Spring/spring-security
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Add SecurityContextHolderStrategy XML Configuration for Messaging

Browse Source 
Issue gh-11061
This commit is contained in:
Josh Cummings
2022-06-27 15:07:04 -06:00
parent 484f35ca39
commit bffe08465a
8 changed files with 110 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

25
config/src/test/java/org/springframework/security/config/websocket/WebSocketMessageBrokerConfigTests.java
View File

@@ -1,5 +1,5 @@
/*
* Copyright 2002-2018 the original author or authors.
* Copyright 2002-2022 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -54,6 +54,7 @@ import org.springframework.security.config.test.SpringTestContextExtension;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.annotation.AuthenticationPrincipal;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.security.core.context.SecurityContextHolderStrategy;
import org.springframework.security.messaging.access.expression.DefaultMessageSecurityExpressionHandler;
import org.springframework.security.messaging.access.expression.MessageSecurityExpressionRoot;
import org.springframework.security.test.context.annotation.SecurityTestExecutionListeners;
@@ -248,6 +249,15 @@ public class WebSocketMessageBrokerConfigTests {
send(message);
}
@Test
public void sendWhenAnonymousMessageWithCustomSecurityContextHolderStrategyAndAuthorizationManagerThenUses() {
this.spring.configLocations(xml("WithSecurityContextHolderStrategy")).autowire();
SecurityContextHolderStrategy strategy = this.spring.getContext().getBean(SecurityContextHolderStrategy.class);
Message<?> message = message("/authenticated", SimpMessageType.CONNECT);
send(message);
verify(strategy).getContext();
}
@Test
public void sendWhenConnectWithoutCsrfTokenThenDenied() {
this.spring.configLocations(xml("SyncConfig")).autowire();
@@ -500,13 +510,22 @@ public class WebSocketMessageBrokerConfigTests {
headers.setSessionId("123");
headers.setSessionAttributes(new HashMap<>());
headers.setDestination(destination);
if (SecurityContextHolder.getContext().getAuthentication() != null) {
headers.setUser(SecurityContextHolder.getContext().getAuthentication());
SecurityContextHolderStrategy strategy = getSecurityContextHolderStrategy();
if (strategy.getContext().getAuthentication() != null) {
headers.setUser(strategy.getContext().getAuthentication());
}
headers.getSessionAttributes().put(CsrfToken.class.getName(), this.token);
return new GenericMessage<>("hi", headers.getMessageHeaders());
}
private SecurityContextHolderStrategy getSecurityContextHolderStrategy() {
String[] names = this.spring.getContext().getBeanNamesForType(SecurityContextHolderStrategy.class);
if (names.length == 1) {
return this.spring.getContext().getBean(names[0], SecurityContextHolderStrategy.class);
}
return SecurityContextHolder.getContextHolderStrategy();
}
@Controller
static class MessageController {

36
config/src/test/resources/org/springframework/security/config/websocket/WebSocketMessageBrokerConfigTests-WithSecurityContextHolderStrategy.xml Normal file
View File

@@ -0,0 +1,36 @@
<?xml version="1.0" encoding="UTF-8"?>
<!--
~ Copyright 2002-2022 the original author or authors.
~
~ Licensed under the Apache License, Version 2.0 (the "License");
~ you may not use this file except in compliance with the License.
~ You may obtain a copy of the License at
~
~ https://www.apache.org/licenses/LICENSE-2.0
~
~ Unless required by applicable law or agreed to in writing, software
~ distributed under the License is distributed on an "AS IS" BASIS,
~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
~ See the License for the specific language governing permissions and
~ limitations under the License.
-->
<b:beans xmlns:b="http://www.springframework.org/schema/beans"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns="http://www.springframework.org/schema/security"
xsi:schemaLocation="http://www.springframework.org/schema/security https://www.springframework.org/schema/security/spring-security.xsd
http://www.springframework.org/schema/beans https://www.springframework.org/schema/beans/spring-beans.xsd">
<b:import resource="classpath:org/springframework/security/config/websocket/controllers.xml"/>
<b:import resource="classpath:org/springframework/security/config/websocket/websocket.xml"/>
<websocket-message-broker use-authorization-manager="true" security-context-holder-strategy-ref="ref">
<intercept-message pattern="/authenticated" access="authenticated"/>
</websocket-message-broker>
<b:bean id="ref" class="org.mockito.Mockito" factory-method="spy">
<b:constructor-arg>
<b:bean class="org.springframework.security.config.MockSecurityContextHolderStrategy"/>
</b:constructor-arg>
</b:bean>
</b:beans>