Spring/spring-security
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Mock Jwt Disables CSRF

Browse Source 
Fixes gh-7170
This commit is contained in:
Josh Cummings
2019-09-05 05:23:13 -06:00
parent aa12748c9b
commit b55b2914c2
3 changed files with 12 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
samples/boot/oauth2resourceserver/src/test/java/sample/OAuth2ResourceServerControllerTests.java
View File

@@ -25,7 +25,6 @@ import org.springframework.security.core.authority.SimpleGrantedAuthority;
import org.springframework.security.oauth2.jwt.JwtDecoder;
import org.springframework.test.context.junit4.SpringRunner;
import org.springframework.test.web.servlet.MockMvc;
import org.springframework.security.oauth2.jwt.Jwt;
import static org.hamcrest.CoreMatchers.is;
import static org.springframework.security.test.web.servlet.request.SecurityMockMvcRequestPostProcessors.jwt;
@@ -33,8 +32,6 @@ import static org.springframework.test.web.servlet.request.MockMvcRequestBuilder
import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.post;
import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.content;
import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;
import static org.mockito.ArgumentMatchers.anyString;
import static org.mockito.Mockito.when;
/**
*
@@ -77,41 +74,26 @@ public class OAuth2ResourceServerControllerTests {
@Test
public void messageCanNotBeCreatedWithoutAnyScope() throws Exception {
Jwt jwt = Jwt.withTokenValue("token")
.header("alg", "none")
.claim("scope", "")
.build();
when(jwtDecoder.decode(anyString())).thenReturn(jwt);
mockMvc.perform(post("/message")
.content("Hello message")
.header("Authorization", "Bearer " + jwt.getTokenValue()))
.with(jwt()))
.andExpect(status().isForbidden());
}
@Test
public void messageCanNotBeCreatedWithScopeMessageReadAuthority() throws Exception {
Jwt jwt = Jwt.withTokenValue("token")
.header("alg", "none")
.claim("scope", "message:read")
.build();
when(jwtDecoder.decode(anyString())).thenReturn(jwt);
mockMvc.perform(post("/message")
.content("Hello message")
.header("Authorization", "Bearer " + jwt.getTokenValue()))
.with(jwt(jwt -> jwt.claim("scope", "message:read"))))
.andExpect(status().isForbidden());
}
@Test
public void messageCanBeCreatedWithScopeMessageWriteAuthority()
throws Exception {
Jwt jwt = Jwt.withTokenValue("token")
.header("alg", "none")
.claim("scope", "message:write")
.build();
when(jwtDecoder.decode(anyString())).thenReturn(jwt);
mockMvc.perform(post("/message")
.content("Hello message")
.header("Authorization", "Bearer " + jwt.getTokenValue()))
.with(jwt(jwt -> jwt.claim("scope", "message:write"))))
.andExpect(status().isOk())
.andExpect(content().string(is("Message was created. Content: Hello message")));
}