Spring/spring-security
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

SEC-2348: Security HTTP Response Headers enabled by default w/ XML

Browse Source
This commit is contained in:
Rob Winch
2014-11-21 16:06:29 -06:00
parent 2e1e9885ec
commit eedbf44235
14 changed files with 3444 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
config/src/test/groovy/org/springframework/security/config/doc/XsdDocumentedTests.groovy
View File

@@ -33,7 +33,7 @@ class XsdDocumentedTests extends Specification {
@Shared def reference = new File('../docs/manual/src/asciidoc/index.adoc')
@Shared File schema31xDocument = new File('src/main/resources/org/springframework/security/config/spring-security-3.1.xsd')
@Shared File schemaDocument = new File('src/main/resources/org/springframework/security/config/spring-security-3.2.xsd')
@Shared File schemaDocument = new File('src/main/resources/org/springframework/security/config/spring-security-4.0.xsd')
@Shared Map<String,Element> elementNameToElement
@Shared GPathResult schemaRootElement
@@ -90,7 +90,7 @@ class XsdDocumentedTests extends Specification {
when: 'all the schemas are found'
def schemas = schemaDocument.getParentFile().list().findAll { it.endsWith('.xsd') }
then: 'the count is equal to 8, if not then schemaDocument needs updated'
schemas.size() == 8
schemas.size() == 9
}
/**

2
config/src/test/groovy/org/springframework/security/config/http/AbstractHttpConfigTests.groovy
View File

@@ -26,7 +26,7 @@ import org.springframework.security.web.FilterInvocation
*
*/
abstract class AbstractHttpConfigTests extends AbstractXmlConfigTests {
final int AUTO_CONFIG_FILTERS = 12;
final int AUTO_CONFIG_FILTERS = 13;
def httpAutoConfig(Closure c) {
xml.http('auto-config': 'true', c)

42
config/src/test/groovy/org/springframework/security/config/http/HttpHeadersConfigTests.groovy
View File

@@ -27,16 +27,48 @@ import org.springframework.security.web.util.matcher.AnyRequestMatcher
* @author Rob Winch
*/
class HttpHeadersConfigTests extends AbstractHttpConfigTests {
def 'headers disabled'() {
setup:
httpAutoConfig {
'headers'(disabled:true)
}
createAppContext()
def 'no http headers filter'() {
when:
def hf = getFilter(HeaderWriterFilter)
then:
!hf
}
def 'headers disabled with child fails'() {
when:
httpAutoConfig {
'headers'(disabled:true) {
'content-type-options'()
}
}
createAppContext()
then:
thrown(BeanDefinitionParsingException)
}
def 'default headers'() {
httpAutoConfig {
}
createAppContext()
def hf = getFilter(HeaderWriterFilter)
expect:
!hf
when:
def hf = getFilter(HeaderWriterFilter)
MockHttpServletResponse response = new MockHttpServletResponse()
hf.doFilter(new MockHttpServletRequest(secure:true), response, new MockFilterChain())
then:
assertHeaders(response, ['X-Content-Type-Options':'nosniff',
'X-Frame-Options':'DENY',
'Strict-Transport-Security': 'max-age=31536000 ; includeSubDomains',
'Cache-Control': 'no-cache, no-store, max-age=0, must-revalidate',
'Expires' : '0',
'Pragma':'no-cache',
'X-XSS-Protection' : '1; mode=block'])
}
def 'http headers with empty headers'() {

10
config/src/test/groovy/org/springframework/security/config/http/MiscHttpConfigTests.groovy
View File

@@ -13,8 +13,9 @@
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.springframework.security.config.http;
package org.springframework.security.config.http
import org.springframework.security.web.header.HeaderWriterFilter
import java.security.Principal
import javax.servlet.Filter
@@ -105,6 +106,7 @@ class MiscHttpConfigTests extends AbstractHttpConfigTests {
assert filters.next() instanceof SecurityContextPersistenceFilter
assert filters.next() instanceof WebAsyncManagerIntegrationFilter
assert filters.next() instanceof HeaderWriterFilter
assert filters.next() instanceof LogoutFilter
Object authProcFilter = filters.next();
assert authProcFilter instanceof UsernamePasswordAuthenticationFilter
@@ -185,7 +187,7 @@ class MiscHttpConfigTests extends AbstractHttpConfigTests {
createAppContext()
expect:
getFilters("/anything")[6] instanceof AnonymousAuthenticationFilter
getFilters("/anything")[7] instanceof AnonymousAuthenticationFilter
}
def anonymousFilterIsRemovedIfDisabledFlagSet() {
@@ -358,7 +360,7 @@ class MiscHttpConfigTests extends AbstractHttpConfigTests {
AUTO_CONFIG_FILTERS + 3 == filters.size();
filters[0] instanceof SecurityContextHolderAwareRequestFilter
filters[1] instanceof SecurityContextPersistenceFilter
filters[5] instanceof SecurityContextHolderAwareRequestFilter
filters[6] instanceof SecurityContextHolderAwareRequestFilter
filters[1] instanceof SecurityContextPersistenceFilter
}
@@ -381,7 +383,7 @@ class MiscHttpConfigTests extends AbstractHttpConfigTests {
createAppContext()
expect:
getFilters("/someurl")[3] instanceof X509AuthenticationFilter
getFilters("/someurl")[4] instanceof X509AuthenticationFilter
}
def x509SubjectPrincipalRegexCanBeSetUsingPropertyPlaceholder() {

2
config/src/test/groovy/org/springframework/security/config/http/SessionManagementConfigTests.groovy
View File

@@ -366,7 +366,7 @@ class SessionManagementConfigTests extends AbstractHttpConfigTests {
'session-management'('session-fixation-protection': 'none', 'invalid-session-url': '/timeoutUrl')
}
createAppContext()
def filter = getFilters("/someurl")[9]
def filter = getFilters("/someurl")[10]
expect:
filter instanceof SessionManagementFilter

4
config/src/test/java/org/springframework/security/config/util/InMemoryXmlApplicationContext.java
View File

@@ -40,11 +40,11 @@ public class InMemoryXmlApplicationContext extends AbstractXmlApplicationContext
Resource inMemoryXml;
public InMemoryXmlApplicationContext(String xml) {
this(xml, "3.2", null);
this(xml, "4.0", null);
}
public InMemoryXmlApplicationContext(String xml, ApplicationContext parent) {
this(xml, "3.2", parent);
this(xml, "4.0", parent);
}
public InMemoryXmlApplicationContext(String xml, String secVersion, ApplicationContext parent) {