Spring/spring-security
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Address SessionLimitStrategy

Browse Source 
Closes gh-16206
This commit is contained in:
Claudenir Machado
2024-12-05 12:50:38 +00:00
committed by Josh Cummings
parent 6bc6946ad9
commit 1864577e98
14 changed files with 627 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

85
web/src/test/java/org/springframework/security/web/authentication/session/ConcurrentSessionControlAuthenticationStrategyTests.java
View File

@@ -1,5 +1,5 @@
/*
* Copyright 2002-2019 the original author or authors.
* Copyright 2002-2024 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -34,6 +34,7 @@ import org.springframework.security.authentication.TestingAuthenticationToken;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.session.SessionInformation;
import org.springframework.security.core.session.SessionRegistry;
import org.springframework.security.web.session.SessionLimit;
import static org.assertj.core.api.Assertions.assertThat;
import static org.assertj.core.api.Assertions.assertThatExceptionOfType;
@@ -41,9 +42,11 @@ import static org.assertj.core.api.Assertions.assertThatIllegalArgumentException
import static org.mockito.ArgumentMatchers.any;
import static org.mockito.ArgumentMatchers.anyBoolean;
import static org.mockito.BDDMockito.given;
import static org.mockito.Mockito.verifyNoInteractions;
/**
* @author Rob Winch
* @author Claudenir Freitas
*
*/
@ExtendWith(MockitoExtension.class)
@@ -144,6 +147,86 @@ public class ConcurrentSessionControlAuthenticationStrategyTests {
assertThat(this.sessionInformation.isExpired()).isFalse();
}
@Test
public void setMaximumSessionsWithNullValue() {
assertThatExceptionOfType(IllegalArgumentException.class)
.isThrownBy(() -> this.strategy.setMaximumSessions(null))
.withMessage("sessionLimit cannot be null");
}
@Test
public void noRegisteredSessionUsingSessionLimit() {
given(this.sessionRegistry.getAllSessions(any(), anyBoolean())).willReturn(Collections.emptyList());
this.strategy.setMaximumSessions(SessionLimit.of(1));
this.strategy.setExceptionIfMaximumExceeded(true);
this.strategy.onAuthentication(this.authentication, this.request, this.response);
// no exception
}
@Test
public void maxSessionsSameSessionIdUsingSessionLimit() {
MockHttpSession session = new MockHttpSession(new MockServletContext(), this.sessionInformation.getSessionId());
this.request.setSession(session);
given(this.sessionRegistry.getAllSessions(any(), anyBoolean()))
.willReturn(Collections.singletonList(this.sessionInformation));
this.strategy.setMaximumSessions(SessionLimit.of(1));
this.strategy.setExceptionIfMaximumExceeded(true);
this.strategy.onAuthentication(this.authentication, this.request, this.response);
// no exception
}
@Test
public void maxSessionsWithExceptionUsingSessionLimit() {
given(this.sessionRegistry.getAllSessions(any(), anyBoolean()))
.willReturn(Collections.singletonList(this.sessionInformation));
this.strategy.setMaximumSessions(SessionLimit.of(1));
this.strategy.setExceptionIfMaximumExceeded(true);
assertThatExceptionOfType(SessionAuthenticationException.class)
.isThrownBy(() -> this.strategy.onAuthentication(this.authentication, this.request, this.response));
}
@Test
public void maxSessionsExpireExistingUserUsingSessionLimit() {
given(this.sessionRegistry.getAllSessions(any(), anyBoolean()))
.willReturn(Collections.singletonList(this.sessionInformation));
this.strategy.setMaximumSessions(SessionLimit.of(1));
this.strategy.onAuthentication(this.authentication, this.request, this.response);
assertThat(this.sessionInformation.isExpired()).isTrue();
}
@Test
public void maxSessionsExpireLeastRecentExistingUserUsingSessionLimit() {
SessionInformation moreRecentSessionInfo = new SessionInformation(this.authentication.getPrincipal(), "unique",
new Date(1374766999999L));
given(this.sessionRegistry.getAllSessions(any(), anyBoolean()))
.willReturn(Arrays.asList(moreRecentSessionInfo, this.sessionInformation));
this.strategy.setMaximumSessions(SessionLimit.of(2));
this.strategy.onAuthentication(this.authentication, this.request, this.response);
assertThat(this.sessionInformation.isExpired()).isTrue();
}
@Test
public void onAuthenticationWhenMaxSessionsExceededByTwoThenTwoSessionsExpiredUsingSessionLimit() {
SessionInformation oldestSessionInfo = new SessionInformation(this.authentication.getPrincipal(), "unique1",
new Date(1374766134214L));
SessionInformation secondOldestSessionInfo = new SessionInformation(this.authentication.getPrincipal(),
"unique2", new Date(1374766134215L));
given(this.sessionRegistry.getAllSessions(any(), anyBoolean()))
.willReturn(Arrays.asList(oldestSessionInfo, secondOldestSessionInfo, this.sessionInformation));
this.strategy.setMaximumSessions(SessionLimit.of(2));
this.strategy.onAuthentication(this.authentication, this.request, this.response);
assertThat(oldestSessionInfo.isExpired()).isTrue();
assertThat(secondOldestSessionInfo.isExpired()).isTrue();
assertThat(this.sessionInformation.isExpired()).isFalse();
}
@Test
public void onAuthenticationWhenSessionLimitIsUnlimited() {
this.strategy.setMaximumSessions(SessionLimit.UNLIMITED);
this.strategy.onAuthentication(this.authentication, this.request, this.response);
verifyNoInteractions(this.sessionRegistry);
}
@Test
public void setMessageSourceNull() {
assertThatIllegalArgumentException().isThrownBy(() -> this.strategy.setMessageSource(null));

59
web/src/test/java/org/springframework/security/web/session/SessionLimitTests.java Normal file
View File

@@ -0,0 +1,59 @@
/*
* Copyright 2002-2024 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* https://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.springframework.security.web.session;
import org.junit.jupiter.api.Test;
import org.junit.jupiter.params.ParameterizedTest;
import org.junit.jupiter.params.provider.ValueSource;
import org.mockito.Mockito;
import org.springframework.security.core.Authentication;
import static org.assertj.core.api.Assertions.assertThat;
import static org.assertj.core.api.Assertions.assertThatIllegalArgumentException;
/**
* @author Claudenir Freitas
* @since 6.5
*/
class SessionLimitTests {
private final Authentication authentication = Mockito.mock(Authentication.class);
@Test
void testUnlimitedInstance() {
SessionLimit sessionLimit = SessionLimit.UNLIMITED;
int result = sessionLimit.apply(this.authentication);
assertThat(result).isEqualTo(-1);
}
@ParameterizedTest
@ValueSource(ints = { -1, 1, 2, 3 })
void testInstanceWithValidMaxSessions(int maxSessions) {
SessionLimit sessionLimit = SessionLimit.of(maxSessions);
int result = sessionLimit.apply(this.authentication);
assertThat(result).isEqualTo(maxSessions);
}
@Test
void testInstanceWithInvalidMaxSessions() {
assertThatIllegalArgumentException().isThrownBy(() -> SessionLimit.of(0))
.withMessage(
"MaximumLogins must be either -1 to allow unlimited logins, or a positive integer to specify a maximum");
}
}