Examples with AuthenticationState org.zaproxy.zap.users.AuthenticationState used on opensource projects

Example 21 with AuthenticationState

use of org.zaproxy.zap.users.AuthenticationState in project zaproxy by zaproxy.

the class AuthenticationMethod method pollAsUser.

public HttpMessage pollAsUser(User user) throws IOException {
    if (!this.authCheckingStrategy.equals(AuthCheckingStrategy.POLL_URL)) {
        throw new IllegalArgumentException("Authentication checking strategy is not POLL_URL");
    }
    HttpMessage pollMsg = new HttpMessage(new URI(this.getPollUrl(), true));
    if (this.getPollData() != null && this.getPollData().length() > 0) {
        pollMsg.getRequestHeader().setMethod(HttpRequestHeader.POST);
        pollMsg.getRequestBody().setBody(this.getPollData());
        pollMsg.getRequestHeader().setContentLength(pollMsg.getRequestBody().length());
    }
    if (this.getPollHeaders() != null && this.getPollHeaders().length() > 0) {
        for (String header : this.getPollHeaders().split("\n")) {
            String[] headerValue = header.split(":");
            if (headerValue.length == 2) {
                pollMsg.getRequestHeader().addHeader(headerValue[0].trim(), headerValue[1].trim());
            } else {
                LOGGER.error("Invalid header '" + header + "' for poll request to " + this.getPollUrl());
            }
        }
    }
    pollMsg.setRequestingUser(user);
    replaceUserDataInPollRequest(pollMsg, user);
    getHttpSender().sendAndReceive(pollMsg);
    AuthenticationHelper.addAuthMessageToHistory(pollMsg);
    AuthenticationState authState = user.getAuthenticationState();
    authState.setLastPollTime(System.currentTimeMillis());
    authState.setRequestsSincePoll(0);
    return pollMsg;
}

Example 22 with AuthenticationState

use of org.zaproxy.zap.users.AuthenticationState in project zaproxy by zaproxy.

the class JsonBasedAuthenticationMethodTypeUnitTest method shouldNotReplacePasswordInPollRequest.

@Test
void shouldNotReplacePasswordInPollRequest() throws NullPointerException, IOException {
    // Given
    String test = "/shouldNotReplacePasswordInPollRequest/test";
    String pollUrl = "/shouldNotReplacePasswordInPollRequest/pollUrl";
    String pollData = "pwd=" + PostBasedAuthenticationMethod.MSG_PASS_PATTERN;
    String password = "password123!";
    final List<String> orderedReqData = new ArrayList<>();
    this.nano.addHandler(new NanoServerHandler(pollUrl) {

        @Override
        protected Response serve(IHTTPSession session) {
            HashMap<String, String> map = new HashMap<>();
            try {
                session.parseBody(map);
                orderedReqData.add(map.get("postData"));
            } catch (Exception e) {
            }
            return newFixedLengthResponse(LOGGED_IN_BODY);
        }
    });
    HttpMessage testMsg = this.getHttpMessage(test);
    HttpMessage pollMsg = this.getHttpMessage(pollUrl);
    method.setPollUrl(pollMsg.getRequestHeader().getURI().toString());
    method.setPollData(pollData);
    User user = mock(User.class);
    given(user.getAuthenticationState()).willReturn(new AuthenticationState());
    given(user.getAuthenticationCredentials()).willReturn(new UsernamePasswordAuthenticationCredentials("", password));
    // When/Then
    assertThat(method.isAuthenticated(testMsg, user), is(true));
    assertThat(orderedReqData.size(), is(1));
    assertThat(orderedReqData.get(0), is(pollData));
}

Example 23 with AuthenticationState

use of org.zaproxy.zap.users.AuthenticationState in project zaproxy by zaproxy.

the class FormBasedAuthenticationMethodTypeUnitTest method shouldNotReplacePasswordInPollRequest.

@Test
void shouldNotReplacePasswordInPollRequest() throws NullPointerException, IOException {
    // Given
    String test = "/shouldNotReplacePasswordInPollRequest/test";
    String pollUrl = "/shouldNotReplacePasswordInPollRequest/pollUrl";
    String pollData = "pwd=" + PostBasedAuthenticationMethod.MSG_PASS_PATTERN;
    String password = "password123!";
    final List<String> orderedReqData = new ArrayList<>();
    this.nano.addHandler(new NanoServerHandler(pollUrl) {

        @Override
        protected Response serve(IHTTPSession session) {
            HashMap<String, String> map = new HashMap<>();
            try {
                session.parseBody(map);
                orderedReqData.add(map.get("postData"));
            } catch (Exception e) {
            }
            return newFixedLengthResponse(LOGGED_IN_BODY);
        }
    });
    HttpMessage testMsg = this.getHttpMessage(test);
    HttpMessage pollMsg = this.getHttpMessage(pollUrl);
    method.setPollUrl(pollMsg.getRequestHeader().getURI().toString());
    method.setPollData(pollData);
    User user = mock(User.class);
    given(user.getAuthenticationState()).willReturn(new AuthenticationState());
    given(user.getAuthenticationCredentials()).willReturn(new UsernamePasswordAuthenticationCredentials("", password));
    // When/Then
    assertThat(method.isAuthenticated(testMsg, user), is(true));
    assertThat(orderedReqData.size(), is(1));
    assertThat(orderedReqData.get(0), is(pollData));
}

Example 24 with AuthenticationState

use of org.zaproxy.zap.users.AuthenticationState in project zaproxy by zaproxy.

the class FormBasedAuthenticationMethodTypeUnitTest method shouldReplaceUsernameInPollRequest.

@Test
void shouldReplaceUsernameInPollRequest() throws NullPointerException, IOException {
    // Given
    String test = "/shouldReplaceUsernameInPollRequest/test";
    String encodedPattern = URLEncoder.encode(PostBasedAuthenticationMethod.MSG_USER_PATTERN, StandardCharsets.UTF_8.name());
    String pollUrl = "/shouldReplaceUsernameInPollRequest/pollUrl";
    String pollData = "user=" + PostBasedAuthenticationMethod.MSG_USER_PATTERN;
    String username = "user";
    final List<String> orderedReqUrls = new ArrayList<>();
    final List<String> orderedReqData = new ArrayList<>();
    this.nano.addHandler(new NanoServerHandler(pollUrl.replace(encodedPattern, username)) {

        @Override
        protected Response serve(IHTTPSession session) {
            orderedReqUrls.add(session.getUri() + "?" + session.getQueryParameterString());
            HashMap<String, String> map = new HashMap<>();
            try {
                session.parseBody(map);
                orderedReqData.add(map.get("postData"));
            } catch (Exception e) {
            }
            return newFixedLengthResponse(LOGGED_IN_BODY);
        }
    });
    HttpMessage testMsg = this.getHttpMessage(test);
    HttpMessage pollMsg = this.getHttpMessage(pollUrl + "?" + encodedPattern);
    method.setPollUrl(pollMsg.getRequestHeader().getURI().toString());
    method.setPollData(pollData);
    User user = mock(User.class);
    given(user.getAuthenticationState()).willReturn(new AuthenticationState());
    given(user.getAuthenticationCredentials()).willReturn(new UsernamePasswordAuthenticationCredentials(username, ""));
    // When/Then
    assertThat(method.isAuthenticated(testMsg, user), is(true));
    assertThat(orderedReqUrls.size(), is(1));
    assertThat(orderedReqUrls.get(0), is(pollUrl + "?" + username));
    assertThat(orderedReqData.size(), is(1));
    assertThat(orderedReqData.get(0), is(pollData.replace(PostBasedAuthenticationMethod.MSG_USER_PATTERN, username)));
}

Example 25 with AuthenticationState

use of org.zaproxy.zap.users.AuthenticationState in project zaproxy by zaproxy.

the class AuthenticationMethodPollUrlUnitTest method shouldPollOnSpecifiedNumberOfRequests.

@Test
void shouldPollOnSpecifiedNumberOfRequests() throws NullPointerException, IOException {
    // Given
    String test = "/shouldPollOnFirstRequest/test";
    String pollUrl = "/shouldPollOnFirstRequest/pollUrl";
    final List<String> orderedReqs = new ArrayList<>();
    this.nano.addHandler(new NanoServerHandler(pollUrl) {

        @Override
        protected Response serve(IHTTPSession session) {
            orderedReqs.add(session.getUri());
            return newFixedLengthResponse(LOGGED_IN_BODY);
        }
    });
    HttpMessage testMsg = this.getHttpMessage(test);
    HttpMessage pollMsg = this.getHttpMessage(pollUrl);
    method.setAuthCheckingStrategy(AuthCheckingStrategy.POLL_URL);
    method.setPollUrl(pollMsg.getRequestHeader().getURI().toString());
    method.setPollFrequencyUnits(AuthPollFrequencyUnits.REQUESTS);
    method.setPollFrequency(5);
    method.setLoggedInIndicatorPattern(LOGGED_IN_INDICATOR);
    User user = mock(User.class);
    given(user.getAuthenticationState()).willReturn(new AuthenticationState());
    // When/Then
    assertThat(method.isAuthenticated(testMsg, user), is(true));
    assertThat(orderedReqs.size(), is(1));
    assertThat(method.isAuthenticated(testMsg, user), is(true));
    assertThat(method.isAuthenticated(testMsg, user), is(true));
    assertThat(method.isAuthenticated(testMsg, user), is(true));
    assertThat(method.isAuthenticated(testMsg, user), is(true));
    assertThat(method.isAuthenticated(testMsg, user), is(true));
    assertThat(orderedReqs.size(), is(1));
    assertThat(method.isAuthenticated(testMsg, user), is(true));
    assertThat(orderedReqs.size(), is(2));
    assertThat(orderedReqs.get(0), is(pollUrl));
    assertThat(orderedReqs.get(1), is(pollUrl));
}