SEC-2321: Improve Java Config defaults for JavaScript clients

config/src/test/groovy/org/springframework/security/config/annotation/web/builders/NamespaceHttpTests.groovy

@@ -331,16 +331,21 @@ public class NamespaceHttpTests extends BaseSpringSpec {
     // http@pattern is not available (instead see the tests http@request-matcher-ref ant or http@request-matcher-ref regex)
 
     def "http@realm"() {
-        when:
+        setup:
             loadConfig(RealmConfig)
+        when:
+            springSecurityFilterChain.doFilter(request,response,chain)
         then:
-            findFilter(BasicAuthenticationFilter).authenticationEntryPoint.realmName == "RealmConfig"
+            response.getHeader("WWW-Authenticate") == 'Basic realm="RealmConfig"'
     }
 
     @Configuration
     static class RealmConfig extends BaseWebConfig {
         protected void configure(HttpSecurity http) throws Exception {
             http
+                .authorizeRequests()
+                    .anyRequest().authenticated()
+                    .and()
                 .httpBasic().realmName("RealmConfig")
         }
     }

config/src/test/groovy/org/springframework/security/config/annotation/web/configurers/ExceptionHandlingConfigurerTests.groovy

@@ -71,7 +71,6 @@ class ExceptionHandlingConfigurerTests extends BaseSpringSpec {
             response.status == httpStatus
         where:
             acceptHeader                                 | httpStatus
-            MediaType.ALL_VALUE                          | HttpServletResponse.SC_MOVED_TEMPORARILY
             MediaType.APPLICATION_XHTML_XML_VALUE        | HttpServletResponse.SC_MOVED_TEMPORARILY
             MediaType.IMAGE_GIF_VALUE                    | HttpServletResponse.SC_MOVED_TEMPORARILY
             MediaType.IMAGE_JPEG_VALUE                   | HttpServletResponse.SC_MOVED_TEMPORARILY
@@ -165,7 +164,7 @@ class ExceptionHandlingConfigurerTests extends BaseSpringSpec {
         when:
             loadConfig(BasicAuthenticationEntryPointBeforeFormLoginConf)
         then:
-            findFilter(ExceptionTranslationFilter).authenticationEntryPoint.defaultEntryPoint.class == BasicAuthenticationEntryPoint
+            findFilter(ExceptionTranslationFilter).authenticationEntryPoint.defaultEntryPoint.defaultEntryPoint.class == BasicAuthenticationEntryPoint
     }
 
     @EnableWebSecurity

config/src/test/groovy/org/springframework/security/config/annotation/web/configurers/HttpBasicConfigurerTests.groovy

@@ -48,10 +48,13 @@ class HttpBasicConfigurerTests extends BaseSpringSpec {
     }
 
     def "SEC-2198: http.httpBasic() defaults AuthenticationEntryPoint"() {
-        when:
+        setup:
             loadConfig(DefaultsEntryPointConfig)
+        when:
+            springSecurityFilterChain.doFilter(request, response, chain)
         then:
-            findFilter(ExceptionTranslationFilter).authenticationEntryPoint.class == BasicAuthenticationEntryPoint
+            response.status == 401
+            response.getHeader("WWW-Authenticate") == 'Basic realm="Realm"'
     }
 
     @EnableWebSecurity
@@ -60,6 +63,9 @@ class HttpBasicConfigurerTests extends BaseSpringSpec {
         @Override
         protected void configure(HttpSecurity http) throws Exception {
             http
+                .authorizeRequests()
+                    .anyRequest().authenticated()
+                    .and()
                 .httpBasic()
         }
 

config/src/test/groovy/org/springframework/security/config/annotation/web/configurers/NamespaceHttpBasicTests.groovy

@@ -53,7 +53,7 @@ public class NamespaceHttpBasicTests extends BaseSpringSpec {
             springSecurityFilterChain.doFilter(request,response,chain)
         then: "unauthorized"
             response.status == HttpServletResponse.SC_UNAUTHORIZED
-            response.getHeader("WWW-Authenticate") == 'Basic realm="Spring Security Application"'
+            response.getHeader("WWW-Authenticate") == 'Basic realm="Realm"'
         when: "login success"
             super.setup()
             basicLogin()

config/src/test/groovy/org/springframework/security/config/annotation/web/configurers/RequestCacheConfigurerTests.groovy

@@ -28,6 +28,8 @@ import org.springframework.security.config.annotation.web.configuration.WebSecur
 import org.springframework.security.web.savedrequest.RequestCache
 import org.springframework.security.web.savedrequest.RequestCacheAwareFilter
 
+import spock.lang.Unroll;
+
 /**
  *
  * @author Rob Winch
@@ -87,6 +89,77 @@ class RequestCacheConfigurerTests extends BaseSpringSpec {
             response.redirectedUrl == "/"
     }
 
+    def "SEC-2321: RequestCache disables application/json"() {
+        setup:
+            loadConfig(RequestCacheDefautlsConfig)
+            request.addHeader("Accept", MediaType.APPLICATION_JSON_VALUE)
+            request.method = "GET"
+            request.servletPath = "/messages"
+            request.requestURI = "/messages"
+        when: "request application/json"
+            springSecurityFilterChain.doFilter(request,response,chain)
+        then: "sent to the login page"
+            response.status == HttpServletResponse.SC_MOVED_TEMPORARILY
+            response.redirectedUrl == "http://localhost/login"
+        when: "authenticate successfully"
+            super.setupWeb(request.session)
+            request.servletPath = "/login"
+            request.setParameter("username","user")
+            request.setParameter("password","password")
+            request.method = "POST"
+            springSecurityFilterChain.doFilter(request,response,chain)
+        then: "sent to default URL since it was application/json. This is desirable since JSON requests are typically not invoked directly from the browser and we don't want the browser to replay them"
+            response.status == HttpServletResponse.SC_MOVED_TEMPORARILY
+            response.redirectedUrl == "/"
+    }
+
+    def "SEC-2321: RequestCache disables X-Requested-With"() {
+        setup:
+            loadConfig(RequestCacheDefautlsConfig)
+            request.addHeader("X-Requested-With", "XMLHttpRequest")
+            request.method = "GET"
+            request.servletPath = "/messages"
+            request.requestURI = "/messages"
+        when: "request X-Requested-With"
+            springSecurityFilterChain.doFilter(request,response,chain)
+        then: "sent to the login page"
+            response.status == HttpServletResponse.SC_MOVED_TEMPORARILY
+            response.redirectedUrl == "http://localhost/login"
+        when: "authenticate successfully"
+            super.setupWeb(request.session)
+            request.servletPath = "/login"
+            request.setParameter("username","user")
+            request.setParameter("password","password")
+            request.method = "POST"
+            springSecurityFilterChain.doFilter(request,response,chain)
+        then: "sent to default URL since it was X-Requested-With"
+            response.status == HttpServletResponse.SC_MOVED_TEMPORARILY
+            response.redirectedUrl == "/"
+    }
+
+    @Unroll
+    def "RequestCache saves Accept: #accept"() {
+        setup:
+            loadConfig(RequestCacheDefautlsConfig)
+            request.addHeader("Accept", accept)
+            request.method = "GET"
+            request.servletPath = "/messages"
+            request.requestURI = "/messages"
+        when: "request content type"
+            springSecurityFilterChain.doFilter(request,response,chain)
+            super.setupWeb(request.session)
+            request.servletPath = "/login"
+            request.setParameter("username","user")
+            request.setParameter("password","password")
+            request.method = "POST"
+            springSecurityFilterChain.doFilter(request,response,chain)
+        then: "sent to saved URL"
+            response.status == HttpServletResponse.SC_MOVED_TEMPORARILY
+            response.redirectedUrl == "http://localhost/messages"
+        where:
+            accept << [MediaType.ALL_VALUE, MediaType.TEXT_HTML, "text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8"]
+    }
+
     @Configuration
     @EnableWebSecurity
     static class RequestCacheDefautlsConfig extends WebSecurityConfigurerAdapter {