Spring/spring-security
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

SEC-2935: Multiple MockMvc invocations proper SecurityContext setup

Browse Source 
Previously if a MockMvc instance was setup with a user and then again with
no user, then the original user would be setup.

This commit ensures that if a user is setup and then no user is setup no
user is used.
This commit is contained in:
Rob Winch
2015-04-22 16:08:41 -05:00
parent e08e9cda00
commit 1bca645add
3 changed files with 183 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
test/src/main/java/org/springframework/security/test/web/servlet/request/SecurityMockMvcRequestPostProcessors.java
View File

@@ -226,7 +226,7 @@ public final class SecurityMockMvcRequestPostProcessors {
/*
* (non-Javadoc)
*
*
* @see org.springframework.test.web.servlet.request.RequestPostProcessor
* #postProcessRequest (org.springframework.mock.web.MockHttpServletRequest)
*/
@@ -457,9 +457,9 @@ public final class SecurityMockMvcRequestPostProcessors {
* Used to wrap the SecurityContextRepository to provide support for testing in
* stateless mode
*/
private static class TestSecurityContextRepository implements
static class TestSecurityContextRepository implements
SecurityContextRepository {
private final String ATTR_NAME = TestSecurityContextRepository.class
private final static String ATTR_NAME = TestSecurityContextRepository.class
.getName().concat(".REPO");
private final SecurityContextRepository delegate;
@@ -490,7 +490,7 @@ public final class SecurityMockMvcRequestPostProcessors {
return getContext(request) != null || delegate.containsContext(request);
}
private SecurityContext getContext(HttpServletRequest request) {
private static SecurityContext getContext(HttpServletRequest request) {
return (SecurityContext) request.getAttribute(ATTR_NAME);
}
}
@@ -506,9 +506,20 @@ public final class SecurityMockMvcRequestPostProcessors {
*/
private final static class TestSecurityContextHolderPostProcessor extends
SecurityContextRequestPostProcessorSupport implements RequestPostProcessor {
private SecurityContext EMPTY = SecurityContextHolder.createEmptyContext();
public MockHttpServletRequest postProcessRequest(MockHttpServletRequest request) {
save(TestSecurityContextHolder.getContext(), request);
// TestSecurityContextHolder is only a default value
SecurityContext existingContext = TestSecurityContextRepository.getContext(request);
if(existingContext != null) {
return request;
}
SecurityContext context = TestSecurityContextHolder.getContext();
if(!EMPTY.equals(context)) {
save(context, request);
}
return request;
}
}
@@ -552,7 +563,7 @@ public final class SecurityMockMvcRequestPostProcessors {
}
public MockHttpServletRequest postProcessRequest(MockHttpServletRequest request) {
SecurityContext context = SecurityContextHolder.getContext();
SecurityContext context = SecurityContextHolder.createEmptyContext();
context.setAuthentication(authentication);
save(authentication, request);
return request;