Spring/spring-security
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

SEC-1217: AbstractRememberMeServices should set 'secure' attribute on remember-me cookie if in secure context. Added "useSecureCookie" configuration property and corresponding use-secure-cookie attribute in namespace.

Browse Source
This commit is contained in:
Luke Taylor
2009-09-01 16:08:20 +00:00
parent b2c2b93545
commit 2039200617
6 changed files with 1748 additions and 1682 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
config/src/test/java/org/springframework/security/config/http/HttpSecurityBeanDefinitionParserTests.java
View File

@@ -544,6 +544,7 @@ public class HttpSecurityBeanDefinitionParserTests {
RememberMeServices rememberMeServices = getRememberMeServices();
assertTrue(rememberMeServices instanceof PersistentTokenBasedRememberMeServices);
assertFalse((Boolean)FieldUtils.getFieldValue(getRememberMeServices(), "useSecureCookie"));
}
@Test
@@ -587,8 +588,7 @@ public class HttpSecurityBeanDefinitionParserTests {
"<http auto-config='true'>" +
" <remember-me key='ourkey' token-validity-seconds='10000' />" +
"</http>" + AUTH_PROVIDER_XML);
assertEquals(10000, FieldUtils.getFieldValue(getRememberMeServices(),
"tokenValiditySeconds"));
assertEquals(10000, FieldUtils.getFieldValue(getRememberMeServices(), "tokenValiditySeconds"));
}
@Test
@@ -597,8 +597,16 @@ public class HttpSecurityBeanDefinitionParserTests {
"<http auto-config='true'>" +
" <remember-me key='ourkey' token-validity-seconds='-1' />" +
"</http>" + AUTH_PROVIDER_XML);
assertEquals(-1, FieldUtils.getFieldValue(getRememberMeServices(),
"tokenValiditySeconds"));
assertEquals(-1, FieldUtils.getFieldValue(getRememberMeServices(), "tokenValiditySeconds"));
}
@Test
public void rememberMeSecureCookieAttributeIsSetCorrectly() throws Exception {
setContext(
"<http auto-config='true'>" +
" <remember-me key='ourkey' use-secure-cookie='true' />" +
"</http>" + AUTH_PROVIDER_XML);
assertTrue((Boolean)FieldUtils.getFieldValue(getRememberMeServices(), "useSecureCookie"));
}
@Test(expected=BeanDefinitionParsingException.class)