Spring/spring-session-data-mongodb
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Update DefaultCookieSerializer to use base64 by default

Browse Source 
Fixes gh-736
This commit is contained in:
Vedran Pavic
2017-04-26 22:43:30 +02:00
parent 6327d36ce9
commit 815cbf4ee8
6 changed files with 38 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
docs/src/test/java/docs/security/RememberMeSecurityConfigurationTests.java
View File

@@ -1,5 +1,5 @@
/*
* Copyright 2014-2016 the original author or authors.
* Copyright 2014-2017 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -16,6 +16,7 @@
package docs.security;
import java.util.Base64;
import java.util.concurrent.TimeUnit;
import javax.servlet.http.Cookie;
@@ -79,7 +80,8 @@ public class RememberMeSecurityConfigurationTests<T extends ExpiringSession> {
Cookie cookie = result.getResponse().getCookie("SESSION");
assertThat(cookie.getMaxAge()).isEqualTo(Integer.MAX_VALUE);
T session = this.sessions.getSession(cookie.getValue());
T session = this.sessions
.getSession(new String(Base64.getDecoder().decode(cookie.getValue())));
assertThat(session.getMaxInactiveIntervalInSeconds())
.isEqualTo((int) TimeUnit.DAYS.toSeconds(30));

6
docs/src/test/java/docs/security/RememberMeSecurityConfigurationXmlTests.java
View File

@@ -1,5 +1,5 @@
/*
* Copyright 2014-2016 the original author or authors.
* Copyright 2014-2017 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -16,6 +16,7 @@
package docs.security;
import java.util.Base64;
import java.util.concurrent.TimeUnit;
import javax.servlet.http.Cookie;
@@ -79,7 +80,8 @@ public class RememberMeSecurityConfigurationXmlTests<T extends ExpiringSession>
Cookie cookie = result.getResponse().getCookie("SESSION");
assertThat(cookie.getMaxAge()).isEqualTo(Integer.MAX_VALUE);
T session = this.sessions.getSession(cookie.getValue());
T session = this.sessions
.getSession(new String(Base64.getDecoder().decode(cookie.getValue())));
assertThat(session.getMaxInactiveIntervalInSeconds())
.isEqualTo((int) TimeUnit.DAYS.toSeconds(30));

3
samples/boot/findbyusername/src/integration-test/java/sample/pages/HomePage.java
View File

@@ -16,6 +16,7 @@
package sample.pages;
import java.util.Base64;
import java.util.Set;
import org.openqa.selenium.By;
@@ -59,7 +60,7 @@ public class HomePage extends BasePage {
String cookieValue = null;
for (Cookie cookie : cookies) {
if ("SESSION".equals(cookie.getName())) {
cookieValue = cookie.getValue();
cookieValue = new String(Base64.getDecoder().decode(cookie.getValue()));
}
}
WebElement element = getDriver().findElement(By.id("terminate-" + cookieValue));

4
spring-session/src/main/java/org/springframework/session/web/http/DefaultCookieSerializer.java
View File

@@ -1,5 +1,5 @@
/*
* Copyright 2014-2016 the original author or authors.
* Copyright 2014-2017 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -53,7 +53,7 @@ public class DefaultCookieSerializer implements CookieSerializer {
private String jvmRoute;
private boolean useBase64Encoding;
private boolean useBase64Encoding = true;
private String rememberMeRequestAttribute;

18
spring-session/src/test/java/org/springframework/session/web/http/CookieHttpSessionStrategyTests.java
View File

@@ -16,6 +16,7 @@
package org.springframework.session.web.http;
import java.util.Base64;
import java.util.Map;
import javax.servlet.http.Cookie;
@@ -92,8 +93,8 @@ public class CookieHttpSessionStrategyTests {
Cookie[] cookies = this.response.getCookies();
assertThat(cookies).hasSize(2);
assertThat(cookies[0].getValue()).isEqualTo(this.session.getId());
assertThat(cookies[1].getValue()).isEqualTo(newSession.getId());
assertThat(base64Decode(cookies[0].getValue())).isEqualTo(this.session.getId());
assertThat(base64Decode(cookies[1].getValue())).isEqualTo(newSession.getId());
}
@Test
@@ -727,10 +728,19 @@ public class CookieHttpSessionStrategyTests {
}
public void setSessionCookie(String value) {
this.request.setCookies(new Cookie(this.cookieName, value));
this.request.setCookies(new Cookie(this.cookieName, base64Encode(value)));
}
public String getSessionId() {
return this.response.getCookie(this.cookieName).getValue();
return base64Decode(this.response.getCookie(this.cookieName).getValue());
}
private static String base64Encode(String value) {
return Base64.getEncoder().encodeToString(value.getBytes());
}
private static String base64Decode(String value) {
return new String(Base64.getDecoder().decode(value));
}
}

15
spring-session/src/test/java/org/springframework/session/web/http/SessionRepositoryFilterTests.java
View File

@@ -19,6 +19,7 @@ package org.springframework.session.web.http;
import java.io.IOException;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.Base64;
import java.util.Collections;
import java.util.HashMap;
import java.util.Map;
@@ -186,7 +187,7 @@ public class SessionRepositoryFilterTests {
});
final String id = (String) this.request.getAttribute(ID_ATTR);
assertThat(getSessionCookie().getValue()).isEqualTo(id);
assertThat(base64Decode(getSessionCookie().getValue())).isEqualTo(id);
setSessionCookie(id);
doFilter(new DoInFilter() {
@@ -517,7 +518,7 @@ public class SessionRepositoryFilterTests {
}
});
final String originalSessionId = getSessionCookie().getValue();
final String originalSessionId = base64Decode(getSessionCookie().getValue());
nextRequest();
// change the session id
@@ -1414,7 +1415,7 @@ public class SessionRepositoryFilterTests {
}
private void setSessionCookie(String sessionId) {
this.request.setCookies(new Cookie[] { new Cookie("SESSION", sessionId) });
this.request.setCookies(new Cookie("SESSION", base64Encode(sessionId)));
}
private void setupRequest() {
@@ -1458,6 +1459,14 @@ public class SessionRepositoryFilterTests {
this.filter.doFilter(this.request, this.response, this.chain);
}
private static String base64Encode(String value) {
return Base64.getEncoder().encodeToString(value.getBytes());
}
private static String base64Decode(String value) {
return new String(Base64.getDecoder().decode(value));
}
abstract class DoInFilter {
void doFilter(HttpServletRequest wrappedRequest,
HttpServletResponse wrappedResponse)