SEC-2137: Allow disabling session fixation and enable concurrency control

web/src/test/java/org/springframework/security/web/authentication/session/CompositeSessionAuthenticationStrategyTests.java

@@ -0,0 +1,92 @@
+/*
+ * Copyright 2002-2013 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.springframework.security.web.authentication.session;
+
+import static junit.framework.Assert.fail;
+import static org.mockito.Mockito.doThrow;
+import static org.mockito.Mockito.times;
+import static org.mockito.Mockito.verify;
+
+import java.util.Arrays;
+import java.util.Collections;
+
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.Mock;
+import org.mockito.runners.MockitoJUnitRunner;
+import org.springframework.security.core.Authentication;
+
+/**
+ * @author Rob Winch
+ *
+ */
+@RunWith(MockitoJUnitRunner.class)
+public class CompositeSessionAuthenticationStrategyTests {
+    @Mock
+    private SessionAuthenticationStrategy strategy1;
+    @Mock
+    private SessionAuthenticationStrategy strategy2;
+    @Mock
+    private Authentication authentication;
+    @Mock
+    private HttpServletRequest request;
+    @Mock
+    private HttpServletResponse response;
+
+
+    @Test(expected = IllegalArgumentException.class)
+    public void constructorNullDelegates() {
+        new CompositeSessionAuthenticationStrategy(null);
+    }
+
+    @Test(expected = IllegalArgumentException.class)
+    public void constructorEmptyDelegates() {
+        new CompositeSessionAuthenticationStrategy(Collections.<SessionAuthenticationStrategy>emptyList());
+    }
+
+    @Test(expected = IllegalArgumentException.class)
+    public void constructorDelegatesContainNull() {
+        new CompositeSessionAuthenticationStrategy(Collections.<SessionAuthenticationStrategy>singletonList(null));
+    }
+
+    @Test
+    public void delegatesToAll() {
+        CompositeSessionAuthenticationStrategy strategy = new CompositeSessionAuthenticationStrategy(Arrays.asList(strategy1,strategy2));
+        strategy.onAuthentication(authentication, request, response);
+
+        verify(strategy1).onAuthentication(authentication, request, response);
+        verify(strategy2).onAuthentication(authentication, request, response);
+    }
+
+
+    @Test
+    public void delegateShortCircuits() {
+        doThrow(new SessionAuthenticationException("oops")).when(strategy1).onAuthentication(authentication, request, response);
+
+        CompositeSessionAuthenticationStrategy strategy = new CompositeSessionAuthenticationStrategy(Arrays.asList(strategy1,strategy2));
+
+        try {
+            strategy.onAuthentication(authentication, request, response);
+            fail("Expected Exception");
+        } catch (SessionAuthenticationException success) {}
+
+        verify(strategy1).onAuthentication(authentication, request, response);
+        verify(strategy2,times(0)).onAuthentication(authentication, request, response);
+    }
+}

web/src/test/java/org/springframework/security/web/authentication/session/ConcurrentSessionControlAuthenticationStrategyTests.java

@@ -0,0 +1,132 @@
+/*
+ * Copyright 2002-2013 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.security.web.authentication.session;
+
+import static org.fest.assertions.Assertions.assertThat;
+import static org.mockito.Matchers.any;
+import static org.mockito.Matchers.anyBoolean;
+import static org.mockito.Mockito.when;
+
+import java.util.Arrays;
+import java.util.Collections;
+import java.util.Date;
+
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.Mock;
+import org.mockito.runners.MockitoJUnitRunner;
+import org.springframework.mock.web.MockHttpServletRequest;
+import org.springframework.mock.web.MockHttpServletResponse;
+import org.springframework.mock.web.MockHttpSession;
+import org.springframework.mock.web.MockServletContext;
+import org.springframework.security.authentication.TestingAuthenticationToken;
+import org.springframework.security.core.Authentication;
+import org.springframework.security.core.session.SessionInformation;
+import org.springframework.security.core.session.SessionRegistry;
+
+/**
+ *
+ * @author Rob Winch
+ *
+ */
+@RunWith(MockitoJUnitRunner.class)
+public class ConcurrentSessionControlAuthenticationStrategyTests {
+    @Mock
+    private SessionRegistry sessionRegistry;
+
+    private Authentication authentication;
+    private MockHttpServletRequest request;
+    private MockHttpServletResponse response;
+    private SessionInformation sessionInformation;
+
+    private ConcurrentSessionControlAuthenticationStrategy strategy;
+
+    @Before
+    public void setup() throws Exception {
+        authentication = new TestingAuthenticationToken("user", "password", "ROLE_USER");
+        request = new MockHttpServletRequest();
+        response = new MockHttpServletResponse();
+        sessionInformation = new SessionInformation(authentication.getPrincipal(), "unique", new Date(1374766134216L));
+
+        strategy = new ConcurrentSessionControlAuthenticationStrategy(sessionRegistry);
+    }
+
+    @Test(expected = IllegalArgumentException.class)
+    public void constructorNullRegistry() {
+        new ConcurrentSessionControlAuthenticationStrategy(null);
+    }
+
+    @Test
+    public void noRegisteredSession() {
+        when(sessionRegistry.getAllSessions(any(), anyBoolean())).thenReturn(Collections.<SessionInformation>emptyList());
+        strategy.setMaximumSessions(1);
+        strategy.setExceptionIfMaximumExceeded(true);
+
+        strategy.onAuthentication(authentication, request, response);
+
+        // no exception
+    }
+
+    @Test
+    public void maxSessionsSameSessionId() {
+        MockHttpSession session = new MockHttpSession(new MockServletContext(), sessionInformation.getSessionId());
+        request.setSession(session);
+        when(sessionRegistry.getAllSessions(any(), anyBoolean())).thenReturn(Collections.<SessionInformation>singletonList(sessionInformation));
+        strategy.setMaximumSessions(1);
+        strategy.setExceptionIfMaximumExceeded(true);
+
+        strategy.onAuthentication(authentication, request, response);
+
+        // no exception
+    }
+
+    @Test(expected = SessionAuthenticationException.class)
+    public void maxSessionsWithException() {
+        when(sessionRegistry.getAllSessions(any(), anyBoolean())).thenReturn(Collections.<SessionInformation>singletonList(sessionInformation));
+        strategy.setMaximumSessions(1);
+        strategy.setExceptionIfMaximumExceeded(true);
+
+        strategy.onAuthentication(authentication, request, response);
+    }
+
+    @Test
+    public void maxSessionsExpireExistingUser() {
+        when(sessionRegistry.getAllSessions(any(), anyBoolean())).thenReturn(Collections.<SessionInformation>singletonList(sessionInformation));
+        strategy.setMaximumSessions(1);
+
+        strategy.onAuthentication(authentication, request, response);
+
+        assertThat(sessionInformation.isExpired()).isTrue();
+    }
+
+    @Test
+    public void maxSessionsExpireLeastRecentExistingUser() {
+        SessionInformation moreRecentSessionInfo = new SessionInformation(authentication.getPrincipal(), "unique", new Date(1374766999999L));
+        when(sessionRegistry.getAllSessions(any(), anyBoolean())).thenReturn(Arrays.<SessionInformation>asList(moreRecentSessionInfo,sessionInformation));
+        strategy.setMaximumSessions(2);
+
+        strategy.onAuthentication(authentication, request, response);
+
+        assertThat(sessionInformation.isExpired()).isTrue();
+    }
+
+    @Test(expected = IllegalArgumentException.class)
+    public void setMessageSourceNull() {
+        strategy.setMessageSource(null);
+    }
+}

web/src/test/java/org/springframework/security/web/authentication/session/RegisterSessionAuthenticationStrategyTests.java

@@ -0,0 +1,67 @@
+/*
+ * Copyright 2002-2013 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.springframework.security.web.authentication.session;
+
+import static org.mockito.Mockito.verify;
+
+import org.junit.Before;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.mockito.Mock;
+import org.mockito.runners.MockitoJUnitRunner;
+import org.springframework.mock.web.MockHttpServletRequest;
+import org.springframework.mock.web.MockHttpServletResponse;
+import org.springframework.security.authentication.TestingAuthenticationToken;
+import org.springframework.security.core.Authentication;
+import org.springframework.security.core.session.SessionRegistry;
+
+/**
+ * @author Rob Winch
+ *
+ */
+@RunWith(MockitoJUnitRunner.class)
+public class RegisterSessionAuthenticationStrategyTests {
+
+    @Mock
+    private SessionRegistry registry;
+
+    private RegisterSessionAuthenticationStrategy authenticationStrategy;
+
+    private Authentication authentication;
+    private MockHttpServletRequest request;
+    private MockHttpServletResponse response;
+
+    @Before
+    public void setup() {
+        authenticationStrategy = new RegisterSessionAuthenticationStrategy(registry);
+        authentication = new TestingAuthenticationToken("user", "password","ROLE_USER");
+        request = new MockHttpServletRequest();
+        response = new MockHttpServletResponse();
+    }
+
+    @Test(expected = IllegalArgumentException.class)
+    public void constructorNullRegistry() {
+        new RegisterSessionAuthenticationStrategy(null);
+    }
+
+    @Test
+    public void onAuthenticationRegistersSession() {
+        authenticationStrategy.onAuthentication(authentication, request, response);
+
+        verify(registry).registerNewSession(request.getSession().getId(), authentication.getPrincipal());
+    }
+
+}