Spring/spring-boot
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Adapt to Spring Security changes

Browse Source 
Closes gh-32604
This commit is contained in:
Madhura Bhave
2022-10-07 15:23:31 -07:00
parent 2e74878ba4
commit ce3c933f77
58 changed files with 497 additions and 361 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
spring-boot-project/spring-boot-devtools/src/main/java/org/springframework/boot/devtools/autoconfigure/RemoteDevtoolsSecurityConfiguration.java
View File

@@ -17,7 +17,6 @@
package org.springframework.boot.devtools.autoconfigure;
import org.springframework.boot.autoconfigure.condition.ConditionalOnClass;
import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean;
import org.springframework.boot.autoconfigure.security.SecurityProperties;
import org.springframework.boot.autoconfigure.web.ServerProperties;
import org.springframework.context.annotation.Bean;
@@ -47,11 +46,10 @@ class RemoteDevtoolsSecurityConfiguration {
@Bean
@Order(SecurityProperties.BASIC_AUTH_ORDER - 1)
@ConditionalOnMissingBean(org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter.class)
@SuppressWarnings("deprecation")
SecurityFilterChain devtoolsSecurityFilterChain(HttpSecurity http) throws Exception {
http.requestMatcher(new AntPathRequestMatcher(this.url)).authorizeHttpRequests().anyRequest().anonymous().and()
.csrf().disable();
http.securityMatcher(new AntPathRequestMatcher(this.url));
http.authorizeHttpRequests().anyRequest().anonymous();
http.csrf().disable();
return http.build();
}

32
spring-boot-project/spring-boot-devtools/src/test/java/org/springframework/boot/devtools/autoconfigure/RemoteDevToolsAutoConfigurationTests.java
View File

@@ -44,7 +44,6 @@ import org.springframework.mock.web.MockHttpServletRequest;
import org.springframework.mock.web.MockHttpServletResponse;
import org.springframework.mock.web.MockServletContext;
import org.springframework.security.config.BeanIds;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.test.web.servlet.MockMvc;
import org.springframework.test.web.servlet.request.MockMvcRequestBuilders;
import org.springframework.test.web.servlet.setup.MockMvcBuilders;
@@ -183,25 +182,6 @@ class RemoteDevToolsAutoConfigurationTests {
mockMvc.perform(MockMvcRequestBuilders.get("/my-path")).andExpect(status().isUnauthorized());
}
@Test
void securityConfigurationWhenWebSecurityConfigurerAdapterIsFound2() throws Exception {
this.context = getContext(() -> {
AnnotationConfigServletWebApplicationContext context = new AnnotationConfigServletWebApplicationContext();
context.setServletContext(new MockServletContext());
context.register(Config.class, PropertyPlaceholderAutoConfiguration.class,
TestWebSecurityConfigurerAdapter.class);
TestPropertyValues.of("spring.devtools.remote.secret:supersecret").applyTo(context);
context.refresh();
return context;
});
DispatcherFilter filter = this.context.getBean(DispatcherFilter.class);
MockMvc mockMvc = MockMvcBuilders.webAppContextSetup(this.context).apply(springSecurity()).addFilter(filter)
.build();
mockMvc.perform(MockMvcRequestBuilders.get(DEFAULT_CONTEXT_PATH + "/restart").header(DEFAULT_SECRET_HEADER_NAME,
"supersecret")).andExpect(status().isOk());
assertRestartInvoked(true);
}
@Test
void disableRestart() throws Exception {
this.context = getContext(() -> loadContext("spring.devtools.remote.secret:supersecret",
@@ -270,18 +250,6 @@ class RemoteDevToolsAutoConfigurationTests {
}
@Configuration(proxyBeanMethods = false)
@SuppressWarnings("deprecation")
static class TestWebSecurityConfigurerAdapter
extends org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter {
@Override
protected void configure(HttpSecurity http) throws Exception {
http.antMatcher("/foo/**").authorizeHttpRequests().anyRequest().authenticated().and().httpBasic();
}
}
/**
* Mock {@link HttpRestartServer} implementation.
*/