Spring/spring-security
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

SEC-1058: Partial refactoring of AbstractProcessingFilter. It now uses the injected SuccssfulAuthenticationHandler strategy instead of managing everything itself. The default implementation is SavedRequestAwareSuccessfulAuthenticationHandler which encapsulates most of the filter's success logic along with the code which was previously in TargetUrlResolver. Removed TargetUrlResolver.

Browse Source
This commit is contained in:
Luke Taylor
2008-12-12 22:30:57 +00:00
parent 6c7d15ee44
commit 10e4d1fe1a
12 changed files with 361 additions and 386 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
core/src/test/java/org/springframework/security/config/HttpSecurityBeanDefinitionParserTests.java
View File

@@ -175,8 +175,8 @@ public class HttpSecurityBeanDefinitionParserTests {
"</http>" + AUTH_PROVIDER_XML);
// These will be matched by the default pattern "/**"
AuthenticationProcessingFilter filter = (AuthenticationProcessingFilter) getFilters("/anything").get(1);
assertEquals("/default", filter.getDefaultTargetUrl());
assertEquals(Boolean.TRUE, FieldUtils.getFieldValue(filter, "alwaysUseDefaultTargetUrl"));
assertEquals("/default", FieldUtils.getFieldValue(filter, "successHandler.defaultTargetUrl"));
assertEquals(Boolean.TRUE, FieldUtils.getFieldValue(filter, "successHandler.alwaysUseDefaultTargetUrl"));
}
@Test(expected=BeanCreationException.class)

99
core/src/test/java/org/springframework/security/ui/AbstractProcessingFilterTests.java
View File

@@ -54,15 +54,7 @@ import org.springframework.security.util.PortResolverImpl;
* @version $Id$
*/
public class AbstractProcessingFilterTests extends TestCase {
//~ Constructors ===================================================================================================
public AbstractProcessingFilterTests() {
}
public AbstractProcessingFilterTests(String arg0) {
super(arg0);
}
SavedRequestAwareAuthenticationSuccessHandler successHandler;
//~ Methods ========================================================================================================
private MockHttpServletRequest createMockRequest() {
@@ -108,6 +100,8 @@ public class AbstractProcessingFilterTests extends TestCase {
protected void setUp() throws Exception {
super.setUp();
successHandler = new SavedRequestAwareAuthenticationSuccessHandler();
successHandler.setDefaultTargetUrl("/logged_in.jsp");
SecurityContextHolder.clearContext();
}
@@ -179,7 +173,7 @@ public class AbstractProcessingFilterTests extends TestCase {
// Setup our test object, to grant access
MockAbstractProcessingFilter filter = new MockAbstractProcessingFilter(true);
filter.setFilterProcessesUrl("/j_OTHER_LOCATION");
filter.setDefaultTargetUrl("/logged_in.jsp");
filter.setSuccessHandler(successHandler);
// Test
executeFilterInContainerSimulator(config, filter, request, response, chain);
@@ -191,7 +185,6 @@ public class AbstractProcessingFilterTests extends TestCase {
public void testGettersSetters() throws Exception {
AbstractProcessingFilter filter = new MockAbstractProcessingFilter();
filter.setAuthenticationManager(new MockAuthenticationManager());
filter.setDefaultTargetUrl("/default");
filter.setFilterProcessesUrl("/p");
filter.setAuthenticationFailureUrl("/fail");
filter.afterPropertiesSet();
@@ -200,24 +193,10 @@ public class AbstractProcessingFilterTests extends TestCase {
filter.setRememberMeServices(new TokenBasedRememberMeServices());
assertEquals(TokenBasedRememberMeServices.class, filter.getRememberMeServices().getClass());
assertTrue(filter.getAuthenticationManager() != null);
assertEquals("/default", filter.getDefaultTargetUrl());
assertEquals("/p", filter.getFilterProcessesUrl());
assertEquals("/fail", filter.getAuthenticationFailureUrl());
}
public void testDefaultUrlMuststartWithSlashOrHttpScheme() {
AbstractProcessingFilter filter = new MockAbstractProcessingFilter();
filter.setDefaultTargetUrl("/acceptableRelativeUrl");
filter.setDefaultTargetUrl("http://some.site.org/index.html");
filter.setDefaultTargetUrl("https://some.site.org/index.html");
try {
filter.setDefaultTargetUrl("missingSlash");
fail("Shouldn't accept default target without leading slash");
} catch (IllegalArgumentException expected) {}
}
public void testIgnoresAnyServletPathOtherThanFilterProcessesUrl() throws Exception {
// Setup our HTTP request
MockHttpServletRequest request = createMockRequest();
@@ -252,8 +231,9 @@ public class AbstractProcessingFilterTests extends TestCase {
// Setup our test object, to grant access
MockAbstractProcessingFilter filter = new MockAbstractProcessingFilter(true);
filter.setFilterProcessesUrl("/j_mock_post");
filter.setDefaultTargetUrl("/logged_in.jsp");
filter.setSuccessHandler(successHandler);
filter.setAuthenticationFailureUrl("/failure.jsp");
filter.setAuthenticationManager(new MockAuthenticationManager(true));
filter.afterPropertiesSet();
@@ -270,7 +250,8 @@ public class AbstractProcessingFilterTests extends TestCase {
public void testStartupDetectsInvalidAuthenticationManager() throws Exception {
AbstractProcessingFilter filter = new MockAbstractProcessingFilter();
filter.setAuthenticationFailureUrl("/failed.jsp");
filter.setDefaultTargetUrl("/");
successHandler.setDefaultTargetUrl("/");
filter.setSuccessHandler(successHandler);
filter.setFilterProcessesUrl("/j_spring_security_check");
try {
@@ -281,25 +262,11 @@ public class AbstractProcessingFilterTests extends TestCase {
}
}
public void testStartupDetectsInvalidDefaultTargetUrl() throws Exception {
AbstractProcessingFilter filter = new MockAbstractProcessingFilter();
filter.setAuthenticationFailureUrl("/failed.jsp");
filter.setAuthenticationManager(new MockAuthenticationManager());
filter.setFilterProcessesUrl("/j_spring_security_check");
try {
filter.afterPropertiesSet();
fail("Should have thrown IllegalArgumentException");
} catch (IllegalArgumentException expected) {
assertEquals("defaultTargetUrl must be specified", expected.getMessage());
}
}
public void testStartupDetectsInvalidFilterProcessesUrl() throws Exception {
AbstractProcessingFilter filter = new MockAbstractProcessingFilter();
filter.setAuthenticationFailureUrl("/failed.jsp");
filter.setAuthenticationManager(new MockAuthenticationManager());
filter.setDefaultTargetUrl("/");
filter.setSuccessHandler(successHandler);
filter.setFilterProcessesUrl(null);
try {
@@ -324,7 +291,7 @@ public class AbstractProcessingFilterTests extends TestCase {
// Setup our test object, to grant access
MockAbstractProcessingFilter filter = new MockAbstractProcessingFilter(true);
filter.setFilterProcessesUrl("/j_mock_post");
filter.setDefaultTargetUrl("/logged_in.jsp");
filter.setSuccessHandler(successHandler);
// Test
executeFilterInContainerSimulator(config, filter, request, response, chain);
@@ -364,10 +331,11 @@ public class AbstractProcessingFilterTests extends TestCase {
// Setup our test object, to grant access
MockAbstractProcessingFilter filter = new MockAbstractProcessingFilter(true);
filter.setFilterProcessesUrl("/j_mock_post");
filter.setDefaultTargetUrl("/foobar");
assertFalse(filter.isAlwaysUseDefaultTargetUrl()); // check default
filter.setAlwaysUseDefaultTargetUrl(true);
assertTrue(filter.isAlwaysUseDefaultTargetUrl()); // check changed
successHandler.setDefaultTargetUrl("/foobar");
assertFalse(successHandler.isAlwaysUseDefaultTargetUrl()); // check default
successHandler.setAlwaysUseDefaultTargetUrl(true);
assertTrue(successHandler.isAlwaysUseDefaultTargetUrl()); // check changed
filter.setSuccessHandler(successHandler);
// Test
executeFilterInContainerSimulator(config, filter, request, response, chain);
@@ -413,12 +381,10 @@ public class AbstractProcessingFilterTests extends TestCase {
MockAbstractProcessingFilter filter = new MockAbstractProcessingFilter(true);
filter.setFilterProcessesUrl("/j_mock_post");
filter.setDefaultTargetUrl("/foobar");
// Configure target resolver default implementation not to use POST SavedRequest
TargetUrlResolverImpl targetUrlResolver = new TargetUrlResolverImpl();
targetUrlResolver.setJustUseSavedRequestOnGet(true);
filter.setTargetUrlResolver(targetUrlResolver);
filter.setSuccessHandler(successHandler);
successHandler.setDefaultTargetUrl("/foobar");
// Configure not to use POST SavedRequest
successHandler.setJustUseSavedRequestOnGet(true);
// Test
executeFilterInContainerSimulator(config, filter, request, response, chain);
@@ -438,8 +404,9 @@ public class AbstractProcessingFilterTests extends TestCase {
// Setup our test object, to grant access
MockAbstractProcessingFilter filter = new MockAbstractProcessingFilter(true);
filter.setDefaultTargetUrl("https://monkeymachine.co.uk/");
filter.setAlwaysUseDefaultTargetUrl(true);
successHandler.setDefaultTargetUrl("https://monkeymachine.co.uk/");
successHandler.setAlwaysUseDefaultTargetUrl(true);
filter.setSuccessHandler(successHandler);
executeFilterInContainerSimulator(config, filter, request, response, chain);
assertEquals("https://monkeymachine.co.uk/", response.getRedirectedUrl());
@@ -458,7 +425,8 @@ public class AbstractProcessingFilterTests extends TestCase {
// Setup our test object, to grant access
MockAbstractProcessingFilter filter = new MockAbstractProcessingFilter(true);
filter.setInvalidateSessionOnSuccessfulAuthentication(true);
filter.setDefaultTargetUrl("http://monkeymachine.co.uk/");
successHandler.setDefaultTargetUrl("http://monkeymachine.co.uk/");
filter.setSuccessHandler(successHandler);
executeFilterInContainerSimulator(config, filter, request, response, chain);
@@ -477,7 +445,8 @@ public class AbstractProcessingFilterTests extends TestCase {
MockAbstractProcessingFilter filter = new MockAbstractProcessingFilter(true);
filter.setInvalidateSessionOnSuccessfulAuthentication(true);
filter.setMigrateInvalidatedSessionAttributes(false);
filter.setDefaultTargetUrl("http://monkeymachine.co.uk/");
successHandler.setDefaultTargetUrl("http://monkeymachine.co.uk/");
filter.setSuccessHandler(successHandler);
executeFilterInContainerSimulator(config, filter, request, response, chain);
@@ -500,7 +469,8 @@ public class AbstractProcessingFilterTests extends TestCase {
MockAbstractProcessingFilter filter = new MockAbstractProcessingFilter(false);
filter.setAllowSessionCreation(false);
filter.setAuthenticationFailureUrl("/");
filter.setDefaultTargetUrl("http://monkeymachine.co.uk/");
successHandler.setDefaultTargetUrl("http://monkeymachine.co.uk/");
filter.setSuccessHandler(successHandler);
executeFilterInContainerSimulator(config, filter, request, response, chain);
@@ -518,7 +488,8 @@ public class AbstractProcessingFilterTests extends TestCase {
MockHttpServletResponse response = new MockHttpServletResponse();
MockAbstractProcessingFilter filter = new MockAbstractProcessingFilter(false);
filter.setDefaultTargetUrl("http://monkeymachine.co.uk/");
successHandler.setDefaultTargetUrl("http://monkeymachine.co.uk/");
filter.setSuccessHandler(successHandler);
executeFilterInContainerSimulator(config, filter, request, response, chain);
@@ -536,7 +507,8 @@ public class AbstractProcessingFilterTests extends TestCase {
MockHttpServletResponse response = new MockHttpServletResponse();
MockAbstractProcessingFilter filter = new MockAbstractProcessingFilter(false);
filter.setDefaultTargetUrl("http://monkeymachine.co.uk/");
successHandler.setDefaultTargetUrl("http://monkeymachine.co.uk/");
filter.setSuccessHandler(successHandler);
filter.setAuthenticationFailureUrl("/error");
filter.setServerSideRedirect(true);
@@ -557,10 +529,9 @@ public class AbstractProcessingFilterTests extends TestCase {
MockHttpServletResponse response = new MockHttpServletResponse();
MockAbstractProcessingFilter filter = new MockAbstractProcessingFilter(true);
TargetUrlResolverImpl targetUrlResolver = new TargetUrlResolverImpl();
targetUrlResolver.setTargetUrlParameter("targetUrl");
filter.setTargetUrlResolver(targetUrlResolver);
filter.setDefaultTargetUrl("http://monkeymachine.co.uk/");
filter.setSuccessHandler(successHandler);
successHandler.setDefaultTargetUrl("http://monkeymachine.co.uk/");
successHandler.setTargetUrlParameter("targetUrl");
filter.setAuthenticationFailureUrl("/error");
executeFilterInContainerSimulator(config, filter, request, response, chain);

22
core/src/test/java/org/springframework/security/ui/SavedRequestAwareAuthenticationSuccessHandlerTests.java Normal file
View File

@@ -0,0 +1,22 @@
package org.springframework.security.ui;
import static org.junit.Assert.*;
import org.junit.Test;
public class SavedRequestAwareAuthenticationSuccessHandlerTests {
@Test
public void defaultUrlMuststartWithSlashOrHttpScheme() {
SavedRequestAwareAuthenticationSuccessHandler handler = new SavedRequestAwareAuthenticationSuccessHandler();
handler.setDefaultTargetUrl("/acceptableRelativeUrl");
handler.setDefaultTargetUrl("http://some.site.org/index.html");
handler.setDefaultTargetUrl("https://some.site.org/index.html");
try {
handler.setDefaultTargetUrl("missingSlash");
fail("Shouldn't accept default target without leading slash");
} catch (IllegalArgumentException expected) {}
}
}

3
core/src/test/resources/org/springframework/security/util/filtertest-valid.xml
View File

@@ -28,11 +28,10 @@ http://www.springframework.org/schema/security http://www.springframework.org/sc
<bean id="mockFilter2" class="org.springframework.security.util.MockFilter"/>
<!-- These are just here so we have filters of a specfic type to check the ordering is as expected -->
<!-- These are just here so we have filters of a specific type to check the ordering is as expected -->
<bean id="sif" class="org.springframework.security.context.HttpSessionContextIntegrationFilter"/>
<bean id="apf" class="org.springframework.security.ui.webapp.AuthenticationProcessingFilter">
<property name="defaultTargetUrl" value="/whocares"/>
<property name="authenticationFailureUrl" value="/whocares2"/>
<property name="authenticationManager">
<bean class="org.springframework.security.MockAuthenticationManager"/>