Spring/spring-security
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

SEC-1229: Redesign Concurrent Session Control implementation. Added ConcurrentSessionControlAuthenticatedSessionStrategy

Browse Source
This commit is contained in:
Luke Taylor
2009-08-27 10:43:01 +00:00
parent ab0d66071a
commit 471206a29d
13 changed files with 377 additions and 198 deletions
Download Patch File Download Diff File Expand all files Collapse all files

30
web/src/test/java/org/springframework/security/web/session/DefaultAuthenticatedSessionStrategyTests.java
View File

@@ -25,22 +25,22 @@ public class DefaultAuthenticatedSessionStrategyTests {
DefaultAuthenticatedSessionStrategy strategy = new DefaultAuthenticatedSessionStrategy();
HttpServletRequest request = new MockHttpServletRequest();
strategy.onAuthenticationSuccess(mock(Authentication.class), request, new MockHttpServletResponse());
strategy.onAuthentication(mock(Authentication.class), request, new MockHttpServletResponse());
assertNull(request.getSession(false));
}
@Test
public void newSessionIsCreatedIfSessionAlreadyExists() throws Exception {
DefaultAuthenticatedSessionStrategy strategy = new DefaultAuthenticatedSessionStrategy();
strategy.setSessionRegistry(mock(SessionRegistry.class));
HttpServletRequest request = new MockHttpServletRequest();
String sessionId = request.getSession().getId();
strategy.onAuthenticationSuccess(mock(Authentication.class), request, new MockHttpServletResponse());
assertFalse(sessionId.equals(request.getSession().getId()));
}
// @Test
// public void newSessionIsCreatedIfSessionAlreadyExists() throws Exception {
// DefaultAuthenticatedSessionStrategy strategy = new DefaultAuthenticatedSessionStrategy();
// strategy.setSessionRegistry(mock(SessionRegistry.class));
// HttpServletRequest request = new MockHttpServletRequest();
// String sessionId = request.getSession().getId();
//
// strategy.onAuthentication(mock(Authentication.class), request, new MockHttpServletResponse());
//
// assertFalse(sessionId.equals(request.getSession().getId()));
// }
// See SEC-1077
@Test
@@ -52,7 +52,7 @@ public class DefaultAuthenticatedSessionStrategyTests {
session.setAttribute("blah", "blah");
session.setAttribute(SavedRequest.SPRING_SECURITY_SAVED_REQUEST_KEY, "SavedRequest");
strategy.onAuthenticationSuccess(mock(Authentication.class), request, new MockHttpServletResponse());
strategy.onAuthentication(mock(Authentication.class), request, new MockHttpServletResponse());
assertNull(request.getSession().getAttribute("blah"));
assertNotNull(request.getSession().getAttribute(SavedRequest.SPRING_SECURITY_SAVED_REQUEST_KEY));
@@ -62,7 +62,9 @@ public class DefaultAuthenticatedSessionStrategyTests {
public void sessionIsCreatedIfAlwaysCreateTrue() throws Exception {
DefaultAuthenticatedSessionStrategy strategy = new DefaultAuthenticatedSessionStrategy();
strategy.setAlwaysCreateSession(true);
HttpServletRequest request = new MockHttpServletRequest();
strategy.onAuthentication(mock(Authentication.class), request, new MockHttpServletResponse());
assertNotNull(request.getSession(false));
}
}

2
web/src/test/java/org/springframework/security/web/session/SessionManagementFilterTests.java
View File

@@ -82,7 +82,7 @@ public class SessionManagementFilterTests {
filter.doFilter(request, new MockHttpServletResponse(), new MockFilterChain());
verify(strategy).onAuthenticationSuccess(any(Authentication.class), any(HttpServletRequest.class), any(HttpServletResponse.class));
verify(strategy).onAuthentication(any(Authentication.class), any(HttpServletRequest.class), any(HttpServletResponse.class));
// Check that it is only applied once to the request
filter.doFilter(request, new MockHttpServletResponse(), new MockFilterChain());
verifyNoMoreInteractions(strategy);