Spring/spring-security
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

RequestMatcherDelegatingAuthorizationManager defaults to deny

Browse Source 
Closes gh-11958
This commit is contained in:
Joe Grandja
2022-10-13 07:16:29 -04:00
parent d0653afec3
commit 753e113a13
51 changed files with 126 additions and 67 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
config/src/test/java/org/springframework/security/config/annotation/web/configurers/AuthorizeHttpRequestsConfigurerTests.java
View File

@@ -358,7 +358,7 @@ public class AuthorizeHttpRequestsConfigurerTests {
}
@Test
public void getWhenServletPathRoleAdminConfiguredAndRoleIsUserAndWithoutServletPathThenRespondsWithOk()
public void getWhenServletPathRoleAdminConfiguredAndRoleIsUserAndWithoutServletPathThenRespondsWithForbidden()
throws Exception {
this.spring.register(ServletPathConfig.class, BasicController.class).autowire();
// @formatter:off
@@ -366,7 +366,7 @@ public class AuthorizeHttpRequestsConfigurerTests {
.with(user("user")
.roles("USER"));
// @formatter:on
this.mvc.perform(requestWithUser).andExpect(status().isOk());
this.mvc.perform(requestWithUser).andExpect(status().isForbidden());
}
@Test

5
config/src/test/java/org/springframework/security/config/authentication/AuthenticationManagerBeanDefinitionParserTests.java
View File

@@ -139,7 +139,10 @@ public class AuthenticationManagerBeanDefinitionParserTests {
+ "<user-service>"
+ " <user name='user' password='password' authorities='ROLE_A,ROLE_B' />"
+ "</user-service>"
+ "<http/>")
+ "<http>"
+ " <intercept-url pattern=\"/**\" access=\"authenticated\"/>"
+ " <http-basic />"
+ "</http>")
.mockMvcAfterSpringSecurityOk()
.autowire();
this.mockMvc.perform(get("/").with(httpBasic("user", "password")))

2
config/src/test/java/org/springframework/security/config/http/InterceptUrlConfigTests.java
View File

@@ -120,7 +120,7 @@ public class InterceptUrlConfigTests {
this.spring.configLocations(this.xml("PatchMethodAuthorizationManager")).autowire();
// @formatter:off
this.mvc.perform(get("/path").with(userCredentials()))
.andExpect(status().isOk());
.andExpect(status().isForbidden());
this.mvc.perform(patch("/path").with(userCredentials()))
.andExpect(status().isForbidden());
this.mvc.perform(patch("/path").with(adminCredentials()))

4
config/src/test/java/org/springframework/security/config/http/SessionManagementConfigServlet31Tests.java
View File

@@ -1,5 +1,5 @@
/*
* Copyright 2002-2013 the original author or authors.
* Copyright 2002-2022 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -85,6 +85,7 @@ public class SessionManagementConfigServlet31Tests {
String id = request.getSession().getId();
// @formatter:off
loadContext("<http>\n"
+ " <intercept-url pattern=\"/**\" access=\"authenticated\"/>\n"
+ " <form-login/>\n"
+ " <session-management/>\n"
+ " <csrf disabled='true'/>\n"
@@ -107,6 +108,7 @@ public class SessionManagementConfigServlet31Tests {
String id = request.getSession().getId();
// @formatter:off
loadContext("<http>\n"
+ " <intercept-url pattern=\"/**\" access=\"authenticated\"/>\n"
+ " <form-login/>\n"
+ " <session-management session-fixation-protection='changeSessionId'/>\n"
+ " <csrf disabled='true'/>\n"