Spring/spring-security
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Default to shouldFilterAllDispatcherTypes=true in XML

Browse Source 
Closes gh-11970
This commit is contained in:
Marcus Da Coregio
2022-10-07 11:46:20 -03:00
parent 146d3269bc
commit 9fd195d419
7 changed files with 84 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
config/src/test/java/org/springframework/security/config/http/InterceptUrlConfigTests.java
View File

@@ -406,6 +406,28 @@ public class InterceptUrlConfigTests {
assertThat(this.spring.getContext().getBean(AuthorizationManager.class)).isNotNull();
}
@Test
public void requestWhenUsingFilterAllDispatcherTypesFalseThenAuthorizesRequestsAccordingly() throws Exception {
this.spring.configLocations(this.xml("FilterAllDispatcherTypesFalse")).autowire();
// @formatter:off
this.mvc.perform(get("/path").with(userCredentials()))
.andExpect(status().isOk());
this.mvc.perform(get("/path").with(adminCredentials()))
.andExpect(status().isForbidden());
this.mvc.perform(get("/error").with((request) -> {
request.setAttribute(WebUtils.ERROR_REQUEST_URI_ATTRIBUTE, "/error");
request.setDispatcherType(DispatcherType.ERROR);
return request;
})).andExpect(status().isOk());
this.mvc.perform(get("/path").with((request) -> {
request.setAttribute(WebUtils.ERROR_REQUEST_URI_ATTRIBUTE, "/path");
request.setDispatcherType(DispatcherType.ERROR);
return request;
})).andExpect(status().isOk());
// @formatter:on
assertThat(this.spring.getContext().getBean(AuthorizationManager.class)).isNotNull();
}
private static RequestPostProcessor adminCredentials() {
return httpBasic("admin", "password");
}