Examples with AuthenticationState org.zaproxy.zap.users.AuthenticationState used on opensource projects

Example 26 with AuthenticationState

use of org.zaproxy.zap.users.AuthenticationState in project zaproxy by zaproxy.

the class AuthenticationMethodPollUrlUnitTest method shouldPollOnSpecifiedNumberOfRequestsPerUser.

@Test
void shouldPollOnSpecifiedNumberOfRequestsPerUser() throws NullPointerException, IOException {
    // Given
    String test = "/shouldPollOnFirstRequest/test";
    String pollUrl = "/shouldPollOnFirstRequest/pollUrl";
    final List<String> orderedReqs = new ArrayList<>();
    this.nano.addHandler(new NanoServerHandler(pollUrl) {

        @Override
        protected Response serve(IHTTPSession session) {
            orderedReqs.add(session.getUri());
            return newFixedLengthResponse(LOGGED_IN_BODY);
        }
    });
    HttpMessage testMsg = this.getHttpMessage(test);
    HttpMessage pollMsg = this.getHttpMessage(pollUrl);
    method.setAuthCheckingStrategy(AuthCheckingStrategy.POLL_URL);
    method.setPollUrl(pollMsg.getRequestHeader().getURI().toString() + "?");
    method.setPollFrequencyUnits(AuthPollFrequencyUnits.REQUESTS);
    method.setPollFrequency(5);
    method.setLoggedInIndicatorPattern(LOGGED_IN_INDICATOR);
    User user1 = mock(User.class);
    given(user1.getAuthenticationState()).willReturn(new AuthenticationState());
    User user2 = mock(User.class);
    given(user2.getAuthenticationState()).willReturn(new AuthenticationState());
    // When/Then
    assertThat(method.isAuthenticated(testMsg, user1), is(true));
    // First poll for user1
    assertThat(orderedReqs.size(), is(1));
    assertThat(method.isAuthenticated(testMsg, user1), is(true));
    assertThat(method.isAuthenticated(testMsg, user1), is(true));
    assertThat(method.isAuthenticated(testMsg, user2), is(true));
    // First poll for user2
    assertThat(orderedReqs.size(), is(2));
    assertThat(method.isAuthenticated(testMsg, user2), is(true));
    assertThat(method.isAuthenticated(testMsg, user1), is(true));
    assertThat(method.isAuthenticated(testMsg, user1), is(true));
    assertThat(method.isAuthenticated(testMsg, user1), is(true));
    // Should not have changed yet
    assertThat(orderedReqs.size(), is(2));
    assertThat(method.isAuthenticated(testMsg, user1), is(true));
    // Second poll for user1
    assertThat(orderedReqs.size(), is(3));
    assertThat(method.isAuthenticated(testMsg, user1), is(true));
    assertThat(method.isAuthenticated(testMsg, user1), is(true));
    assertThat(method.isAuthenticated(testMsg, user1), is(true));
    assertThat(method.isAuthenticated(testMsg, user2), is(true));
    assertThat(method.isAuthenticated(testMsg, user2), is(true));
    assertThat(method.isAuthenticated(testMsg, user2), is(true));
    assertThat(method.isAuthenticated(testMsg, user2), is(true));
    // Should not have changed yet
    assertThat(orderedReqs.size(), is(3));
    assertThat(method.isAuthenticated(testMsg, user2), is(true));
    // Second poll for user2
    assertThat(orderedReqs.size(), is(4));
}

Example 27 with AuthenticationState

use of org.zaproxy.zap.users.AuthenticationState in project zaproxy by zaproxy.

the class AuthenticationMethodIndicatorsUnitTest method shouldIdentifyLoggedInRequestBodyWhenLoggedInIndicatorIsSet.

@Test
void shouldIdentifyLoggedInRequestBodyWhenLoggedInIndicatorIsSet() {
    // Given
    method.setLoggedInIndicatorPattern(LOGGED_IN_INDICATOR);
    method.setAuthCheckingStrategy(AuthCheckingStrategy.EACH_REQ);
    loginMessage.setRequestBody(LOGGED_IN_BODY);
    User user = mock(User.class);
    given(user.getAuthenticationState()).willReturn(new AuthenticationState());
    // When/Then
    assertThat(method.isAuthenticated(loginMessage, user), is(true));
}

Example 28 with AuthenticationState

use of org.zaproxy.zap.users.AuthenticationState in project zaproxy by zaproxy.

the class AuthenticationMethodIndicatorsUnitTest method shouldIdentifyResponseAsLoggedInWhenNoIndicatorIsSet.

@Test
void shouldIdentifyResponseAsLoggedInWhenNoIndicatorIsSet() {
    // Given
    loginMessage.setResponseBody(LOGGED_OUT_BODY);
    User user = mock(User.class);
    given(user.getAuthenticationState()).willReturn(new AuthenticationState());
    // When/Then
    assertThat(method.isAuthenticated(loginMessage, user), is(true));
}

Example 29 with AuthenticationState

use of org.zaproxy.zap.users.AuthenticationState in project zaproxy by zaproxy.

the class AuthenticationMethodIndicatorsUnitTest method shouldIdentifyLoggedInRequestWithComplexRegex.

@Test
void shouldIdentifyLoggedInRequestWithComplexRegex() {
    // Given
    method.setLoggedOutIndicatorPattern(LOGGED_OUT_COMPLEX_INDICATOR);
    method.setAuthCheckingStrategy(AuthCheckingStrategy.EACH_REQ);
    loginMessage.setRequestBody(LOGGED_OUT_BODY);
    User user = mock(User.class);
    given(user.getAuthenticationState()).willReturn(new AuthenticationState());
    // When/Then
    assertThat(method.isAuthenticated(loginMessage, user), is(true));
}

Example 30 with AuthenticationState

use of org.zaproxy.zap.users.AuthenticationState in project zaproxy by zaproxy.

the class AuthenticationMethodIndicatorsUnitTest method shouldIdentifyLoggedInRequestBodyWhenLoggedOutIndicatorIsSet.

@Test
void shouldIdentifyLoggedInRequestBodyWhenLoggedOutIndicatorIsSet() {
    // Given
    method.setLoggedOutIndicatorPattern(LOGGED_OUT_INDICATOR);
    method.setAuthCheckingStrategy(AuthCheckingStrategy.EACH_REQ);
    loginMessage.setRequestBody(LOGGED_IN_BODY);
    User user = mock(User.class);
    given(user.getAuthenticationState()).willReturn(new AuthenticationState());
    // When/Then
    assertThat(method.isAuthenticated(loginMessage, user), is(true));
}