessDeniedHandler.class);
    RequestMatcher firstMatcher = mock(RequestMatcher.class);
    AccessDeniedHandler secondHandler = mock(AccessDeniedHandler.class);
    RequestMatcher secondMatcher = mock(RequestMatcher.class);
    given(firstMatcher.matches(this.request)).willReturn(true);
    this.deniedHandlers.put(firstMatcher, firstHandler);
    this.deniedHandlers.put(secondMatcher, secondHandler);
    this.delegator = new RequestMatcherDelegatingAccessDeniedHandler(this.deniedHandlers, this.accessDeniedHandler);
    this.delegator.handle(this.request, null, null);
    verify(firstHandler).handle(this.request, null, null);
    verify(secondHandler, never()).handle(this.request, null, null);
    verify(this.accessDeniedHandler, never()).handle(this.request, null, null);
    verify(secondMatcher, never()).matches(this.request);
}

Example 83 with RequestMatcher

use of org.springframework.security.web.util.matcher.RequestMatcher in project spring-security by spring-projects.

the class RequestMatcherDelegatingAccessDeniedHandlerTests method handleWhenNothingMatchesThenOnlyDefaultHandlerInvoked.

@Test
public void handleWhenNothingMatchesThenOnlyDefaultHandlerInvoked() throws Exception {
    AccessDeniedHandler handler = mock(AccessDeniedHandler.class);
    RequestMatcher matcher = mock(RequestMatcher.class);
    given(matcher.matches(this.request)).willReturn(false);
    this.deniedHandlers.put(matcher, handler);
    this.delegator = new RequestMatcherDelegatingAccessDeniedHandler(this.deniedHandlers, this.accessDeniedHandler);
    this.delegator.handle(this.request, null, null);
    verify(this.accessDeniedHandler).handle(this.request, null, null);
    verify(handler, never()).handle(this.request, null, null);
}

Example 84 with RequestMatcher

use of org.springframework.security.web.util.matcher.RequestMatcher in project spring-security by spring-projects.

the class RequestMatcherDelegatingAccessDeniedHandlerTests method handleWhenSecondMatchesThenOnlySecondInvoked.

@Test
public void handleWhenSecondMatchesThenOnlySecondInvoked() throws Exception {
    AccessDeniedHandler firstHandler = mock(AccessDeniedHandler.class);
    RequestMatcher firstMatcher = mock(RequestMatcher.class);
    AccessDeniedHandler secondHandler = mock(AccessDeniedHandler.class);
    RequestMatcher secondMatcher = mock(RequestMatcher.class);
    given(firstMatcher.matches(this.request)).willReturn(false);
    given(secondMatcher.matches(this.request)).willReturn(true);
    this.deniedHandlers.put(firstMatcher, firstHandler);
    this.deniedHandlers.put(secondMatcher, secondHandler);
    this.delegator = new RequestMatcherDelegatingAccessDeniedHandler(this.deniedHandlers, this.accessDeniedHandler);
    this.delegator.handle(this.request, null, null);
    verify(secondHandler).handle(this.request, null, null);
    verify(firstHandler, never()).handle(this.request, null, null);
    verify(this.accessDeniedHandler, never()).handle(this.request, null, null);
}

Example 85 with RequestMatcher

use of org.springframework.security.web.util.matcher.RequestMatcher in project OsmAnd-tools by osmandapp.

the class WebSecurityConfiguration method configure.

@Override
protected void configure(HttpSecurity http) throws Exception {
    // http.csrf().disable().antMatcher("/**");
    // 1. CSRF
    Set<String> enabledMethods = new TreeSet<>(Arrays.asList("GET", "HEAD", "TRACE", "OPTIONS", "POST", "DELETE"));
    http.csrf().requireCsrfProtectionMatcher(new RequestMatcher() {

        @Override
        public boolean matches(HttpServletRequest request) {
            String method = request.getMethod();
            if (method != null && !enabledMethods.contains(method)) {
                String url = request.getServletPath();
                if (request.getPathInfo() != null) {
                    url += request.getPathInfo();
                }
                if (url.startsWith("/api/") || url.startsWith("/subscription/")) {
                    return false;
                }
                return true;
            }
            return false;
        }
    }).csrfTokenRepository(CookieCsrfTokenRepository.withHttpOnlyFalse());
    http.cors().configurationSource(corsConfigurationSource());
    http.authorizeRequests().antMatchers("/actuator/**", "/admin/**").hasAuthority(ROLE_ADMIN).antMatchers("/mapapi/auth/**").permitAll().antMatchers("/mapapi/**").hasAuthority(ROLE_PRO_USER).anyRequest().permitAll();
    http.oauth2Login().userInfoEndpoint().userService(oauthGithubUserService());
    // SEE MapApiController.loginForm to test form
    // http.formLogin().loginPage("/mapapi/auth/loginForm").
    // loginProcessingUrl("/mapapi/auth/loginProcess").defaultSuccessUrl("/map/loginSuccess");
    LoginUrlAuthenticationEntryPoint mapLogin = new LoginUrlAuthenticationEntryPoint("/map/loginForm");
    if (getApplicationContext().getEnvironment().acceptsProfiles(Profiles.of("production"))) {
        mapLogin.setForceHttps(true);
    }
    http.exceptionHandling().defaultAuthenticationEntryPointFor(mapLogin, new AntPathRequestMatcher("/mapapi/**"));
    http.rememberMe().tokenValiditySeconds(3600 * 24 * 14);
    http.logout().deleteCookies("JSESSIONID").logoutSuccessUrl("/").logoutRequestMatcher(new AntPathRequestMatcher("/logout")).permitAll();
}