diff --git a/README.adoc b/README.adoc index 4a38dab..9840b06 100644 --- a/README.adoc +++ b/README.adoc @@ -183,30 +183,31 @@ Add the following Spring Configuration: @Configuration public class Config { - @Bean - public JedisConnectionFactory connectionFactory() throws Exception { - return new JedisConnectionFactory(); - } + @Bean + public JedisConnectionFactory connectionFactory() throws Exception { + return new JedisConnectionFactory(); + } - @Bean - public RedisTemplate redisTemplate(RedisConnectionFactory connectionFactory) { - RedisTemplate template = new RedisTemplate(); - template.setKeySerializer(new StringRedisSerializer()); - template.setHashKeySerializer(new StringRedisSerializer()); - template.setConnectionFactory(connectionFactory); - return template; - } + @Bean + public RedisTemplate redisTemplate(RedisConnectionFactory connectionFactory) { + RedisTemplate template = new RedisTemplate(); + template.setKeySerializer(new StringRedisSerializer()); + template.setHashKeySerializer(new StringRedisSerializer()); + template.setConnectionFactory(connectionFactory); + return template; + } - @Bean - public RedisOperationsSessionRepository sessionRepository(RedisTemplate redisTemplate) { - return new RedisOperationsSessionRepository(redisTemplate); - } + @Bean + public RedisOperationsSessionRepository sessionRepository(RedisTemplate redisTemplate) { + return new RedisOperationsSessionRepository(redisTemplate); + } - @Bean - public SessionRepositoryFilter sessionFilter(RedisOperationsSessionRepository sessionRepository) { - return new SessionRepositoryFilter(sessionRepository); - } + @Bean + public SessionRepositoryFilter sessionFilter(SessionRepository sessionRepository) { + return new SessionRepositoryFilter(sessionRepository); + } } + ---- In our example, we are connecting to the default port (6379). For more information on configuring Spring Data Redis, refer to the http://docs.spring.io/spring-data/data-redis/docs/current/reference/html/[reference documentation]. @@ -221,19 +222,19 @@ We next need to be sure our Servlet Container (i.e. Tomcat) is properly configur [source,java] ---- public class Initializer extends AbstractContextLoaderInitializer { - @Override - public void onStartup(ServletContext servletContext) throws ServletException { - super.onStartup(servletContext); - servletContext.addFilter("sessionFilter", DelegatingFilterProxy.class) - .addMappingForUrlPatterns(EnumSet.of(DispatcherType.REQUEST), false, "/*"); - } + @Override + public void onStartup(ServletContext servletContext) throws ServletException { + super.onStartup(servletContext); + servletContext.addFilter("sessionFilter", DelegatingFilterProxy.class) + .addMappingForUrlPatterns(EnumSet.of(DispatcherType.REQUEST), false, "/*"); + } - @Override - protected WebApplicationContext createRootApplicationContext() { - AnnotationConfigWebApplicationContext context = new AnnotationConfigWebApplicationContext(); - context.register(Config.class); - return context; - } + @Override + protected WebApplicationContext createRootApplicationContext() { + AnnotationConfigWebApplicationContext context = new AnnotationConfigWebApplicationContext(); + context.register(Config.class); + return context; + } } ---- diff --git a/samples/web/src/main/java/Config.java b/samples/web/src/main/java/Config.java index 086fc1c..f8d98a8 100644 --- a/samples/web/src/main/java/Config.java +++ b/samples/web/src/main/java/Config.java @@ -23,8 +23,11 @@ import org.springframework.data.redis.connection.jedis.JedisConnectionFactory; import org.springframework.data.redis.core.RedisTemplate; import org.springframework.data.redis.serializer.StringRedisSerializer; import org.springframework.session.ExpiringSession; +import org.springframework.session.SessionRepository; import org.springframework.session.data.redis.RedisOperationsSessionRepository; +import org.springframework.session.data.redis.RedisOperationsSessionRepository.RedisSession; import org.springframework.session.web.http.SessionRepositoryFilter; + import redis.clients.jedis.Protocol; import redis.embedded.RedisServer; @@ -34,50 +37,50 @@ import redis.embedded.RedisServer; @Configuration public class Config { - @Bean - public RedisServerBean redisServer() { - return new RedisServerBean(); - } + @Bean + public RedisServerBean redisServer() { + return new RedisServerBean(); + } - class RedisServerBean implements InitializingBean, DisposableBean { - private RedisServer redisServer; + class RedisServerBean implements InitializingBean, DisposableBean { + private RedisServer redisServer; - @Override - public void afterPropertiesSet() throws Exception { - redisServer = new RedisServer(Protocol.DEFAULT_PORT); - redisServer.start(); - } + @Override + public void afterPropertiesSet() throws Exception { + redisServer = new RedisServer(Protocol.DEFAULT_PORT); + redisServer.start(); + } - @Override - public void destroy() throws Exception { - if(redisServer != null) { - redisServer.stop(); - } - } - } + @Override + public void destroy() throws Exception { + if(redisServer != null) { + redisServer.stop(); + } + } + } - @Bean - public JedisConnectionFactory connectionFactory() throws Exception { - return new JedisConnectionFactory(); - } + @Bean + public JedisConnectionFactory connectionFactory() throws Exception { + return new JedisConnectionFactory(); + } - @Bean - public RedisTemplate redisTemplate(RedisConnectionFactory connectionFactory) { - RedisTemplate template = new RedisTemplate(); - template.setKeySerializer(new StringRedisSerializer()); - template.setHashKeySerializer(new StringRedisSerializer()); - template.setConnectionFactory(connectionFactory); - return template; - } + @Bean + public RedisTemplate redisTemplate(RedisConnectionFactory connectionFactory) { + RedisTemplate template = new RedisTemplate(); + template.setKeySerializer(new StringRedisSerializer()); + template.setHashKeySerializer(new StringRedisSerializer()); + template.setConnectionFactory(connectionFactory); + return template; + } - @Bean - public RedisOperationsSessionRepository sessionRepository(RedisTemplate redisTemplate) { - return new RedisOperationsSessionRepository(redisTemplate); - } + @Bean + public RedisOperationsSessionRepository sessionRepository(RedisTemplate redisTemplate) { + return new RedisOperationsSessionRepository(redisTemplate); + } - @Bean - public SessionRepositoryFilter sessionFilter(RedisOperationsSessionRepository sessionRepository) { - return new SessionRepositoryFilter(sessionRepository); - } + @Bean + public SessionRepositoryFilter sessionFilter(SessionRepository sessionRepository) { + return new SessionRepositoryFilter(sessionRepository); + } } diff --git a/samples/web/src/main/java/SessionServlet.java b/samples/web/src/main/java/SessionServlet.java index 01a50e1..ec4fd67 100644 --- a/samples/web/src/main/java/SessionServlet.java +++ b/samples/web/src/main/java/SessionServlet.java @@ -26,11 +26,14 @@ import java.io.IOException; */ @WebServlet("/session") public class SessionServlet extends HttpServlet { - @Override - protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException { - String attributeName = req.getParameter("attributeName"); - String attributeValue = req.getParameter("attributeValue"); - req.getSession().setAttribute(attributeName, attributeValue); - resp.sendRedirect(req.getContextPath() + "/"); - } + + @Override + protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException { + String attributeName = req.getParameter("attributeName"); + String attributeValue = req.getParameter("attributeValue"); + req.getSession().setAttribute(attributeName, attributeValue); + resp.sendRedirect(req.getContextPath() + "/"); + } + + private static final long serialVersionUID = 2878267318695777395L; } diff --git a/spring-session/src/integration-test/java/org/springframework/session/data/redis/RedisOperationsSessionRepositoryITests.java b/spring-session/src/integration-test/java/org/springframework/session/data/redis/RedisOperationsSessionRepositoryITests.java index e356162..eb6de49 100644 --- a/spring-session/src/integration-test/java/org/springframework/session/data/redis/RedisOperationsSessionRepositoryITests.java +++ b/spring-session/src/integration-test/java/org/springframework/session/data/redis/RedisOperationsSessionRepositoryITests.java @@ -30,99 +30,97 @@ import java.net.ServerSocket; @RunWith(SpringJUnit4ClassRunner.class) @ContextConfiguration -public class RedisOperationsSessionRepositoryITests { - private RedisServer redisServer; +public class RedisOperationsSessionRepositoryITests { + private RedisServer redisServer; - @Autowired - private SessionRepository repository; + @Autowired + private SessionRepository repository; - @Before - public void setup() throws IOException { - redisServer = new RedisServer(getPort()); - redisServer.start(); - } + @Before + public void setup() throws IOException { + redisServer = new RedisServer(getPort()); + redisServer.start(); + } - @After - public void shutdown() throws InterruptedException { - redisServer.stop(); - } + @After + public void shutdown() throws InterruptedException { + redisServer.stop(); + } - @Test - public void saves() { - Session toSave = repository.createSession(); - toSave.setAttribute("a", "b"); - Authentication toSaveToken = new UsernamePasswordAuthenticationToken("user","password", AuthorityUtils.createAuthorityList("ROLE_USER")); - SecurityContext toSaveContext = SecurityContextHolder.createEmptyContext(); - toSaveContext.setAuthentication(toSaveToken); - toSave.setAttribute("SPRING_SECURITY_CONTEXT", toSaveContext); + @Test + public void saves() { + S toSave = repository.createSession(); + toSave.setAttribute("a", "b"); + Authentication toSaveToken = new UsernamePasswordAuthenticationToken("user","password", AuthorityUtils.createAuthorityList("ROLE_USER")); + SecurityContext toSaveContext = SecurityContextHolder.createEmptyContext(); + toSaveContext.setAuthentication(toSaveToken); + toSave.setAttribute("SPRING_SECURITY_CONTEXT", toSaveContext); - repository.save(toSave); + repository.save(toSave); - Session session = repository.getSession(toSave.getId()); + Session session = repository.getSession(toSave.getId()); - assertThat(session.getId()).isEqualTo(toSave.getId()); - assertThat(session.getAttributeNames()).isEqualTo(session.getAttributeNames()); - assertThat(session.getAttribute("a")).isEqualTo(toSave.getAttribute("a")); + assertThat(session.getId()).isEqualTo(toSave.getId()); + assertThat(session.getAttributeNames()).isEqualTo(session.getAttributeNames()); + assertThat(session.getAttribute("a")).isEqualTo(toSave.getAttribute("a")); - SecurityContext context = (SecurityContext) session.getAttribute("SPRING_SECURITY_CONTEXT"); + repository.delete(toSave.getId()); - repository.delete(toSave.getId()); + assertThat(repository.getSession(toSave.getId())).isNull(); + } - assertThat(repository.getSession(toSave.getId())).isNull(); - } + @Test + public void putAllOnSingleAttrDoesNotRemoveOld() { + S toSave = repository.createSession(); + toSave.setAttribute("a", "b"); - @Test - public void putAllOnSingleAttrDoesNotRemoveOld() { - Session toSave = repository.createSession(); - toSave.setAttribute("a", "b"); + repository.save(toSave); + toSave = repository.getSession(toSave.getId()); - repository.save(toSave); - toSave = repository.getSession(toSave.getId()); + toSave.setAttribute("1", "2"); - toSave.setAttribute("1", "2"); + repository.save(toSave); + toSave = repository.getSession(toSave.getId()); - repository.save(toSave); - toSave = repository.getSession(toSave.getId()); + Session session = repository.getSession(toSave.getId()); + assertThat(session.getAttributeNames().size()).isEqualTo(2); + assertThat(session.getAttribute("a")).isEqualTo("b"); + assertThat(session.getAttribute("1")).isEqualTo("2"); + } - Session session = repository.getSession(toSave.getId()); - assertThat(session.getAttributeNames().size()).isEqualTo(2); - assertThat(session.getAttribute("a")).isEqualTo("b"); - assertThat(session.getAttribute("1")).isEqualTo("2"); - } + @Configuration + static class Config { + @Bean + public JedisConnectionFactory connectionFactory() throws Exception { + JedisConnectionFactory factory = new JedisConnectionFactory(); + factory.setPort(getPort()); + factory.setUsePool(false); + return factory; + } - @Configuration - static class Config { - @Bean - public JedisConnectionFactory connectionFactory() throws Exception { - JedisConnectionFactory factory = new JedisConnectionFactory(); - factory.setPort(getPort()); - factory.setUsePool(false); - return factory; - } + @Bean + public RedisTemplate redisTemplate(RedisConnectionFactory connectionFactory) { + RedisTemplate template = new RedisTemplate(); + template.setKeySerializer(new StringRedisSerializer()); + template.setHashKeySerializer(new StringRedisSerializer()); + template.setConnectionFactory(connectionFactory); + return template; + } - @Bean - public RedisTemplate redisTemplate(RedisConnectionFactory connectionFactory) { - RedisTemplate template = new RedisTemplate(); - template.setKeySerializer(new StringRedisSerializer()); - template.setHashKeySerializer(new StringRedisSerializer()); - template.setConnectionFactory(connectionFactory); - return template; - } + @Bean + public RedisOperationsSessionRepository sessionRepository(RedisTemplate redisTemplate) { + return new RedisOperationsSessionRepository(redisTemplate); + } + } - @Bean - public RedisOperationsSessionRepository sessionRepository(RedisTemplate redisTemplate) { - return new RedisOperationsSessionRepository(redisTemplate); - } - } + private static Integer availablePort; - private static Integer availablePort; - - private static int getPort() throws IOException { - if(availablePort == null) { - ServerSocket socket = new ServerSocket(0); - availablePort = socket.getLocalPort(); - socket.close(); - } - return availablePort; - } + private static int getPort() throws IOException { + if(availablePort == null) { + ServerSocket socket = new ServerSocket(0); + availablePort = socket.getLocalPort(); + socket.close(); + } + return availablePort; + } } \ No newline at end of file diff --git a/spring-session/src/main/java/org/springframework/session/Session.java b/spring-session/src/main/java/org/springframework/session/Session.java index ed97243..d256be0 100644 --- a/spring-session/src/main/java/org/springframework/session/Session.java +++ b/spring-session/src/main/java/org/springframework/session/Session.java @@ -15,7 +15,6 @@ */ package org.springframework.session; -import java.io.Serializable; import java.util.Set; /** diff --git a/spring-session/src/main/java/org/springframework/session/data/redis/RedisOperationsSessionRepository.java b/spring-session/src/main/java/org/springframework/session/data/redis/RedisOperationsSessionRepository.java index 2ebb226..49d1ff7 100644 --- a/spring-session/src/main/java/org/springframework/session/data/redis/RedisOperationsSessionRepository.java +++ b/spring-session/src/main/java/org/springframework/session/data/redis/RedisOperationsSessionRepository.java @@ -233,7 +233,7 @@ public class RedisOperationsSessionRepository implements SessionRepository delta = new HashMap(); diff --git a/spring-session/src/main/java/org/springframework/session/web/http/SessionRepositoryFilter.java b/spring-session/src/main/java/org/springframework/session/web/http/SessionRepositoryFilter.java index 57ba2d6..6d5436b 100644 --- a/spring-session/src/main/java/org/springframework/session/web/http/SessionRepositoryFilter.java +++ b/spring-session/src/main/java/org/springframework/session/web/http/SessionRepositoryFilter.java @@ -23,6 +23,7 @@ import javax.servlet.FilterChain; import javax.servlet.ServletContext; import javax.servlet.ServletException; import javax.servlet.http.*; + import java.io.IOException; import java.util.Collections; import java.util.Enumeration; @@ -51,282 +52,284 @@ import java.util.Set; * @author Rob Winch */ public class SessionRepositoryFilter extends OncePerRequestFilter { - private final SessionRepository sessionRepository; + private final SessionRepository sessionRepository; - private HttpSessionStrategy httpSessionStrategy = new CookieHttpSessionStrategy(); + private HttpSessionStrategy httpSessionStrategy = new CookieHttpSessionStrategy(); - /** - * Creates a new instance - * - * @param sessionRepository the SessionRepository to use. Cannot be null. - */ - public SessionRepositoryFilter(SessionRepository sessionRepository) { - Assert.notNull(sessionRepository, "SessionRepository cannot be null"); - this.sessionRepository = sessionRepository; - } + /** + * Creates a new instance + * + * @param sessionRepository the SessionRepository to use. Cannot be null. + */ + public SessionRepositoryFilter(SessionRepository sessionRepository) { + Assert.notNull(sessionRepository, "SessionRepository cannot be null"); + this.sessionRepository = sessionRepository; + } - /** - * Sets the {@link HttpSessionStrategy} to be used. The default is a {@link CookieHttpSessionStrategy}. - * - * @param httpSessionStrategy the {@link HttpSessionStrategy} to use. Cannot be null. - */ - public void setHttpSessionStrategy(HttpSessionStrategy httpSessionStrategy) { - Assert.notNull(httpSessionStrategy,"httpSessionIdStrategy cannot be null"); - this.httpSessionStrategy = httpSessionStrategy; - } + /** + * Sets the {@link HttpSessionStrategy} to be used. The default is a {@link CookieHttpSessionStrategy}. + * + * @param httpSessionStrategy the {@link HttpSessionStrategy} to use. Cannot be null. + */ + public void setHttpSessionStrategy(HttpSessionStrategy httpSessionStrategy) { + Assert.notNull(httpSessionStrategy,"httpSessionIdStrategy cannot be null"); + this.httpSessionStrategy = httpSessionStrategy; + } - protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException { - SessionRepositoryRequestWrapper wrappedRequest = new SessionRepositoryRequestWrapper(request, response); - SessionRepositoryResponseWrapper wrappedResponse = new SessionRepositoryResponseWrapper(wrappedRequest,response); - try { - filterChain.doFilter(wrappedRequest, wrappedResponse); - } finally { - wrappedRequest.commitSession(); - } - } + protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException { + SessionRepositoryRequestWrapper wrappedRequest = new SessionRepositoryRequestWrapper(request, response); + SessionRepositoryResponseWrapper wrappedResponse = new SessionRepositoryResponseWrapper(wrappedRequest,response); + try { + filterChain.doFilter(wrappedRequest, wrappedResponse); + } finally { + wrappedRequest.commitSession(); + } + } - /** - * Allows ensuring that the session is saved if the response is committed. - * - * @author Rob Winch - * @since 1.0 - */ - private final class SessionRepositoryResponseWrapper extends OnCommittedResponseWrapper { + /** + * Allows ensuring that the session is saved if the response is committed. + * + * @author Rob Winch + * @since 1.0 + */ + private final class SessionRepositoryResponseWrapper extends OnCommittedResponseWrapper { - private final SessionRepositoryRequestWrapper request; + private final SessionRepositoryRequestWrapper request; - /** - * @param response the response to be wrapped - */ - public SessionRepositoryResponseWrapper(SessionRepositoryRequestWrapper request, HttpServletResponse response) { - super(response); - Assert.notNull(request, "SessionRepositoryRequestWrapper cannot be null"); - this.request = request; - } + /** + * @param response the response to be wrapped + */ + public SessionRepositoryResponseWrapper(SessionRepositoryRequestWrapper request, HttpServletResponse response) { + super(response); + Assert.notNull(request, "SessionRepositoryRequestWrapper cannot be null"); + this.request = request; + } - @Override - protected void onResponseCommitted() { - request.commitSession(); - } - } + @Override + protected void onResponseCommitted() { + request.commitSession(); + } + } - /** - * A {@link javax.servlet.http.HttpServletRequest} that retrieves the {@link javax.servlet.http.HttpSession} using a - * {@link org.springframework.session.SessionRepository}. - * - * @author Rob Winch - * @since 1.0 - */ - private final class SessionRepositoryRequestWrapper extends HttpServletRequestWrapper { - private HttpSessionWrapper currentSession; - private boolean requestedValidSession; - private final HttpServletResponse response; + /** + * A {@link javax.servlet.http.HttpServletRequest} that retrieves the {@link javax.servlet.http.HttpSession} using a + * {@link org.springframework.session.SessionRepository}. + * + * @author Rob Winch + * @since 1.0 + */ + private final class SessionRepositoryRequestWrapper extends HttpServletRequestWrapper { + private HttpSessionWrapper currentSession; + private boolean requestedValidSession; + private final HttpServletResponse response; - private SessionRepositoryRequestWrapper(HttpServletRequest request, HttpServletResponse response) { - super(request); - this.response = response; - } + private SessionRepositoryRequestWrapper(HttpServletRequest request, HttpServletResponse response) { + super(request); + this.response = response; + } - /** - * Uses the HttpSessionStrategy to write the session id tot he response and persist the Session. - */ - private void commitSession() { - HttpSessionWrapper wrappedSession = currentSession; - if(wrappedSession == null) { - if(isInvalidateClientSession()) { - httpSessionStrategy.onInvalidateSession(this, response); - } - } else { - S session = wrappedSession.session; - sessionRepository.save(session); - httpSessionStrategy.onNewSession(session, this, response); - } - } + /** + * Uses the HttpSessionStrategy to write the session id tot he response and persist the Session. + */ + private void commitSession() { + HttpSessionWrapper wrappedSession = currentSession; + if(wrappedSession == null) { + if(isInvalidateClientSession()) { + httpSessionStrategy.onInvalidateSession(this, response); + } + } else { + S session = wrappedSession.session; + sessionRepository.save(session); + httpSessionStrategy.onNewSession(session, this, response); + } + } - private boolean isInvalidateClientSession() { - return currentSession == null && requestedValidSession; - } + private boolean isInvalidateClientSession() { + return currentSession == null && requestedValidSession; + } - @Override - public HttpSession getSession(boolean create) { - if(currentSession != null) { - return currentSession; - } - String requestedSessionId = getRequestedSessionId(); - if(requestedSessionId != null) { - S session = sessionRepository.getSession(requestedSessionId); - if(session != null) { - this.requestedValidSession = true; - currentSession = new HttpSessionWrapper(session, getServletContext()); - currentSession.setNew(false); - return currentSession; - } - } - if(!create) { - return null; - } - S session = sessionRepository.createSession(); - currentSession = new HttpSessionWrapper(session, getServletContext()); - return currentSession; - } + @Override + public HttpSession getSession(boolean create) { + if(currentSession != null) { + return currentSession; + } + String requestedSessionId = getRequestedSessionId(); + if(requestedSessionId != null) { + S session = sessionRepository.getSession(requestedSessionId); + if(session != null) { + this.requestedValidSession = true; + currentSession = new HttpSessionWrapper(session, getServletContext()); + currentSession.setNew(false); + return currentSession; + } + } + if(!create) { + return null; + } + S session = sessionRepository.createSession(); + currentSession = new HttpSessionWrapper(session, getServletContext()); + return currentSession; + } - @Override - public HttpSession getSession() { - return getSession(true); - } + @Override + public HttpSession getSession() { + return getSession(true); + } - @Override - public String getRequestedSessionId() { - return httpSessionStrategy.getRequestedSessionId(this); - } + @Override + public String getRequestedSessionId() { + return httpSessionStrategy.getRequestedSessionId(this); + } - /** - * Allows creating an HttpSession from a Session instance. - * - * @author Rob Winch - * @since 1.0 - */ - private final class HttpSessionWrapper implements HttpSession { - private final S session; - private final ServletContext servletContext; - private boolean invalidated; - private boolean old; + /** + * Allows creating an HttpSession from a Session instance. + * + * @author Rob Winch + * @since 1.0 + */ + private final class HttpSessionWrapper implements HttpSession { + private final S session; + private final ServletContext servletContext; + private boolean invalidated; + private boolean old; - public HttpSessionWrapper(S session, ServletContext servletContext) { - this.session = session; - this.servletContext = servletContext; - } + public HttpSessionWrapper(S session, ServletContext servletContext) { + this.session = session; + this.servletContext = servletContext; + } - @Override - public long getCreationTime() { - checkState(); - return session.getCreationTime(); - } + @Override + public long getCreationTime() { + checkState(); + return session.getCreationTime(); + } - @Override - public String getId() { - return session.getId(); - } + @Override + public String getId() { + return session.getId(); + } - @Override - public long getLastAccessedTime() { - checkState(); - return session.getLastAccessedTime(); - } + @Override + public long getLastAccessedTime() { + checkState(); + return session.getLastAccessedTime(); + } - @Override - public ServletContext getServletContext() { - return servletContext; - } + @Override + public ServletContext getServletContext() { + return servletContext; + } - @Override - public void setMaxInactiveInterval(int interval) { - session.setMaxInactiveInterval(interval); - } + @Override + public void setMaxInactiveInterval(int interval) { + session.setMaxInactiveInterval(interval); + } - @Override - public int getMaxInactiveInterval() { - return session.getMaxInactiveInterval(); - } + @Override + public int getMaxInactiveInterval() { + return session.getMaxInactiveInterval(); + } - @Override - public HttpSessionContext getSessionContext() { - return NOOP_SESSION_CONTEXT; - } + @Override + @SuppressWarnings("deprecation") + public HttpSessionContext getSessionContext() { + return NOOP_SESSION_CONTEXT; + } - @Override - public Object getAttribute(String name) { - checkState(); - return session.getAttribute(name); - } + @Override + public Object getAttribute(String name) { + checkState(); + return session.getAttribute(name); + } - @Override - public Object getValue(String name) { - return getAttribute(name); - } + @Override + public Object getValue(String name) { + return getAttribute(name); + } - @Override - public Enumeration getAttributeNames() { - checkState(); - return Collections.enumeration(session.getAttributeNames()); - } + @Override + public Enumeration getAttributeNames() { + checkState(); + return Collections.enumeration(session.getAttributeNames()); + } - @Override - public String[] getValueNames() { - checkState(); - Set attrs = session.getAttributeNames(); - return attrs.toArray(new String[0]); - } + @Override + public String[] getValueNames() { + checkState(); + Set attrs = session.getAttributeNames(); + return attrs.toArray(new String[0]); + } - @Override - public void setAttribute(String name, Object value) { - checkState(); - session.setAttribute(name, value); - } + @Override + public void setAttribute(String name, Object value) { + checkState(); + session.setAttribute(name, value); + } - @Override - public void putValue(String name, Object value) { - setAttribute(name, value); - } + @Override + public void putValue(String name, Object value) { + setAttribute(name, value); + } - @Override - public void removeAttribute(String name) { - checkState(); - session.removeAttribute(name); - } + @Override + public void removeAttribute(String name) { + checkState(); + session.removeAttribute(name); + } - @Override - public void removeValue(String name) { - removeAttribute(name); - } + @Override + public void removeValue(String name) { + removeAttribute(name); + } - @Override - public void invalidate() { - checkState(); - this.invalidated = true; - currentSession = null; - sessionRepository.delete(getId()); - } + @Override + public void invalidate() { + checkState(); + this.invalidated = true; + currentSession = null; + sessionRepository.delete(getId()); + } - public void setNew(boolean isNew) { - this.old = !isNew; - } + public void setNew(boolean isNew) { + this.old = !isNew; + } - @Override - public boolean isNew() { - checkState(); - return !old; - } + @Override + public boolean isNew() { + checkState(); + return !old; + } - private void checkState() { - if(invalidated) { - throw new IllegalStateException("The HttpSession has already be invalidated."); - } - } - } - } + private void checkState() { + if(invalidated) { + throw new IllegalStateException("The HttpSession has already be invalidated."); + } + } + } + } - private static final HttpSessionContext NOOP_SESSION_CONTEXT = new HttpSessionContext() { - @Override - public HttpSession getSession(String sessionId) { - return null; - } + @SuppressWarnings("deprecation") + private static final HttpSessionContext NOOP_SESSION_CONTEXT = new HttpSessionContext() { + @Override + public HttpSession getSession(String sessionId) { + return null; + } - @Override - public Enumeration getIds() { - return EMPTY_ENUMERATION; - } - }; + @Override + public Enumeration getIds() { + return EMPTY_ENUMERATION; + } + }; - private static final Enumeration EMPTY_ENUMERATION = new Enumeration() { - @Override - public boolean hasMoreElements() { - return false; - } + private static final Enumeration EMPTY_ENUMERATION = new Enumeration() { + @Override + public boolean hasMoreElements() { + return false; + } - @Override - public String nextElement() { - throw new NoSuchElementException("a"); - } - }; + @Override + public String nextElement() { + throw new NoSuchElementException("a"); + } + }; } diff --git a/spring-session/src/test/java/org/springframework/session/data/redis/RedisOperationsSessionRepositoryTests.java b/spring-session/src/test/java/org/springframework/session/data/redis/RedisOperationsSessionRepositoryTests.java index 0cab7d1..9b6c52c 100644 --- a/spring-session/src/test/java/org/springframework/session/data/redis/RedisOperationsSessionRepositoryTests.java +++ b/spring-session/src/test/java/org/springframework/session/data/redis/RedisOperationsSessionRepositoryTests.java @@ -19,7 +19,6 @@ import org.springframework.data.redis.core.BoundHashOperations; import org.springframework.data.redis.core.RedisOperations; import org.springframework.session.ExpiringSession; import org.springframework.session.MapSession; -import org.springframework.session.Session; import org.springframework.session.data.redis.RedisOperationsSessionRepository.RedisSession; @@ -122,6 +121,7 @@ public class RedisOperationsSessionRepositoryTests { } @Test + @SuppressWarnings("unchecked") public void getSessionNotFound() { String id = "abc"; when(redisOperations.boundHashOps(getKey(id))).thenReturn(boundHashOperations); @@ -131,6 +131,7 @@ public class RedisOperationsSessionRepositoryTests { } @Test + @SuppressWarnings({ "rawtypes", "unchecked" }) public void getSessionFound() { String attrName = "attrName"; MapSession expected = new MapSession(); @@ -155,6 +156,7 @@ public class RedisOperationsSessionRepositoryTests { } + @SuppressWarnings("rawtypes") private Map map(Object...objects) { Map result = new HashMap(); if(objects == null) { diff --git a/spring-session/src/test/java/org/springframework/session/web/http/OncePerRequestFilterTests.java b/spring-session/src/test/java/org/springframework/session/web/http/OncePerRequestFilterTests.java index 4f1f2f0..b8e5ac7 100644 --- a/spring-session/src/test/java/org/springframework/session/web/http/OncePerRequestFilterTests.java +++ b/spring-session/src/test/java/org/springframework/session/web/http/OncePerRequestFilterTests.java @@ -12,6 +12,7 @@ import javax.servlet.ServletException; import javax.servlet.http.HttpServlet; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; + import java.io.IOException; import java.util.ArrayList; import java.util.List; @@ -19,56 +20,57 @@ import java.util.List; import static org.fest.assertions.Assertions.*; public class OncePerRequestFilterTests { - private MockHttpServletRequest request; - private MockHttpServletResponse response; - private MockFilterChain chain; - private OncePerRequestFilter filter; - private HttpServlet servlet; + private MockHttpServletRequest request; + private MockHttpServletResponse response; + private MockFilterChain chain; + private OncePerRequestFilter filter; + private HttpServlet servlet; - private List invocations; + private List invocations; - @Before - public void setup() { - servlet = new HttpServlet() {}; - request = new MockHttpServletRequest(); - response = new MockHttpServletResponse(); - chain = new MockFilterChain(); - invocations = new ArrayList(); - filter = new OncePerRequestFilter() { - @Override - protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException { - invocations.add(this); - filterChain.doFilter(request, response); - } - }; - } + @Before + @SuppressWarnings("serial") + public void setup() { + servlet = new HttpServlet() {}; + request = new MockHttpServletRequest(); + response = new MockHttpServletResponse(); + chain = new MockFilterChain(); + invocations = new ArrayList(); + filter = new OncePerRequestFilter() { + @Override + protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException { + invocations.add(this); + filterChain.doFilter(request, response); + } + }; + } - @Test - public void doFilterOnce() throws ServletException, IOException { - filter.doFilter(request, response, chain); + @Test + public void doFilterOnce() throws ServletException, IOException { + filter.doFilter(request, response, chain); - assertThat(invocations).containsOnly(filter); - } + assertThat(invocations).containsOnly(filter); + } - @Test - public void doFilterMultiOnlyIvokesOnce() throws ServletException, IOException { - filter.doFilter(request, response, new MockFilterChain(servlet, filter)); + @Test + public void doFilterMultiOnlyIvokesOnce() throws ServletException, IOException { + filter.doFilter(request, response, new MockFilterChain(servlet, filter)); - assertThat(invocations).containsOnly(filter); - } + assertThat(invocations).containsOnly(filter); + } - @Test - public void doFilterOtherSubclassInvoked() throws ServletException, IOException { - OncePerRequestFilter filter2 = new OncePerRequestFilter() { - @Override - protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException { - invocations.add(this); - filterChain.doFilter(request, response); - } - }; - filter.doFilter(request, response, new MockFilterChain(servlet, filter2)); + @Test + public void doFilterOtherSubclassInvoked() throws ServletException, IOException { + OncePerRequestFilter filter2 = new OncePerRequestFilter() { + @Override + protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException { + invocations.add(this); + filterChain.doFilter(request, response); + } + }; + filter.doFilter(request, response, new MockFilterChain(servlet, filter2)); - assertThat(invocations).containsOnly(filter, filter2); - } + assertThat(invocations).containsOnly(filter, filter2); + } } \ No newline at end of file diff --git a/spring-session/src/test/java/org/springframework/session/web/http/SessionRepositoryFilterTests.java b/spring-session/src/test/java/org/springframework/session/web/http/SessionRepositoryFilterTests.java index b24d96b..0e21b08 100644 --- a/spring-session/src/test/java/org/springframework/session/web/http/SessionRepositoryFilterTests.java +++ b/spring-session/src/test/java/org/springframework/session/web/http/SessionRepositoryFilterTests.java @@ -1,884 +1,888 @@ package org.springframework.session.web.http; +import static org.fest.assertions.Assertions.assertThat; +import static org.junit.Assert.fail; + +import java.io.IOException; +import java.util.Arrays; +import java.util.Collections; +import java.util.NoSuchElementException; + +import javax.servlet.FilterChain; +import javax.servlet.ServletContext; +import javax.servlet.ServletException; +import javax.servlet.http.Cookie; +import javax.servlet.http.HttpServlet; +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; +import javax.servlet.http.HttpSession; +import javax.servlet.http.HttpSessionContext; + import org.junit.Before; import org.junit.Test; import org.springframework.mock.web.MockFilterChain; import org.springframework.mock.web.MockHttpServletRequest; import org.springframework.mock.web.MockHttpServletResponse; +import org.springframework.session.ExpiringSession; import org.springframework.session.MapSessionRepository; import org.springframework.session.SessionRepository; -import org.springframework.session.web.http.OncePerRequestFilter; -import org.springframework.session.web.http.SessionRepositoryFilter; - -import javax.servlet.FilterChain; -import javax.servlet.ServletContext; -import javax.servlet.ServletException; -import javax.servlet.http.*; -import java.io.IOException; -import java.util.Arrays; -import java.util.Collections; -import java.util.NoSuchElementException; - -import static org.fest.assertions.Assertions.assertThat; -import static org.junit.Assert.fail; - -public class SessionRepositoryFilterTests { - private final static String SESSION_ATTR_NAME = HttpSession.class.getName(); - - private SessionRepository sessionRepository; - - private SessionRepositoryFilter filter; - - private MockHttpServletRequest request; - - private MockHttpServletResponse response; - - private MockFilterChain chain; - - @Before - public void setup() throws Exception { - sessionRepository = new MapSessionRepository(); - filter = new SessionRepositoryFilter(sessionRepository); - request = new MockHttpServletRequest(); - response = new MockHttpServletResponse(); - chain = new MockFilterChain(); - } - - @Test - public void doFilterCreateDate() throws Exception { - final String CREATE_ATTR = "create"; - doFilter(new DoInFilter() { - @Override - public void doFilter(HttpServletRequest wrappedRequest) { - long creationTime = wrappedRequest.getSession().getCreationTime(); - long now = System.currentTimeMillis(); - assertThat(now - creationTime).isGreaterThanOrEqualTo(0).isLessThan(5000); - request.setAttribute(CREATE_ATTR, creationTime); - } - }); - - final long expectedCreationTime = (Long) request.getAttribute(CREATE_ATTR); - Thread.sleep(50L); - setupSession(); - - doFilter(new DoInFilter() { - @Override - public void doFilter(HttpServletRequest wrappedRequest) { - long creationTime = wrappedRequest.getSession().getCreationTime(); - - assertThat(creationTime).isEqualTo(expectedCreationTime); - } - }); - } - - @Test - public void doFilterLastAccessedTime() throws Exception { - final String ACCESS_ATTR = "create"; - doFilter(new DoInFilter() { - @Override - public void doFilter(HttpServletRequest wrappedRequest) { - long lastAccessed = wrappedRequest.getSession().getLastAccessedTime(); - assertThat(lastAccessed).isEqualTo(wrappedRequest.getSession().getCreationTime()); - request.setAttribute(ACCESS_ATTR, lastAccessed); - } - }); - - final long creationTime = (Long) request.getAttribute(ACCESS_ATTR); - Thread.sleep(10L); - setupSession(); - - doFilter(new DoInFilter() { - @Override - public void doFilter(HttpServletRequest wrappedRequest) { - long lastAccessed = wrappedRequest.getSession().getLastAccessedTime(); - - assertThat(lastAccessed).isGreaterThan(wrappedRequest.getSession().getCreationTime()); - } - }); - } - - @Test - public void doFilterId() throws Exception { - final String ID_ATTR = "create"; - doFilter(new DoInFilter() { - @Override - public void doFilter(HttpServletRequest wrappedRequest) { - String id = wrappedRequest.getSession().getId(); - assertThat(id).isNotNull(); - assertThat(wrappedRequest.getSession().getId()).isEqualTo(id); - request.setAttribute(ID_ATTR, id); - } - }); - - final String id = (String) request.getAttribute(ID_ATTR); - assertThat(getSessionCookie().getValue()).isEqualTo(id); - setSessionCookie(id); - - doFilter(new DoInFilter() { - @Override - public void doFilter(HttpServletRequest wrappedRequest) { - assertThat(wrappedRequest.getSession().getId()).isEqualTo(id); - } - }); - } - - @Test - public void doFilterIdChanges() throws Exception { - final String ID_ATTR = "create"; - doFilter(new DoInFilter() { - @Override - public void doFilter(HttpServletRequest wrappedRequest) { - String id = wrappedRequest.getSession().getId(); - request.setAttribute(ID_ATTR, id); - } - }); - - final String id = (String) request.getAttribute(ID_ATTR); - - doFilter(new DoInFilter() { - @Override - public void doFilter(HttpServletRequest wrappedRequest) { - assertThat(wrappedRequest.getSession().getId()).isNotEqualTo(id); - } - }); - } - - @Test - public void doFilterServletContext() throws Exception { - doFilter(new DoInFilter() { - @Override - public void doFilter(HttpServletRequest wrappedRequest) { - ServletContext context = wrappedRequest.getSession().getServletContext(); - assertThat(context).isSameAs(wrappedRequest.getServletContext()); - } - }); - } - - @Test - public void doFilterMaxInactiveIntervalDefault() throws Exception { - doFilter(new DoInFilter() { - @Override - public void doFilter(HttpServletRequest wrappedRequest) { - int interval = wrappedRequest.getSession().getMaxInactiveInterval(); - assertThat(interval).isEqualTo(1800); // 30 minute default (same as Tomcat) - } - }); - } - - @Test - public void doFilterMaxInactiveIntervalOverride() throws Exception { - final int interval = 600; - doFilter(new DoInFilter() { - @Override - public void doFilter(HttpServletRequest wrappedRequest) { - wrappedRequest.getSession().setMaxInactiveInterval(interval); - assertThat(wrappedRequest.getSession().getMaxInactiveInterval()).isEqualTo(interval); - } - }); - - setupSession(); - - doFilter(new DoInFilter() { - @Override - public void doFilter(HttpServletRequest wrappedRequest) { - assertThat(wrappedRequest.getSession().getMaxInactiveInterval()).isEqualTo(interval); - } - }); - } - - @Test - public void doFilterAttribute() throws Exception { - final String ATTR = "ATTR"; - final String VALUE = "VALUE"; - doFilter(new DoInFilter() { - @Override - public void doFilter(HttpServletRequest wrappedRequest) { - wrappedRequest.getSession().setAttribute(ATTR, VALUE); - assertThat(wrappedRequest.getSession().getAttribute(ATTR)).isEqualTo(VALUE); - assertThat(Collections.list(wrappedRequest.getSession().getAttributeNames())).containsOnly(ATTR); - } - }); - - setupSession(); - - doFilter(new DoInFilter() { - @Override - public void doFilter(HttpServletRequest wrappedRequest) { - assertThat(wrappedRequest.getSession().getAttribute(ATTR)).isEqualTo(VALUE); - assertThat(Collections.list(wrappedRequest.getSession().getAttributeNames())).containsOnly(ATTR); - } - }); - - setupSession(); - - doFilter(new DoInFilter() { - @Override - public void doFilter(HttpServletRequest wrappedRequest) { - assertThat(wrappedRequest.getSession().getAttribute(ATTR)).isEqualTo(VALUE); - - wrappedRequest.getSession().removeAttribute(ATTR); - - assertThat(wrappedRequest.getSession().getAttribute(ATTR)).isNull(); - } - }); - - setupSession(); - - doFilter(new DoInFilter() { - @Override - public void doFilter(HttpServletRequest wrappedRequest) { - assertThat(wrappedRequest.getSession().getAttribute(ATTR)).isNull(); - } - }); - } - - @Test - public void doFilterValue() throws Exception { - final String ATTR = "ATTR"; - final String VALUE = "VALUE"; - doFilter(new DoInFilter() { - @Override - public void doFilter(HttpServletRequest wrappedRequest) { - wrappedRequest.getSession().putValue(ATTR, VALUE); - assertThat(wrappedRequest.getSession().getValue(ATTR)).isEqualTo(VALUE); - assertThat(Arrays.asList(wrappedRequest.getSession().getValueNames())).containsOnly(ATTR); - } - }); - - setupSession(); - - doFilter(new DoInFilter() { - @Override - public void doFilter(HttpServletRequest wrappedRequest) { - assertThat(wrappedRequest.getSession().getValue(ATTR)).isEqualTo(VALUE); - assertThat(Arrays.asList(wrappedRequest.getSession().getValueNames())).containsOnly(ATTR); - } - }); - - setupSession(); - - doFilter(new DoInFilter() { - @Override - public void doFilter(HttpServletRequest wrappedRequest) { - assertThat(wrappedRequest.getSession().getValue(ATTR)).isEqualTo(VALUE); - - wrappedRequest.getSession().removeValue(ATTR); - - assertThat(wrappedRequest.getSession().getValue(ATTR)).isNull(); - } - }); - - setupSession(); - - doFilter(new DoInFilter() { - @Override - public void doFilter(HttpServletRequest wrappedRequest) { - assertThat(wrappedRequest.getSession().getValue(ATTR)).isNull(); - } - }); - } - - @Test - public void doFilterIsNewTrue() throws Exception { - doFilter(new DoInFilter() { - @Override - public void doFilter(HttpServletRequest wrappedRequest) { - assertThat(wrappedRequest.getSession().isNew()).isTrue(); - assertThat(wrappedRequest.getSession().isNew()).isTrue(); - } - }); - } - - @Test - public void doFilterIsNewFalse() throws Exception { - doFilter(new DoInFilter() { - @Override - public void doFilter(HttpServletRequest wrappedRequest) { - wrappedRequest.getSession(); - } - }); - - setupSession(); - - doFilter(new DoInFilter() { - @Override - public void doFilter(HttpServletRequest wrappedRequest) { - assertThat(wrappedRequest.getSession().isNew()).isFalse(); - } - }); - } - - @Test - public void doFilterGetSessionNew() throws Exception { - doFilter(new DoInFilter() { - @Override - public void doFilter(HttpServletRequest wrappedRequest) { - wrappedRequest.getSession(); - } - }); - - assertNewSession(); - } - - @Test - public void doFilterGetSessionTrueNew() throws Exception { - doFilter(new DoInFilter() { - @Override - public void doFilter(HttpServletRequest wrappedRequest) { - wrappedRequest.getSession(true); - } - }); - - assertNewSession(); - } - - @Test - public void doFilterGetSessionFalseNew() throws Exception { - doFilter(new DoInFilter() { - @Override - public void doFilter(HttpServletRequest wrappedRequest) { - wrappedRequest.getSession(false); - } - }); - - assertNoSession(); - } - - @Test - public void doFilterGetSessionGetSessionFalse() throws Exception { - doFilter(new DoInFilter() { - @Override - public void doFilter(HttpServletRequest wrappedRequest) { - wrappedRequest.getSession(); - } - }); - - setupSession(); - - doFilter(new DoInFilter() { - @Override - public void doFilter(HttpServletRequest wrappedRequest) { - assertThat(wrappedRequest.getSession(false)).isNotNull(); - } - }); - } - - @Test - public void doFilterCookieSecuritySettings() throws Exception { - request.setSecure(true); - doFilter(new DoInFilter() { - @Override - public void doFilter(HttpServletRequest wrappedRequest) { - wrappedRequest.getSession(); - } - }); - - Cookie session = getSessionCookie(); - assertThat(session.isHttpOnly()).describedAs("Session Cookie should be HttpOnly").isTrue(); - assertThat(session.getSecure()).describedAs("Session Cookie should be marked as Secure").isTrue(); - } - - @Test - public void doFilterSessionContext() throws Exception { - doFilter(new DoInFilter() { - @Override - public void doFilter(HttpServletRequest wrappedRequest) { - HttpSessionContext sessionContext = wrappedRequest.getSession().getSessionContext(); - assertThat(sessionContext).isNotNull(); - assertThat(sessionContext.getSession("a")).isNull(); - assertThat(sessionContext.getIds()).isNotNull(); - assertThat(sessionContext.getIds().hasMoreElements()).isFalse(); - - try { - sessionContext.getIds().nextElement(); - fail("Expected Exception"); - } catch(NoSuchElementException success) {} - } - }); - } - - - - // --- saving - - @Test - public void doFilterGetAttr() throws Exception { - final String ATTR_NAME = "attr"; - final String ATTR_VALUE = "value"; - final String ATTR_NAME2 = "attr2"; - final String ATTR_VALUE2 = "value2"; - - doFilter(new DoInFilter() { - @Override - public void doFilter(HttpServletRequest wrappedRequest) { - wrappedRequest.getSession().setAttribute(ATTR_NAME, ATTR_VALUE); - wrappedRequest.getSession().setAttribute(ATTR_NAME2, ATTR_VALUE2); - } - }); - - assertNewSession(); - - setupSession(); - - doFilter(new DoInFilter() { - @Override - public void doFilter(HttpServletRequest wrappedRequest) { - assertThat(wrappedRequest.getSession().getAttribute(ATTR_NAME)).isEqualTo(ATTR_VALUE); - assertThat(wrappedRequest.getSession().getAttribute(ATTR_NAME2)).isEqualTo(ATTR_VALUE2); - } - }); - } - - // --- invalidate - - @Test - public void doFilterInvalidateInvalidateIllegalState() throws Exception { - doFilter(new DoInFilter() { - @Override - public void doFilter(HttpServletRequest wrappedRequest) { - HttpSession session = wrappedRequest.getSession(); - session.invalidate(); - try { - session.invalidate(); - fail("Expected Exception"); - } catch(IllegalStateException success) {} - } - }); - } - - @Test - public void doFilterInvalidateCreationTimeIllegalState() throws Exception { - doFilter(new DoInFilter() { - @Override - public void doFilter(HttpServletRequest wrappedRequest) { - HttpSession session = wrappedRequest.getSession(); - session.invalidate(); - try { - session.getCreationTime(); - fail("Expected Exception"); - } catch(IllegalStateException success) {} - } - }); - } - - @Test - public void doFilterInvalidateAttributeIllegalState() throws Exception { - doFilter(new DoInFilter() { - @Override - public void doFilter(HttpServletRequest wrappedRequest) { - HttpSession session = wrappedRequest.getSession(); - session.invalidate(); - try { - session.getAttribute("attr"); - fail("Expected Exception"); - } catch(IllegalStateException success) {} - } - }); - } - - @Test - public void doFilterInvalidateValueIllegalState() throws Exception { - doFilter(new DoInFilter() { - @Override - public void doFilter(HttpServletRequest wrappedRequest) { - HttpSession session = wrappedRequest.getSession(); - session.invalidate(); - try { - session.getValue("attr"); - fail("Expected Exception"); - } catch(IllegalStateException success) {} - } - }); - } - - @Test - public void doFilterInvalidateAttributeNamesIllegalState() throws Exception { - doFilter(new DoInFilter() { - @Override - public void doFilter(HttpServletRequest wrappedRequest) { - HttpSession session = wrappedRequest.getSession(); - session.invalidate(); - try { - session.getAttributeNames(); - fail("Expected Exception"); - } catch(IllegalStateException success) {} - } - }); - } - - @Test - public void doFilterInvalidateValueNamesIllegalState() throws Exception { - doFilter(new DoInFilter() { - @Override - public void doFilter(HttpServletRequest wrappedRequest) { - HttpSession session = wrappedRequest.getSession(); - session.invalidate(); - try { - session.getValueNames(); - fail("Expected Exception"); - } catch(IllegalStateException success) {} - } - }); - } - - @Test - public void doFilterInvalidateSetAttributeIllegalState() throws Exception { - doFilter(new DoInFilter() { - @Override - public void doFilter(HttpServletRequest wrappedRequest) { - HttpSession session = wrappedRequest.getSession(); - session.invalidate(); - try { - session.setAttribute("a", "b"); - fail("Expected Exception"); - } catch(IllegalStateException success) {} - } - }); - } - - @Test - public void doFilterInvalidatePutValueIllegalState() throws Exception { - doFilter(new DoInFilter() { - @Override - public void doFilter(HttpServletRequest wrappedRequest) { - HttpSession session = wrappedRequest.getSession(); - session.invalidate(); - try { - session.putValue("a", "b"); - fail("Expected Exception"); - } catch(IllegalStateException success) {} - } - }); - } - - @Test - public void doFilterInvalidateRemoveAttributeIllegalState() throws Exception { - doFilter(new DoInFilter() { - @Override - public void doFilter(HttpServletRequest wrappedRequest) { - HttpSession session = wrappedRequest.getSession(); - session.invalidate(); - try { - session.removeAttribute("name"); - fail("Expected Exception"); - } catch(IllegalStateException success) {} - } - }); - } - - @Test - public void doFilterInvalidateRemoveValueIllegalState() throws Exception { - doFilter(new DoInFilter() { - @Override - public void doFilter(HttpServletRequest wrappedRequest) { - HttpSession session = wrappedRequest.getSession(); - session.invalidate(); - try { - session.removeValue("name"); - fail("Expected Exception"); - } catch(IllegalStateException success) {} - } - }); - } - - @Test - public void doFilterInvalidateNewIllegalState() throws Exception { - doFilter(new DoInFilter() { - @Override - public void doFilter(HttpServletRequest wrappedRequest) { - HttpSession session = wrappedRequest.getSession(); - session.invalidate(); - try { - session.isNew(); - fail("Expected Exception"); - } catch(IllegalStateException success) {} - } - }); - } - - @Test - public void doFilterInvalidateLastAccessedTimeIllegalState() throws Exception { - doFilter(new DoInFilter() { - @Override - public void doFilter(HttpServletRequest wrappedRequest) { - HttpSession session = wrappedRequest.getSession(); - session.invalidate(); - try { - session.getLastAccessedTime(); - fail("Expected Exception"); - } catch(IllegalStateException success) {} - } - }); - } - - @Test - public void doFilterInvalidateId() throws Exception { - doFilter(new DoInFilter() { - @Override - public void doFilter(HttpServletRequest wrappedRequest) { - HttpSession session = wrappedRequest.getSession(); - session.invalidate(); - // no exception - session.getId(); - } - }); - } - - @Test - public void doFilterInvalidateServletContext() throws Exception { - doFilter(new DoInFilter() { - @Override - public void doFilter(HttpServletRequest wrappedRequest) { - HttpSession session = wrappedRequest.getSession(); - session.invalidate(); - - // no exception - session.getServletContext(); - } - }); - } - - @Test - public void doFilterInvalidateSessionContext() throws Exception { - doFilter(new DoInFilter() { - @Override - public void doFilter(HttpServletRequest wrappedRequest) { - HttpSession session = wrappedRequest.getSession(); - session.invalidate(); - - // no exception - session.getSessionContext(); - } - }); - } - - @Test - public void doFilterInvalidateMaxInteractiveInterval() throws Exception { - doFilter(new DoInFilter() { - @Override - public void doFilter(HttpServletRequest wrappedRequest) { - HttpSession session = wrappedRequest.getSession(); - session.invalidate(); - - // no exception - session.getMaxInactiveInterval(); - session.setMaxInactiveInterval(3600); - } - }); - } - - @Test - public void doFilterInvalidateAndGetSession() throws Exception { - final String ATTR_NAME = "attr"; - final String ATTR_VALUE = "value"; - final String ATTR_NAME2 = "attr2"; - final String ATTR_VALUE2 = "value2"; - - doFilter(new DoInFilter() { - @Override - public void doFilter(HttpServletRequest wrappedRequest) { - wrappedRequest.getSession().setAttribute(ATTR_NAME, ATTR_VALUE); - wrappedRequest.getSession().invalidate(); - wrappedRequest.getSession().setAttribute(ATTR_NAME2, ATTR_VALUE2); - } - }); - - assertNewSession(); - - setupSession(); - - doFilter(new DoInFilter() { - @Override - public void doFilter(HttpServletRequest wrappedRequest) { - assertThat(wrappedRequest.getSession().getAttribute(ATTR_NAME)).isNull(); - assertThat(wrappedRequest.getSession().getAttribute(ATTR_NAME2)).isEqualTo(ATTR_VALUE2); - } - }); - } - - // --- invalid session ids - - @Test - public void doFilterGetSessionInvalidSessionId() throws Exception { - setSessionCookie("INVALID"); - doFilter(new DoInFilter() { - @Override - public void doFilter(HttpServletRequest wrappedRequest) { - wrappedRequest.getSession(); - } - }); - - assertNewSession(); - } - - @Test - public void doFilterGetSessionTrueInvalidSessionId() throws Exception { - setSessionCookie("INVALID"); - doFilter(new DoInFilter() { - @Override - public void doFilter(HttpServletRequest wrappedRequest) { - wrappedRequest.getSession(true); - } - }); - - assertNewSession(); - } - - @Test - public void doFilterGetSessionFalseInvalidSessionId() throws Exception { - setSessionCookie("INVALID"); - doFilter(new DoInFilter() { - @Override - public void doFilter(HttpServletRequest wrappedRequest) { - wrappedRequest.getSession(false); - } - }); - - assertNoSession(); - } - - // --- commit response saves immediately - - @Test - public void doFilterSendError() throws Exception { - doFilter(new DoInFilter() { - @Override - public void doFilter(HttpServletRequest wrappedRequest, HttpServletResponse wrappedResponse) throws IOException { - String id = wrappedRequest.getSession().getId(); - wrappedResponse.sendError(HttpServletResponse.SC_INTERNAL_SERVER_ERROR); - assertThat(sessionRepository.getSession(id)).isNotNull(); - } - }); - } - - @Test - public void doFilterSendErrorAndMessage() throws Exception { - doFilter(new DoInFilter() { - @Override - public void doFilter(HttpServletRequest wrappedRequest, HttpServletResponse wrappedResponse) throws IOException { - String id = wrappedRequest.getSession().getId(); - wrappedResponse.sendError(HttpServletResponse.SC_INTERNAL_SERVER_ERROR, "Error"); - assertThat(sessionRepository.getSession(id)).isNotNull(); - } - }); - } - - @Test - public void doFilterSendRedirect() throws Exception { - doFilter(new DoInFilter() { - @Override - public void doFilter(HttpServletRequest wrappedRequest, HttpServletResponse wrappedResponse) throws IOException { - String id = wrappedRequest.getSession().getId(); - wrappedResponse.sendRedirect("/"); - assertThat(sessionRepository.getSession(id)).isNotNull(); - } - }); - } - - @Test - public void doFilterFlushBuffer() throws Exception { - doFilter(new DoInFilter() { - @Override - public void doFilter(HttpServletRequest wrappedRequest, HttpServletResponse wrappedResponse) throws IOException { - String id = wrappedRequest.getSession().getId(); - wrappedResponse.flushBuffer(); - assertThat(sessionRepository.getSession(id)).isNotNull(); - } - }); - } - - @Test - public void doFilterOutputFlush() throws Exception { - doFilter(new DoInFilter() { - @Override - public void doFilter(HttpServletRequest wrappedRequest, HttpServletResponse wrappedResponse) throws IOException { - String id = wrappedRequest.getSession().getId(); - wrappedResponse.getOutputStream().flush(); - assertThat(sessionRepository.getSession(id)).isNotNull(); - } - }); - } - - @Test - public void doFilterOutputClose() throws Exception { - doFilter(new DoInFilter() { - @Override - public void doFilter(HttpServletRequest wrappedRequest, HttpServletResponse wrappedResponse) throws IOException { - String id = wrappedRequest.getSession().getId(); - wrappedResponse.getOutputStream().close(); - assertThat(sessionRepository.getSession(id)).isNotNull(); - } - }); - } - - @Test - public void doFilterWriterFlush() throws Exception { - doFilter(new DoInFilter() { - @Override - public void doFilter(HttpServletRequest wrappedRequest, HttpServletResponse wrappedResponse) throws IOException { - String id = wrappedRequest.getSession().getId(); - wrappedResponse.getWriter().flush(); - assertThat(sessionRepository.getSession(id)).isNotNull(); - } - }); - } - - @Test - public void doFilterWriterClose() throws Exception { - doFilter(new DoInFilter() { - @Override - public void doFilter(HttpServletRequest wrappedRequest, HttpServletResponse wrappedResponse) throws IOException { - String id = wrappedRequest.getSession().getId(); - wrappedResponse.getWriter().close(); - assertThat(sessionRepository.getSession(id)).isNotNull(); - } - }); - } - - // --- helper methods - - private void assertNewSession() { - Cookie cookie = getSessionCookie(); - assertThat(cookie).isNotNull(); - assertThat(cookie.getMaxAge()).isEqualTo(-1); - assertThat(cookie.getValue()).isNotEqualTo("INVALID"); - assertThat(cookie.isHttpOnly()).describedAs("Cookie is expected to be HTTP Only").isTrue(); - assertThat(cookie.getSecure()).describedAs("Cookie secured is expected to be " + request.isSecure()).isEqualTo(request.isSecure()); - assertThat(request.getSession(false)).describedAs("The original HttpServletRequest HttpSession should be null").isNull(); - } - - private void assertNoSession() { - Cookie cookie = getSessionCookie(); - assertThat(cookie).isNull(); - assertThat(request.getSession(false)).describedAs("The original HttpServletRequest HttpSession should be null").isNull(); - } - - private Cookie getSessionCookie() { - return response.getCookie("SESSION"); - } - - private void setSessionCookie(String sessionId) { - request.setCookies(new Cookie[]{new Cookie("SESSION", sessionId)}); - } - - private void setupSession() { - setSessionCookie(getSessionCookie().getValue()); - } - - private void doFilter(final DoInFilter doInFilter) throws ServletException, IOException { - chain = new MockFilterChain(new HttpServlet() {}, new OncePerRequestFilter() { - @Override - protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException { - doInFilter.doFilter(request, response); - } - }); - filter.doFilter(request, response, chain); - } - - abstract class DoInFilter { - void doFilter(HttpServletRequest wrappedRequest, HttpServletResponse wrappedResponse) throws ServletException, IOException { - doFilter(wrappedRequest); - } - void doFilter(HttpServletRequest wrappedRequest) {} - } + +@SuppressWarnings("deprecation") +public class SessionRepositoryFilterTests { + private SessionRepository sessionRepository; + + private SessionRepositoryFilter filter; + + private MockHttpServletRequest request; + + private MockHttpServletResponse response; + + private MockFilterChain chain; + + @Before + public void setup() throws Exception { + sessionRepository = new MapSessionRepository(); + filter = new SessionRepositoryFilter(sessionRepository); + request = new MockHttpServletRequest(); + response = new MockHttpServletResponse(); + chain = new MockFilterChain(); + } + + @Test + public void doFilterCreateDate() throws Exception { + final String CREATE_ATTR = "create"; + doFilter(new DoInFilter() { + @Override + public void doFilter(HttpServletRequest wrappedRequest) { + long creationTime = wrappedRequest.getSession().getCreationTime(); + long now = System.currentTimeMillis(); + assertThat(now - creationTime).isGreaterThanOrEqualTo(0).isLessThan(5000); + request.setAttribute(CREATE_ATTR, creationTime); + } + }); + + final long expectedCreationTime = (Long) request.getAttribute(CREATE_ATTR); + Thread.sleep(50L); + setupSession(); + + doFilter(new DoInFilter() { + @Override + public void doFilter(HttpServletRequest wrappedRequest) { + long creationTime = wrappedRequest.getSession().getCreationTime(); + + assertThat(creationTime).isEqualTo(expectedCreationTime); + } + }); + } + + @Test + public void doFilterLastAccessedTime() throws Exception { + final String ACCESS_ATTR = "create"; + doFilter(new DoInFilter() { + @Override + public void doFilter(HttpServletRequest wrappedRequest) { + long lastAccessed = wrappedRequest.getSession().getLastAccessedTime(); + assertThat(lastAccessed).isEqualTo(wrappedRequest.getSession().getCreationTime()); + request.setAttribute(ACCESS_ATTR, lastAccessed); + } + }); + + Thread.sleep(10L); + setupSession(); + + doFilter(new DoInFilter() { + @Override + public void doFilter(HttpServletRequest wrappedRequest) { + long lastAccessed = wrappedRequest.getSession().getLastAccessedTime(); + + assertThat(lastAccessed).isGreaterThan(wrappedRequest.getSession().getCreationTime()); + } + }); + } + + @Test + public void doFilterId() throws Exception { + final String ID_ATTR = "create"; + doFilter(new DoInFilter() { + @Override + public void doFilter(HttpServletRequest wrappedRequest) { + String id = wrappedRequest.getSession().getId(); + assertThat(id).isNotNull(); + assertThat(wrappedRequest.getSession().getId()).isEqualTo(id); + request.setAttribute(ID_ATTR, id); + } + }); + + final String id = (String) request.getAttribute(ID_ATTR); + assertThat(getSessionCookie().getValue()).isEqualTo(id); + setSessionCookie(id); + + doFilter(new DoInFilter() { + @Override + public void doFilter(HttpServletRequest wrappedRequest) { + assertThat(wrappedRequest.getSession().getId()).isEqualTo(id); + } + }); + } + + @Test + public void doFilterIdChanges() throws Exception { + final String ID_ATTR = "create"; + doFilter(new DoInFilter() { + @Override + public void doFilter(HttpServletRequest wrappedRequest) { + String id = wrappedRequest.getSession().getId(); + request.setAttribute(ID_ATTR, id); + } + }); + + final String id = (String) request.getAttribute(ID_ATTR); + + doFilter(new DoInFilter() { + @Override + public void doFilter(HttpServletRequest wrappedRequest) { + assertThat(wrappedRequest.getSession().getId()).isNotEqualTo(id); + } + }); + } + + @Test + public void doFilterServletContext() throws Exception { + doFilter(new DoInFilter() { + @Override + public void doFilter(HttpServletRequest wrappedRequest) { + ServletContext context = wrappedRequest.getSession().getServletContext(); + assertThat(context).isSameAs(wrappedRequest.getServletContext()); + } + }); + } + + @Test + public void doFilterMaxInactiveIntervalDefault() throws Exception { + doFilter(new DoInFilter() { + @Override + public void doFilter(HttpServletRequest wrappedRequest) { + int interval = wrappedRequest.getSession().getMaxInactiveInterval(); + assertThat(interval).isEqualTo(1800); // 30 minute default (same as Tomcat) + } + }); + } + + @Test + public void doFilterMaxInactiveIntervalOverride() throws Exception { + final int interval = 600; + doFilter(new DoInFilter() { + @Override + public void doFilter(HttpServletRequest wrappedRequest) { + wrappedRequest.getSession().setMaxInactiveInterval(interval); + assertThat(wrappedRequest.getSession().getMaxInactiveInterval()).isEqualTo(interval); + } + }); + + setupSession(); + + doFilter(new DoInFilter() { + @Override + public void doFilter(HttpServletRequest wrappedRequest) { + assertThat(wrappedRequest.getSession().getMaxInactiveInterval()).isEqualTo(interval); + } + }); + } + + @Test + public void doFilterAttribute() throws Exception { + final String ATTR = "ATTR"; + final String VALUE = "VALUE"; + doFilter(new DoInFilter() { + @Override + public void doFilter(HttpServletRequest wrappedRequest) { + wrappedRequest.getSession().setAttribute(ATTR, VALUE); + assertThat(wrappedRequest.getSession().getAttribute(ATTR)).isEqualTo(VALUE); + assertThat(Collections.list(wrappedRequest.getSession().getAttributeNames())).containsOnly(ATTR); + } + }); + + setupSession(); + + doFilter(new DoInFilter() { + @Override + public void doFilter(HttpServletRequest wrappedRequest) { + assertThat(wrappedRequest.getSession().getAttribute(ATTR)).isEqualTo(VALUE); + assertThat(Collections.list(wrappedRequest.getSession().getAttributeNames())).containsOnly(ATTR); + } + }); + + setupSession(); + + doFilter(new DoInFilter() { + @Override + public void doFilter(HttpServletRequest wrappedRequest) { + assertThat(wrappedRequest.getSession().getAttribute(ATTR)).isEqualTo(VALUE); + + wrappedRequest.getSession().removeAttribute(ATTR); + + assertThat(wrappedRequest.getSession().getAttribute(ATTR)).isNull(); + } + }); + + setupSession(); + + doFilter(new DoInFilter() { + @Override + public void doFilter(HttpServletRequest wrappedRequest) { + assertThat(wrappedRequest.getSession().getAttribute(ATTR)).isNull(); + } + }); + } + + @Test + public void doFilterValue() throws Exception { + final String ATTR = "ATTR"; + final String VALUE = "VALUE"; + doFilter(new DoInFilter() { + @Override + public void doFilter(HttpServletRequest wrappedRequest) { + wrappedRequest.getSession().putValue(ATTR, VALUE); + assertThat(wrappedRequest.getSession().getValue(ATTR)).isEqualTo(VALUE); + assertThat(Arrays.asList(wrappedRequest.getSession().getValueNames())).containsOnly(ATTR); + } + }); + + setupSession(); + + doFilter(new DoInFilter() { + @Override + public void doFilter(HttpServletRequest wrappedRequest) { + assertThat(wrappedRequest.getSession().getValue(ATTR)).isEqualTo(VALUE); + assertThat(Arrays.asList(wrappedRequest.getSession().getValueNames())).containsOnly(ATTR); + } + }); + + setupSession(); + + doFilter(new DoInFilter() { + @Override + public void doFilter(HttpServletRequest wrappedRequest) { + assertThat(wrappedRequest.getSession().getValue(ATTR)).isEqualTo(VALUE); + + wrappedRequest.getSession().removeValue(ATTR); + + assertThat(wrappedRequest.getSession().getValue(ATTR)).isNull(); + } + }); + + setupSession(); + + doFilter(new DoInFilter() { + @Override + public void doFilter(HttpServletRequest wrappedRequest) { + assertThat(wrappedRequest.getSession().getValue(ATTR)).isNull(); + } + }); + } + + @Test + public void doFilterIsNewTrue() throws Exception { + doFilter(new DoInFilter() { + @Override + public void doFilter(HttpServletRequest wrappedRequest) { + assertThat(wrappedRequest.getSession().isNew()).isTrue(); + assertThat(wrappedRequest.getSession().isNew()).isTrue(); + } + }); + } + + @Test + public void doFilterIsNewFalse() throws Exception { + doFilter(new DoInFilter() { + @Override + public void doFilter(HttpServletRequest wrappedRequest) { + wrappedRequest.getSession(); + } + }); + + setupSession(); + + doFilter(new DoInFilter() { + @Override + public void doFilter(HttpServletRequest wrappedRequest) { + assertThat(wrappedRequest.getSession().isNew()).isFalse(); + } + }); + } + + @Test + public void doFilterGetSessionNew() throws Exception { + doFilter(new DoInFilter() { + @Override + public void doFilter(HttpServletRequest wrappedRequest) { + wrappedRequest.getSession(); + } + }); + + assertNewSession(); + } + + @Test + public void doFilterGetSessionTrueNew() throws Exception { + doFilter(new DoInFilter() { + @Override + public void doFilter(HttpServletRequest wrappedRequest) { + wrappedRequest.getSession(true); + } + }); + + assertNewSession(); + } + + @Test + public void doFilterGetSessionFalseNew() throws Exception { + doFilter(new DoInFilter() { + @Override + public void doFilter(HttpServletRequest wrappedRequest) { + wrappedRequest.getSession(false); + } + }); + + assertNoSession(); + } + + @Test + public void doFilterGetSessionGetSessionFalse() throws Exception { + doFilter(new DoInFilter() { + @Override + public void doFilter(HttpServletRequest wrappedRequest) { + wrappedRequest.getSession(); + } + }); + + setupSession(); + + doFilter(new DoInFilter() { + @Override + public void doFilter(HttpServletRequest wrappedRequest) { + assertThat(wrappedRequest.getSession(false)).isNotNull(); + } + }); + } + + @Test + public void doFilterCookieSecuritySettings() throws Exception { + request.setSecure(true); + doFilter(new DoInFilter() { + @Override + public void doFilter(HttpServletRequest wrappedRequest) { + wrappedRequest.getSession(); + } + }); + + Cookie session = getSessionCookie(); + assertThat(session.isHttpOnly()).describedAs("Session Cookie should be HttpOnly").isTrue(); + assertThat(session.getSecure()).describedAs("Session Cookie should be marked as Secure").isTrue(); + } + + @Test + public void doFilterSessionContext() throws Exception { + doFilter(new DoInFilter() { + @Override + public void doFilter(HttpServletRequest wrappedRequest) { + HttpSessionContext sessionContext = wrappedRequest.getSession().getSessionContext(); + assertThat(sessionContext).isNotNull(); + assertThat(sessionContext.getSession("a")).isNull(); + assertThat(sessionContext.getIds()).isNotNull(); + assertThat(sessionContext.getIds().hasMoreElements()).isFalse(); + + try { + sessionContext.getIds().nextElement(); + fail("Expected Exception"); + } catch(NoSuchElementException success) {} + } + }); + } + + + + // --- saving + + @Test + public void doFilterGetAttr() throws Exception { + final String ATTR_NAME = "attr"; + final String ATTR_VALUE = "value"; + final String ATTR_NAME2 = "attr2"; + final String ATTR_VALUE2 = "value2"; + + doFilter(new DoInFilter() { + @Override + public void doFilter(HttpServletRequest wrappedRequest) { + wrappedRequest.getSession().setAttribute(ATTR_NAME, ATTR_VALUE); + wrappedRequest.getSession().setAttribute(ATTR_NAME2, ATTR_VALUE2); + } + }); + + assertNewSession(); + + setupSession(); + + doFilter(new DoInFilter() { + @Override + public void doFilter(HttpServletRequest wrappedRequest) { + assertThat(wrappedRequest.getSession().getAttribute(ATTR_NAME)).isEqualTo(ATTR_VALUE); + assertThat(wrappedRequest.getSession().getAttribute(ATTR_NAME2)).isEqualTo(ATTR_VALUE2); + } + }); + } + + // --- invalidate + + @Test + public void doFilterInvalidateInvalidateIllegalState() throws Exception { + doFilter(new DoInFilter() { + @Override + public void doFilter(HttpServletRequest wrappedRequest) { + HttpSession session = wrappedRequest.getSession(); + session.invalidate(); + try { + session.invalidate(); + fail("Expected Exception"); + } catch(IllegalStateException success) {} + } + }); + } + + @Test + public void doFilterInvalidateCreationTimeIllegalState() throws Exception { + doFilter(new DoInFilter() { + @Override + public void doFilter(HttpServletRequest wrappedRequest) { + HttpSession session = wrappedRequest.getSession(); + session.invalidate(); + try { + session.getCreationTime(); + fail("Expected Exception"); + } catch(IllegalStateException success) {} + } + }); + } + + @Test + public void doFilterInvalidateAttributeIllegalState() throws Exception { + doFilter(new DoInFilter() { + @Override + public void doFilter(HttpServletRequest wrappedRequest) { + HttpSession session = wrappedRequest.getSession(); + session.invalidate(); + try { + session.getAttribute("attr"); + fail("Expected Exception"); + } catch(IllegalStateException success) {} + } + }); + } + + @Test + public void doFilterInvalidateValueIllegalState() throws Exception { + doFilter(new DoInFilter() { + @Override + public void doFilter(HttpServletRequest wrappedRequest) { + HttpSession session = wrappedRequest.getSession(); + session.invalidate(); + try { + session.getValue("attr"); + fail("Expected Exception"); + } catch(IllegalStateException success) {} + } + }); + } + + @Test + public void doFilterInvalidateAttributeNamesIllegalState() throws Exception { + doFilter(new DoInFilter() { + @Override + public void doFilter(HttpServletRequest wrappedRequest) { + HttpSession session = wrappedRequest.getSession(); + session.invalidate(); + try { + session.getAttributeNames(); + fail("Expected Exception"); + } catch(IllegalStateException success) {} + } + }); + } + + @Test + public void doFilterInvalidateValueNamesIllegalState() throws Exception { + doFilter(new DoInFilter() { + @Override + public void doFilter(HttpServletRequest wrappedRequest) { + HttpSession session = wrappedRequest.getSession(); + session.invalidate(); + try { + session.getValueNames(); + fail("Expected Exception"); + } catch(IllegalStateException success) {} + } + }); + } + + @Test + public void doFilterInvalidateSetAttributeIllegalState() throws Exception { + doFilter(new DoInFilter() { + @Override + public void doFilter(HttpServletRequest wrappedRequest) { + HttpSession session = wrappedRequest.getSession(); + session.invalidate(); + try { + session.setAttribute("a", "b"); + fail("Expected Exception"); + } catch(IllegalStateException success) {} + } + }); + } + + @Test + public void doFilterInvalidatePutValueIllegalState() throws Exception { + doFilter(new DoInFilter() { + @Override + public void doFilter(HttpServletRequest wrappedRequest) { + HttpSession session = wrappedRequest.getSession(); + session.invalidate(); + try { + session.putValue("a", "b"); + fail("Expected Exception"); + } catch(IllegalStateException success) {} + } + }); + } + + @Test + public void doFilterInvalidateRemoveAttributeIllegalState() throws Exception { + doFilter(new DoInFilter() { + @Override + public void doFilter(HttpServletRequest wrappedRequest) { + HttpSession session = wrappedRequest.getSession(); + session.invalidate(); + try { + session.removeAttribute("name"); + fail("Expected Exception"); + } catch(IllegalStateException success) {} + } + }); + } + + @Test + public void doFilterInvalidateRemoveValueIllegalState() throws Exception { + doFilter(new DoInFilter() { + @Override + public void doFilter(HttpServletRequest wrappedRequest) { + HttpSession session = wrappedRequest.getSession(); + session.invalidate(); + try { + session.removeValue("name"); + fail("Expected Exception"); + } catch(IllegalStateException success) {} + } + }); + } + + @Test + public void doFilterInvalidateNewIllegalState() throws Exception { + doFilter(new DoInFilter() { + @Override + public void doFilter(HttpServletRequest wrappedRequest) { + HttpSession session = wrappedRequest.getSession(); + session.invalidate(); + try { + session.isNew(); + fail("Expected Exception"); + } catch(IllegalStateException success) {} + } + }); + } + + @Test + public void doFilterInvalidateLastAccessedTimeIllegalState() throws Exception { + doFilter(new DoInFilter() { + @Override + public void doFilter(HttpServletRequest wrappedRequest) { + HttpSession session = wrappedRequest.getSession(); + session.invalidate(); + try { + session.getLastAccessedTime(); + fail("Expected Exception"); + } catch(IllegalStateException success) {} + } + }); + } + + @Test + public void doFilterInvalidateId() throws Exception { + doFilter(new DoInFilter() { + @Override + public void doFilter(HttpServletRequest wrappedRequest) { + HttpSession session = wrappedRequest.getSession(); + session.invalidate(); + // no exception + session.getId(); + } + }); + } + + @Test + public void doFilterInvalidateServletContext() throws Exception { + doFilter(new DoInFilter() { + @Override + public void doFilter(HttpServletRequest wrappedRequest) { + HttpSession session = wrappedRequest.getSession(); + session.invalidate(); + + // no exception + session.getServletContext(); + } + }); + } + + @Test + public void doFilterInvalidateSessionContext() throws Exception { + doFilter(new DoInFilter() { + @Override + public void doFilter(HttpServletRequest wrappedRequest) { + HttpSession session = wrappedRequest.getSession(); + session.invalidate(); + + // no exception + session.getSessionContext(); + } + }); + } + + @Test + public void doFilterInvalidateMaxInteractiveInterval() throws Exception { + doFilter(new DoInFilter() { + @Override + public void doFilter(HttpServletRequest wrappedRequest) { + HttpSession session = wrappedRequest.getSession(); + session.invalidate(); + + // no exception + session.getMaxInactiveInterval(); + session.setMaxInactiveInterval(3600); + } + }); + } + + @Test + public void doFilterInvalidateAndGetSession() throws Exception { + final String ATTR_NAME = "attr"; + final String ATTR_VALUE = "value"; + final String ATTR_NAME2 = "attr2"; + final String ATTR_VALUE2 = "value2"; + + doFilter(new DoInFilter() { + @Override + public void doFilter(HttpServletRequest wrappedRequest) { + wrappedRequest.getSession().setAttribute(ATTR_NAME, ATTR_VALUE); + wrappedRequest.getSession().invalidate(); + wrappedRequest.getSession().setAttribute(ATTR_NAME2, ATTR_VALUE2); + } + }); + + assertNewSession(); + + setupSession(); + + doFilter(new DoInFilter() { + @Override + public void doFilter(HttpServletRequest wrappedRequest) { + assertThat(wrappedRequest.getSession().getAttribute(ATTR_NAME)).isNull(); + assertThat(wrappedRequest.getSession().getAttribute(ATTR_NAME2)).isEqualTo(ATTR_VALUE2); + } + }); + } + + // --- invalid session ids + + @Test + public void doFilterGetSessionInvalidSessionId() throws Exception { + setSessionCookie("INVALID"); + doFilter(new DoInFilter() { + @Override + public void doFilter(HttpServletRequest wrappedRequest) { + wrappedRequest.getSession(); + } + }); + + assertNewSession(); + } + + @Test + public void doFilterGetSessionTrueInvalidSessionId() throws Exception { + setSessionCookie("INVALID"); + doFilter(new DoInFilter() { + @Override + public void doFilter(HttpServletRequest wrappedRequest) { + wrappedRequest.getSession(true); + } + }); + + assertNewSession(); + } + + @Test + public void doFilterGetSessionFalseInvalidSessionId() throws Exception { + setSessionCookie("INVALID"); + doFilter(new DoInFilter() { + @Override + public void doFilter(HttpServletRequest wrappedRequest) { + wrappedRequest.getSession(false); + } + }); + + assertNoSession(); + } + + // --- commit response saves immediately + + @Test + public void doFilterSendError() throws Exception { + doFilter(new DoInFilter() { + @Override + public void doFilter(HttpServletRequest wrappedRequest, HttpServletResponse wrappedResponse) throws IOException { + String id = wrappedRequest.getSession().getId(); + wrappedResponse.sendError(HttpServletResponse.SC_INTERNAL_SERVER_ERROR); + assertThat(sessionRepository.getSession(id)).isNotNull(); + } + }); + } + + @Test + public void doFilterSendErrorAndMessage() throws Exception { + doFilter(new DoInFilter() { + @Override + public void doFilter(HttpServletRequest wrappedRequest, HttpServletResponse wrappedResponse) throws IOException { + String id = wrappedRequest.getSession().getId(); + wrappedResponse.sendError(HttpServletResponse.SC_INTERNAL_SERVER_ERROR, "Error"); + assertThat(sessionRepository.getSession(id)).isNotNull(); + } + }); + } + + @Test + public void doFilterSendRedirect() throws Exception { + doFilter(new DoInFilter() { + @Override + public void doFilter(HttpServletRequest wrappedRequest, HttpServletResponse wrappedResponse) throws IOException { + String id = wrappedRequest.getSession().getId(); + wrappedResponse.sendRedirect("/"); + assertThat(sessionRepository.getSession(id)).isNotNull(); + } + }); + } + + @Test + public void doFilterFlushBuffer() throws Exception { + doFilter(new DoInFilter() { + @Override + public void doFilter(HttpServletRequest wrappedRequest, HttpServletResponse wrappedResponse) throws IOException { + String id = wrappedRequest.getSession().getId(); + wrappedResponse.flushBuffer(); + assertThat(sessionRepository.getSession(id)).isNotNull(); + } + }); + } + + @Test + public void doFilterOutputFlush() throws Exception { + doFilter(new DoInFilter() { + @Override + public void doFilter(HttpServletRequest wrappedRequest, HttpServletResponse wrappedResponse) throws IOException { + String id = wrappedRequest.getSession().getId(); + wrappedResponse.getOutputStream().flush(); + assertThat(sessionRepository.getSession(id)).isNotNull(); + } + }); + } + + @Test + public void doFilterOutputClose() throws Exception { + doFilter(new DoInFilter() { + @Override + public void doFilter(HttpServletRequest wrappedRequest, HttpServletResponse wrappedResponse) throws IOException { + String id = wrappedRequest.getSession().getId(); + wrappedResponse.getOutputStream().close(); + assertThat(sessionRepository.getSession(id)).isNotNull(); + } + }); + } + + @Test + public void doFilterWriterFlush() throws Exception { + doFilter(new DoInFilter() { + @Override + public void doFilter(HttpServletRequest wrappedRequest, HttpServletResponse wrappedResponse) throws IOException { + String id = wrappedRequest.getSession().getId(); + wrappedResponse.getWriter().flush(); + assertThat(sessionRepository.getSession(id)).isNotNull(); + } + }); + } + + @Test + public void doFilterWriterClose() throws Exception { + doFilter(new DoInFilter() { + @Override + public void doFilter(HttpServletRequest wrappedRequest, HttpServletResponse wrappedResponse) throws IOException { + String id = wrappedRequest.getSession().getId(); + wrappedResponse.getWriter().close(); + assertThat(sessionRepository.getSession(id)).isNotNull(); + } + }); + } + + // --- helper methods + + private void assertNewSession() { + Cookie cookie = getSessionCookie(); + assertThat(cookie).isNotNull(); + assertThat(cookie.getMaxAge()).isEqualTo(-1); + assertThat(cookie.getValue()).isNotEqualTo("INVALID"); + assertThat(cookie.isHttpOnly()).describedAs("Cookie is expected to be HTTP Only").isTrue(); + assertThat(cookie.getSecure()).describedAs("Cookie secured is expected to be " + request.isSecure()).isEqualTo(request.isSecure()); + assertThat(request.getSession(false)).describedAs("The original HttpServletRequest HttpSession should be null").isNull(); + } + + private void assertNoSession() { + Cookie cookie = getSessionCookie(); + assertThat(cookie).isNull(); + assertThat(request.getSession(false)).describedAs("The original HttpServletRequest HttpSession should be null").isNull(); + } + + private Cookie getSessionCookie() { + return response.getCookie("SESSION"); + } + + private void setSessionCookie(String sessionId) { + request.setCookies(new Cookie[]{new Cookie("SESSION", sessionId)}); + } + + private void setupSession() { + setSessionCookie(getSessionCookie().getValue()); + } + + @SuppressWarnings("serial") + private void doFilter(final DoInFilter doInFilter) throws ServletException, IOException { + chain = new MockFilterChain(new HttpServlet() {}, new OncePerRequestFilter() { + @Override + protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException { + doInFilter.doFilter(request, response); + } + }); + filter.doFilter(request, response, chain); + } + + abstract class DoInFilter { + void doFilter(HttpServletRequest wrappedRequest, HttpServletResponse wrappedResponse) throws ServletException, IOException { + doFilter(wrappedRequest); + } + void doFilter(HttpServletRequest wrappedRequest) {} + } } \ No newline at end of file