Spring/spring-security
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Add FormRedirectStrategy to enable POST OIDC Logout

Browse Source 
FormRedirectStrategy redirects using an autosubmitting HTML form using the POST method versus DefaultRedirectStrategy which redirects using the GET method.

Can be used to implement POST binding for relying party initiated OIDC logout by setting FormRedirectStrategy as the redirection strategy on OidcClientInitiatedLogoutSuccessHandler.

Closes gh-13002

Signed-off-by: Craig Andrews <candrews@integralblue.com>
This commit is contained in:
Craig Andrews
2024-12-04 11:33:23 -05:00
committed by Steve Riesenberg
parent e63ef3cdc4
commit 58534e7f60
11 changed files with 351 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
web/src/test/java/org/springframework/security/web/aot/hint/WebMvcSecurityRuntimeHintsTests.java
View File

@@ -74,4 +74,10 @@ class WebMvcSecurityRuntimeHintsTests {
.forResource("org/springframework/security/spring-security-webauthn.js")).accepts(this.hints);
}
@Test
void formRedirectJavascriptHasHints() {
assertThat(RuntimeHintsPredicates.resource().forResource("org/springframework/security/form-redirect.js"))
.accepts(this.hints);
}
}

31
web/src/test/java/org/springframework/security/web/authentication/ui/DefaultResourcesFilterTests.java
View File

@@ -94,4 +94,35 @@ public class DefaultResourcesFilterTests {
}
@Nested
class FormRedirectJavascriptFilter {
private final DefaultResourcesFilter formRedirectJavascriptFilter = DefaultResourcesFilter
.formRedirectJavascript();
private final MockMvc mockMvc = MockMvcBuilders.standaloneSetup(new Object())
.addFilters(this.formRedirectJavascriptFilter)
.build();
@Test
void doFilterThenRender() throws Exception {
this.mockMvc.perform(get("/form-redirect.js"))
.andExpect(status().isOk())
.andExpect(content().contentType("text/javascript;charset=UTF-8"))
.andExpect(content().string(containsString("submit")));
}
@Test
void doFilterWhenPathDoesNotMatchThenCallsThrough() throws Exception {
this.mockMvc.perform(get("/does-not-match")).andExpect(status().isNotFound());
}
@Test
void toStringPrintsPathAndResource() {
assertThat(this.formRedirectJavascriptFilter.toString()).isEqualTo(
"DefaultResourcesFilter [matcher=Ant [pattern='/form-redirect.js', GET], resource=org/springframework/security/form-redirect.js]");
}
}
}

2
web/src/test/java/org/springframework/security/web/server/ui/DefaultResourcesWebFilterTests.java → web/src/test/java/org/springframework/security/web/server/ui/DefaultResourcesCssWebFilterTests.java
View File

@@ -36,7 +36,7 @@ import static org.assertj.core.api.Assertions.assertThat;
* @author Daniel Garnier-Moiroux
* @since 6.4
*/
class DefaultResourcesWebFilterTests {
class DefaultResourcesCssWebFilterTests {
private final WebHandler notFoundHandler = (exchange) -> {
exchange.getResponse().setStatusCode(HttpStatus.NOT_FOUND);

77
web/src/test/java/org/springframework/security/web/server/ui/DefaultResourcesFormRedirectJavascriptWebFilterTests.java Normal file
View File

@@ -0,0 +1,77 @@
/*
* Copyright 2002-2024 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* https://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.springframework.security.web.server.ui;
import java.nio.charset.StandardCharsets;
import java.util.List;
import org.junit.jupiter.api.Test;
import reactor.core.publisher.Mono;
import org.springframework.http.HttpStatus;
import org.springframework.http.MediaType;
import org.springframework.mock.http.server.reactive.MockServerHttpRequest;
import org.springframework.mock.web.server.MockServerWebExchange;
import org.springframework.web.server.WebFilterChain;
import org.springframework.web.server.WebHandler;
import org.springframework.web.server.handler.DefaultWebFilterChain;
import static org.assertj.core.api.Assertions.assertThat;
/**
* @author Craig Andrews
* @since 6.4
*/
class DefaultResourcesFormRedirectJavascriptWebFilterTests {
private final WebHandler notFoundHandler = (exchange) -> {
exchange.getResponse().setStatusCode(HttpStatus.NOT_FOUND);
return Mono.empty();
};
private final DefaultResourcesWebFilter filter = DefaultResourcesWebFilter.formRedirectJavascript();
@Test
void filterWhenPathMatchesThenRenders() {
MockServerWebExchange exchange = MockServerWebExchange.from(MockServerHttpRequest.get("/form-redirect.js"));
WebFilterChain filterChain = new DefaultWebFilterChain(this.notFoundHandler, List.of(this.filter));
filterChain.filter(exchange).block();
assertThat(exchange.getResponse().getStatusCode()).isEqualTo(HttpStatus.OK);
assertThat(exchange.getResponse().getHeaders().getContentType())
.isEqualTo(new MediaType("text", "javascript", StandardCharsets.UTF_8));
assertThat(exchange.getResponse().getBodyAsString().block()).contains("document");
}
@Test
void filterWhenPathDoesNotMatchThenCallsThrough() {
MockServerWebExchange exchange = MockServerWebExchange.from(MockServerHttpRequest.get("/does-not-match"));
WebFilterChain filterChain = new DefaultWebFilterChain(this.notFoundHandler, List.of(this.filter));
filterChain.filter(exchange).block();
assertThat(exchange.getResponse().getStatusCode()).isEqualTo(HttpStatus.NOT_FOUND);
}
@Test
void toStringPrintsPathAndResource() {
assertThat(this.filter.toString()).isEqualTo(
"DefaultResourcesWebFilter{matcher=PathMatcherServerWebExchangeMatcher{pattern='/form-redirect.js', method=GET}, resource='org/springframework/security/form-redirect.js'}");
}
}

96
web/src/test/java/org/springframework/security/web/server/ui/FormRedirectStrategyTests.java Normal file
View File

@@ -0,0 +1,96 @@
/*
* Copyright 2002-2023 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* https://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.springframework.security.web.server.ui;
import java.io.IOException;
import org.junit.jupiter.api.BeforeEach;
import org.junit.jupiter.api.Test;
import org.springframework.http.HttpStatus;
import org.springframework.http.MediaType;
import org.springframework.mock.web.MockHttpServletRequest;
import org.springframework.mock.web.MockHttpServletResponse;
import org.springframework.mock.web.MockServletContext;
import org.springframework.test.web.servlet.request.MockMvcRequestBuilders;
import static org.assertj.core.api.Assertions.assertThat;
public class FormRedirectStrategyTests {
private FormRedirectStrategy formRedirectStrategy;
private MockHttpServletRequest request;
private MockHttpServletResponse response;
@BeforeEach
public void beforeEach() {
this.formRedirectStrategy = new FormRedirectStrategy();
final MockServletContext mockServletContext = new MockServletContext();
mockServletContext.setContextPath("/contextPath");
// the request URL doesn't matter
this.request = MockMvcRequestBuilders.get("https://localhost").buildRequest(mockServletContext);
this.response = new MockHttpServletResponse();
}
@Test
public void absoluteUrlNoParametersRedirect() throws IOException {
this.formRedirectStrategy.sendRedirect(this.request, this.response, "https://example.com");
assertThat(this.response.getStatus()).isEqualTo(HttpStatus.OK.value());
assertThat(this.response.getContentType()).isEqualTo(MediaType.TEXT_HTML_VALUE);
assertThat(this.response.getContentAsString()).contains("action=\"https://example.com\"");
}
@Test
public void rootRelativeUrlNoParametersRedirect() throws IOException {
this.formRedirectStrategy.sendRedirect(this.request, this.response, "/test");
assertThat(this.response.getStatus()).isEqualTo(HttpStatus.OK.value());
assertThat(this.response.getContentType()).isEqualTo(MediaType.TEXT_HTML_VALUE);
assertThat(this.response.getContentAsString()).contains("action=\"/test\"");
}
@Test
public void relativeUrlNoParametersRedirect() throws IOException {
this.formRedirectStrategy.sendRedirect(this.request, this.response, "test");
assertThat(this.response.getStatus()).isEqualTo(HttpStatus.OK.value());
assertThat(this.response.getContentType()).isEqualTo(MediaType.TEXT_HTML_VALUE);
assertThat(this.response.getContentAsString()).contains("action=\"test\"");
}
@Test
public void absoluteUrlWithFragmentRedirect() throws IOException {
this.formRedirectStrategy.sendRedirect(this.request, this.response, "https://example.com/path#fragment");
assertThat(this.response.getStatus()).isEqualTo(HttpStatus.OK.value());
assertThat(this.response.getContentType()).isEqualTo(MediaType.TEXT_HTML_VALUE);
assertThat(this.response.getContentAsString()).contains("action=\"https://example.com/path#fragment\"");
}
@Test
public void absoluteUrlWithQueryParamsRedirect() throws IOException {
this.formRedirectStrategy.sendRedirect(this.request, this.response,
"https://example.com/path?param1=one&param2=two#fragment");
assertThat(this.response.getStatus()).isEqualTo(HttpStatus.OK.value());
assertThat(this.response.getContentType()).isEqualTo(MediaType.TEXT_HTML_VALUE);
assertThat(this.response.getContentAsString()).contains("action=\"https://example.com/path#fragment\"");
assertThat(this.response.getContentAsString())
.contains("<input name=\"param1\" type=\"hidden\" value=\"one\" />");
assertThat(this.response.getContentAsString())
.contains("<input name=\"param2\" type=\"hidden\" value=\"two\" />");
}
}