Add Support for Clear Site Data on Logout
Added an implementation of HeaderWriter for Clear-Site-Data HTTP response header as welll as an implementation of LogoutHanlder that accepts an implementation of HeaderWriter to write headers. - Added ClearSiteDataHeaderWriter and HeaderWriterLogoutHandler that implements HeaderWriter and LogoutHandler respectively - Added unit tests for both implementations's behaviours - Integration tests for HeaderWriterLogoutHandler that uses ClearSiteDataHeaderWriter - Updated the documentation to include link to HeaderWriterLogoutHandler Fixes gh-4187
This commit is contained in:
Rafiullah Hamedy
committed by
Josh Cummings
Josh Cummings
parent
7739a0e91a
commit
82d527ed42
@@ -0,0 +1,104 @@
|
||||
/*
|
||||
* Copyright 2002-2019 the original author or authors.
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
|
||||
package org.springframework.security.web.authentication.logout;
|
||||
|
||||
import org.junit.Before;
|
||||
import org.junit.Rule;
|
||||
import org.junit.Test;
|
||||
import org.junit.rules.ExpectedException;
|
||||
import org.springframework.mock.web.MockHttpServletRequest;
|
||||
import org.springframework.mock.web.MockHttpServletResponse;
|
||||
import org.springframework.security.core.Authentication;
|
||||
import org.springframework.security.web.header.writers.ClearSiteDataHeaderWriter;
|
||||
|
||||
import static org.assertj.core.api.Assertions.assertThat;
|
||||
import static org.mockito.Mockito.mock;
|
||||
import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.header;
|
||||
|
||||
/**
|
||||
*
|
||||
* @author Rafiullah Hamedy
|
||||
*
|
||||
* @see {@link HeaderWriterLogoutHandler}
|
||||
*/
|
||||
public class HeaderWriterLogoutHandlerTests {
|
||||
private static final String HEADER_NAME = "Clear-Site-Data";
|
||||
|
||||
private MockHttpServletResponse response;
|
||||
private MockHttpServletRequest request;
|
||||
|
||||
@Rule
|
||||
public ExpectedException thrown = ExpectedException.none();
|
||||
|
||||
@Before
|
||||
public void setup() {
|
||||
this.response = new MockHttpServletResponse();
|
||||
this.request = new MockHttpServletRequest();
|
||||
}
|
||||
|
||||
@Test
|
||||
public void createInstanceWhenHeaderWriterIsNullThenThrowsException() {
|
||||
this.thrown.expect(IllegalArgumentException.class);
|
||||
this.thrown.expectMessage("headerWriter cannot be null.");
|
||||
|
||||
new HeaderWriterLogoutHandler(null);
|
||||
}
|
||||
|
||||
@Test
|
||||
public void createInstanceWhenSourceIsNullThenThrowsException() {
|
||||
this.thrown.expect(IllegalArgumentException.class);
|
||||
this.thrown.expectMessage("Sources cannot be empty or null.");
|
||||
|
||||
new HeaderWriterLogoutHandler(new ClearSiteDataHeaderWriter());
|
||||
}
|
||||
|
||||
@Test
|
||||
public void logoutWhenRequestIsNotSecureThenHeaderIsNotPresent() {
|
||||
HeaderWriterLogoutHandler handler = new HeaderWriterLogoutHandler(
|
||||
new ClearSiteDataHeaderWriter("cache"));
|
||||
|
||||
handler.logout(request, response, mock(Authentication.class));
|
||||
|
||||
assertThat(header().doesNotExist(HEADER_NAME));
|
||||
}
|
||||
|
||||
@Test
|
||||
public void logoutWhenRequestIsSecureThenHeaderIsPresentMatchesWildCardSource() {
|
||||
HeaderWriterLogoutHandler handler = new HeaderWriterLogoutHandler(
|
||||
new ClearSiteDataHeaderWriter("*"));
|
||||
|
||||
this.request.setSecure(true);
|
||||
|
||||
handler.logout(request, response, mock(Authentication.class));
|
||||
|
||||
assertThat(header().stringValues(HEADER_NAME, "\"*\""));
|
||||
}
|
||||
|
||||
@Test
|
||||
public void logoutWhenRequestIsSecureThenHeaderValueMatchesSource() {
|
||||
HeaderWriterLogoutHandler handler = new HeaderWriterLogoutHandler(
|
||||
new ClearSiteDataHeaderWriter("cache", "cookies", "storage",
|
||||
"executionContexts"));
|
||||
|
||||
this.request.setSecure(true);
|
||||
|
||||
handler.logout(request, response, mock(Authentication.class));
|
||||
|
||||
assertThat(header().stringValues(HEADER_NAME, "\"cache\", \"cookies\", \"storage\", "
|
||||
+ "\"executionContexts\""));
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,95 @@
|
||||
/*
|
||||
* Copyright 2002-2019 the original author or authors.
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
|
||||
package org.springframework.security.web.header.writers;
|
||||
|
||||
import org.junit.Before;
|
||||
import org.junit.Rule;
|
||||
import org.junit.Test;
|
||||
import org.junit.rules.ExpectedException;
|
||||
import org.springframework.mock.web.MockHttpServletRequest;
|
||||
import org.springframework.mock.web.MockHttpServletResponse;
|
||||
|
||||
import static org.assertj.core.api.Assertions.assertThat;
|
||||
import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.header;
|
||||
|
||||
/**
|
||||
*
|
||||
* @author Rafiullah Hamedy
|
||||
*
|
||||
* @see {@link ClearSiteDataHeaderWriter}
|
||||
*/
|
||||
public class ClearSiteDataHeaderWriterTests {
|
||||
private static final String HEADER_NAME = "Clear-Site-Data";
|
||||
|
||||
private MockHttpServletRequest request;
|
||||
private MockHttpServletResponse response;
|
||||
|
||||
@Rule
|
||||
public ExpectedException thrown = ExpectedException.none();
|
||||
|
||||
@Before
|
||||
public void setup() {
|
||||
request = new MockHttpServletRequest();
|
||||
request.setSecure(true);
|
||||
response = new MockHttpServletResponse();
|
||||
}
|
||||
|
||||
@Test
|
||||
public void createInstanceWhenMissingSourceThenThrowsException() {
|
||||
this.thrown.expect(Exception.class);
|
||||
this.thrown.expectMessage("Sources cannot be empty or null.");
|
||||
|
||||
new ClearSiteDataHeaderWriter();
|
||||
}
|
||||
|
||||
@Test
|
||||
public void createInstanceWhenEmptySourceThenThrowsException() {
|
||||
this.thrown.expect(Exception.class);
|
||||
this.thrown.expectMessage("Sources cannot be empty or null.");
|
||||
|
||||
new ClearSiteDataHeaderWriter(new String[] {});
|
||||
}
|
||||
|
||||
@Test
|
||||
public void writeHeaderWhenRequestNotSecureThenHeaderIsNotPresent() {
|
||||
this.request.setSecure(false);
|
||||
|
||||
ClearSiteDataHeaderWriter headerWriter = new ClearSiteDataHeaderWriter("cache");
|
||||
headerWriter.writeHeaders(request, response);
|
||||
|
||||
assertThat(header().doesNotExist(HEADER_NAME));
|
||||
}
|
||||
|
||||
@Test
|
||||
public void writeHeaderWhenRequestIsSecureThenHeaderValueMatchesPassedSource() {
|
||||
ClearSiteDataHeaderWriter headerWriter = new ClearSiteDataHeaderWriter("storage");
|
||||
headerWriter.writeHeaders(request, response);
|
||||
|
||||
assertThat(header().stringValues(HEADER_NAME, "\"storage\""));
|
||||
}
|
||||
|
||||
@Test
|
||||
public void writeHeaderWhenRequestIsSecureThenHeaderValueMatchesPassedSources() {
|
||||
ClearSiteDataHeaderWriter headerWriter =
|
||||
new ClearSiteDataHeaderWriter("cache", "cookies", "storage", "executionContexts");
|
||||
|
||||
headerWriter.writeHeaders(request, response);
|
||||
|
||||
assertThat(header().stringValues(HEADER_NAME, "\"cache\", \"cookies\", \"storage\","
|
||||
+ " \"executionContexts\""));
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user