Use HTTPS for external links wherever possible

See gh-16320
This commit is contained in:
Spring Operator
2019-03-26 04:16:22 -05:00
committed by Andy Wilkinson
parent 864942ad4f
commit 9fc3ac7d49
12 changed files with 48 additions and 48 deletions

View File

@@ -271,23 +271,23 @@ public class OAuth2ClientPropertiesRegistrationAdapterTests {
assertThat(adapted.getClientName()).isEqualTo(issuer);
assertThat(adapted.getScopes()).containsOnly("user");
assertThat(adapted.getRedirectUriTemplate())
.isEqualTo("http://example.com/redirect");
.isEqualTo("https://example.com/redirect");
assertThat(providerDetails.getAuthorizationUri())
.isEqualTo("http://example.com/auth");
assertThat(providerDetails.getTokenUri()).isEqualTo("http://example.com/token");
assertThat(providerDetails.getJwkSetUri()).isEqualTo("http://example.com/jwk");
.isEqualTo("https://example.com/auth");
assertThat(providerDetails.getTokenUri()).isEqualTo("https://example.com/token");
assertThat(providerDetails.getJwkSetUri()).isEqualTo("https://example.com/jwk");
UserInfoEndpoint userInfoEndpoint = providerDetails.getUserInfoEndpoint();
assertThat(userInfoEndpoint.getUri()).isEqualTo("http://example.com/info");
assertThat(userInfoEndpoint.getUri()).isEqualTo("https://example.com/info");
assertThat(userInfoEndpoint.getUserNameAttributeName()).isEqualTo("sub");
}
private Provider createProvider() {
Provider provider = new Provider();
provider.setAuthorizationUri("http://example.com/auth");
provider.setTokenUri("http://example.com/token");
provider.setUserInfoUri("http://example.com/info");
provider.setAuthorizationUri("https://example.com/auth");
provider.setTokenUri("https://example.com/token");
provider.setUserInfoUri("https://example.com/info");
provider.setUserNameAttribute("sub");
provider.setJwkSetUri("http://example.com/jwk");
provider.setJwkSetUri("https://example.com/jwk");
return provider;
}
@@ -297,7 +297,7 @@ public class OAuth2ClientPropertiesRegistrationAdapterTests {
registration.setClientId("clientId");
registration.setClientSecret("clientSecret");
registration.setClientAuthenticationMethod("post");
registration.setRedirectUri("http://example.com/redirect");
registration.setRedirectUri("https://example.com/redirect");
registration.setScope(Collections.singleton("user"));
registration.setAuthorizationGrantType("authorization_code");
return registration;

View File

@@ -168,7 +168,7 @@ public class ReactiveOAuth2ClientAutoConfigurationTests {
@Bean
public ReactiveClientRegistrationRepository clientRegistrationRepository() {
List<ClientRegistration> registrations = new ArrayList<>();
registrations.add(getClientRegistration("first", "http://user-info-uri.com"));
registrations.add(getClientRegistration("first", "https://user-info-uri.com"));
registrations.add(getClientRegistration("second", "http://other-user-info"));
return new InMemoryReactiveClientRegistrationRepository(registrations);
}
@@ -180,9 +180,9 @@ public class ReactiveOAuth2ClientAutoConfigurationTests {
org.springframework.security.oauth2.core.ClientAuthenticationMethod.BASIC)
.authorizationGrantType(AuthorizationGrantType.AUTHORIZATION_CODE)
.scope("read").clientSecret("secret")
.redirectUriTemplate("http://redirect-uri.com")
.authorizationUri("http://authorization-uri.com")
.tokenUri("http://token-uri.com").userInfoUri(userInfoUri)
.redirectUriTemplate("https://redirect-uri.com")
.authorizationUri("https://authorization-uri.com")
.tokenUri("https://token-uri.com").userInfoUri(userInfoUri)
.userNameAttributeName("login");
return builder.build();
}

View File

@@ -80,7 +80,7 @@ public class ReactiveOAuth2ResourceServerAutoConfigurationTests {
@Test
public void autoConfigurationShouldConfigureResourceServer() {
this.contextRunner.withPropertyValues(
"spring.security.oauth2.resourceserver.jwt.jwk-set-uri=http://jwk-set-uri.com")
"spring.security.oauth2.resourceserver.jwt.jwk-set-uri=https://jwk-set-uri.com")
.run((context) -> {
assertThat(context.getBean(ReactiveJwtDecoder.class))
.isInstanceOf(NimbusReactiveJwtDecoder.class);
@@ -110,8 +110,8 @@ public class ReactiveOAuth2ResourceServerAutoConfigurationTests {
@Test
public void autoConfigurationWhenBothSetUriAndIssuerUriPresentShouldUseSetUri() {
this.contextRunner.withPropertyValues(
"spring.security.oauth2.resourceserver.jwt.jwk-set-uri=http://jwk-set-uri.com",
"spring.security.oauth2.resourceserver.jwt.issuer-uri=http://jwk-oidc-issuer-location.com")
"spring.security.oauth2.resourceserver.jwt.jwk-set-uri=https://jwk-set-uri.com",
"spring.security.oauth2.resourceserver.jwt.issuer-uri=https://jwk-oidc-issuer-location.com")
.run((context) -> {
assertThat(context.getBean(ReactiveJwtDecoder.class))
.isInstanceOf(NimbusReactiveJwtDecoder.class);
@@ -130,7 +130,7 @@ public class ReactiveOAuth2ResourceServerAutoConfigurationTests {
@Test
public void jwtDecoderBeanIsConditionalOnMissingBean() {
this.contextRunner.withPropertyValues(
"spring.security.oauth2.resourceserver.jwt.jwk-set-uri=http://jwk-set-uri.com")
"spring.security.oauth2.resourceserver.jwt.jwk-set-uri=https://jwk-set-uri.com")
.withUserConfiguration(JwtDecoderConfig.class)
.run((this::assertFilterConfiguredWithJwtAuthenticationManager));
}
@@ -138,7 +138,7 @@ public class ReactiveOAuth2ResourceServerAutoConfigurationTests {
@Test
public void jwtDecoderByIssuerUriBeanIsConditionalOnMissingBean() {
this.contextRunner.withPropertyValues(
"spring.security.oauth2.resourceserver.jwt.issuer-uri=http://jwk-oidc-issuer-location.com")
"spring.security.oauth2.resourceserver.jwt.issuer-uri=https://jwk-oidc-issuer-location.com")
.withUserConfiguration(JwtDecoderConfig.class)
.run((this::assertFilterConfiguredWithJwtAuthenticationManager));
}
@@ -146,7 +146,7 @@ public class ReactiveOAuth2ResourceServerAutoConfigurationTests {
@Test
public void autoConfigurationShouldBeConditionalOnBearerTokenAuthenticationTokenClass() {
this.contextRunner.withPropertyValues(
"spring.security.oauth2.resourceserver.jwt.jwk-set-uri=http://jwk-set-uri.com")
"spring.security.oauth2.resourceserver.jwt.jwk-set-uri=https://jwk-set-uri.com")
.withUserConfiguration(JwtDecoderConfig.class)
.withClassLoader(
new FilteredClassLoader(BearerTokenAuthenticationToken.class))
@@ -157,7 +157,7 @@ public class ReactiveOAuth2ResourceServerAutoConfigurationTests {
@Test
public void autoConfigurationShouldBeConditionalOnReactiveJwtDecoderClass() {
this.contextRunner.withPropertyValues(
"spring.security.oauth2.resourceserver.jwt.jwk-set-uri=http://jwk-set-uri.com")
"spring.security.oauth2.resourceserver.jwt.jwk-set-uri=https://jwk-set-uri.com")
.withUserConfiguration(JwtDecoderConfig.class)
.withClassLoader(new FilteredClassLoader(ReactiveJwtDecoder.class))
.run((context) -> assertThat(context)
@@ -167,7 +167,7 @@ public class ReactiveOAuth2ResourceServerAutoConfigurationTests {
@Test
public void autoConfigurationWhenSecurityWebFilterChainConfigPresentShouldNotAddOne() {
this.contextRunner.withPropertyValues(
"spring.security.oauth2.resourceserver.jwt.jwk-set-uri=http://jwk-set-uri.com")
"spring.security.oauth2.resourceserver.jwt.jwk-set-uri=https://jwk-set-uri.com")
.withUserConfiguration(SecurityWebFilterChainConfig.class)
.run((context) -> {
assertThat(context).hasSingleBean(SecurityWebFilterChain.class);

View File

@@ -75,7 +75,7 @@ public class OAuth2ResourceServerAutoConfigurationTests {
@Test
public void autoConfigurationShouldConfigureResourceServer() {
this.contextRunner.withPropertyValues(
"spring.security.oauth2.resourceserver.jwt.jwk-set-uri=http://jwk-set-uri.com")
"spring.security.oauth2.resourceserver.jwt.jwk-set-uri=https://jwk-set-uri.com")
.run((context) -> {
assertThat(context.getBean(JwtDecoder.class))
.isInstanceOf(NimbusJwtDecoderJwkSupport.class);
@@ -105,8 +105,8 @@ public class OAuth2ResourceServerAutoConfigurationTests {
@Test
public void autoConfigurationWhenBothSetUriAndIssuerUriPresentShouldUseSetUri() {
this.contextRunner.withPropertyValues(
"spring.security.oauth2.resourceserver.jwt.issuer-uri=http://issuer-uri.com",
"spring.security.oauth2.resourceserver.jwt.jwk-set-uri=http://jwk-set-uri.com")
"spring.security.oauth2.resourceserver.jwt.issuer-uri=https://issuer-uri.com",
"spring.security.oauth2.resourceserver.jwt.jwk-set-uri=https://jwk-set-uri.com")
.run((context) -> {
assertThat(context.getBean(JwtDecoder.class))
.isInstanceOf(NimbusJwtDecoderJwkSupport.class);
@@ -126,7 +126,7 @@ public class OAuth2ResourceServerAutoConfigurationTests {
@Test
public void jwtDecoderByJwkSetUriIsConditionalOnMissingBean() {
this.contextRunner.withPropertyValues(
"spring.security.oauth2.resourceserver.jwt.jwk-set-uri=http://jwk-set-uri.com")
"spring.security.oauth2.resourceserver.jwt.jwk-set-uri=https://jwk-set-uri.com")
.withUserConfiguration(JwtDecoderConfig.class)
.run((context) -> assertThat(getBearerTokenFilter(context)).isNotNull());
}
@@ -134,7 +134,7 @@ public class OAuth2ResourceServerAutoConfigurationTests {
@Test
public void jwtDecoderByOidcIssuerUriIsConditionalOnMissingBean() {
this.contextRunner.withPropertyValues(
"spring.security.oauth2.resourceserver.jwt.issuer-uri=http://jwk-oidc-issuer-location.com")
"spring.security.oauth2.resourceserver.jwt.issuer-uri=https://jwk-oidc-issuer-location.com")
.withUserConfiguration(JwtDecoderConfig.class)
.run((context) -> assertThat(getBearerTokenFilter(context)).isNotNull());
}
@@ -142,7 +142,7 @@ public class OAuth2ResourceServerAutoConfigurationTests {
@Test
public void autoConfigurationShouldBeConditionalOnJwtAuthenticationTokenClass() {
this.contextRunner.withPropertyValues(
"spring.security.oauth2.resourceserver.jwt.jwk-set-uri=http://jwk-set-uri.com")
"spring.security.oauth2.resourceserver.jwt.jwk-set-uri=https://jwk-set-uri.com")
.withUserConfiguration(JwtDecoderConfig.class)
.withClassLoader(new FilteredClassLoader(JwtAuthenticationToken.class))
.run((context) -> assertThat(getBearerTokenFilter(context)).isNull());
@@ -151,7 +151,7 @@ public class OAuth2ResourceServerAutoConfigurationTests {
@Test
public void autoConfigurationShouldBeConditionalOnJwtDecoderClass() {
this.contextRunner.withPropertyValues(
"spring.security.oauth2.resourceserver.jwt.jwk-set-uri=http://jwk-set-uri.com")
"spring.security.oauth2.resourceserver.jwt.jwk-set-uri=https://jwk-set-uri.com")
.withUserConfiguration(JwtDecoderConfig.class)
.withClassLoader(new FilteredClassLoader(JwtDecoder.class))
.run((context) -> assertThat(getBearerTokenFilter(context)).isNull());