diff --git a/docs/src/test/java/docs/security/RememberMeSecurityConfigurationTests.java b/docs/src/test/java/docs/security/RememberMeSecurityConfigurationTests.java index 09a12e8..2b45cac 100644 --- a/docs/src/test/java/docs/security/RememberMeSecurityConfigurationTests.java +++ b/docs/src/test/java/docs/security/RememberMeSecurityConfigurationTests.java @@ -1,5 +1,5 @@ /* - * Copyright 2014-2016 the original author or authors. + * Copyright 2014-2017 the original author or authors. * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -16,6 +16,7 @@ package docs.security; +import java.util.Base64; import java.util.concurrent.TimeUnit; import javax.servlet.http.Cookie; @@ -79,7 +80,8 @@ public class RememberMeSecurityConfigurationTests { Cookie cookie = result.getResponse().getCookie("SESSION"); assertThat(cookie.getMaxAge()).isEqualTo(Integer.MAX_VALUE); - T session = this.sessions.getSession(cookie.getValue()); + T session = this.sessions + .getSession(new String(Base64.getDecoder().decode(cookie.getValue()))); assertThat(session.getMaxInactiveIntervalInSeconds()) .isEqualTo((int) TimeUnit.DAYS.toSeconds(30)); diff --git a/docs/src/test/java/docs/security/RememberMeSecurityConfigurationXmlTests.java b/docs/src/test/java/docs/security/RememberMeSecurityConfigurationXmlTests.java index e60e378..982bf05 100644 --- a/docs/src/test/java/docs/security/RememberMeSecurityConfigurationXmlTests.java +++ b/docs/src/test/java/docs/security/RememberMeSecurityConfigurationXmlTests.java @@ -1,5 +1,5 @@ /* - * Copyright 2014-2016 the original author or authors. + * Copyright 2014-2017 the original author or authors. * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -16,6 +16,7 @@ package docs.security; +import java.util.Base64; import java.util.concurrent.TimeUnit; import javax.servlet.http.Cookie; @@ -79,7 +80,8 @@ public class RememberMeSecurityConfigurationXmlTests Cookie cookie = result.getResponse().getCookie("SESSION"); assertThat(cookie.getMaxAge()).isEqualTo(Integer.MAX_VALUE); - T session = this.sessions.getSession(cookie.getValue()); + T session = this.sessions + .getSession(new String(Base64.getDecoder().decode(cookie.getValue()))); assertThat(session.getMaxInactiveIntervalInSeconds()) .isEqualTo((int) TimeUnit.DAYS.toSeconds(30)); diff --git a/samples/boot/findbyusername/src/integration-test/java/sample/pages/HomePage.java b/samples/boot/findbyusername/src/integration-test/java/sample/pages/HomePage.java index 32522d6..ea4d309 100644 --- a/samples/boot/findbyusername/src/integration-test/java/sample/pages/HomePage.java +++ b/samples/boot/findbyusername/src/integration-test/java/sample/pages/HomePage.java @@ -16,6 +16,7 @@ package sample.pages; +import java.util.Base64; import java.util.Set; import org.openqa.selenium.By; @@ -59,7 +60,7 @@ public class HomePage extends BasePage { String cookieValue = null; for (Cookie cookie : cookies) { if ("SESSION".equals(cookie.getName())) { - cookieValue = cookie.getValue(); + cookieValue = new String(Base64.getDecoder().decode(cookie.getValue())); } } WebElement element = getDriver().findElement(By.id("terminate-" + cookieValue)); diff --git a/spring-session/src/main/java/org/springframework/session/web/http/DefaultCookieSerializer.java b/spring-session/src/main/java/org/springframework/session/web/http/DefaultCookieSerializer.java index 3b9cb39..b2c0abc 100644 --- a/spring-session/src/main/java/org/springframework/session/web/http/DefaultCookieSerializer.java +++ b/spring-session/src/main/java/org/springframework/session/web/http/DefaultCookieSerializer.java @@ -1,5 +1,5 @@ /* - * Copyright 2014-2016 the original author or authors. + * Copyright 2014-2017 the original author or authors. * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -53,7 +53,7 @@ public class DefaultCookieSerializer implements CookieSerializer { private String jvmRoute; - private boolean useBase64Encoding; + private boolean useBase64Encoding = true; private String rememberMeRequestAttribute; diff --git a/spring-session/src/test/java/org/springframework/session/web/http/CookieHttpSessionStrategyTests.java b/spring-session/src/test/java/org/springframework/session/web/http/CookieHttpSessionStrategyTests.java index 451fa4c..3a84c04 100644 --- a/spring-session/src/test/java/org/springframework/session/web/http/CookieHttpSessionStrategyTests.java +++ b/spring-session/src/test/java/org/springframework/session/web/http/CookieHttpSessionStrategyTests.java @@ -16,6 +16,7 @@ package org.springframework.session.web.http; +import java.util.Base64; import java.util.Map; import javax.servlet.http.Cookie; @@ -92,8 +93,8 @@ public class CookieHttpSessionStrategyTests { Cookie[] cookies = this.response.getCookies(); assertThat(cookies).hasSize(2); - assertThat(cookies[0].getValue()).isEqualTo(this.session.getId()); - assertThat(cookies[1].getValue()).isEqualTo(newSession.getId()); + assertThat(base64Decode(cookies[0].getValue())).isEqualTo(this.session.getId()); + assertThat(base64Decode(cookies[1].getValue())).isEqualTo(newSession.getId()); } @Test @@ -727,10 +728,19 @@ public class CookieHttpSessionStrategyTests { } public void setSessionCookie(String value) { - this.request.setCookies(new Cookie(this.cookieName, value)); + this.request.setCookies(new Cookie(this.cookieName, base64Encode(value))); } public String getSessionId() { - return this.response.getCookie(this.cookieName).getValue(); + return base64Decode(this.response.getCookie(this.cookieName).getValue()); } + + private static String base64Encode(String value) { + return Base64.getEncoder().encodeToString(value.getBytes()); + } + + private static String base64Decode(String value) { + return new String(Base64.getDecoder().decode(value)); + } + } diff --git a/spring-session/src/test/java/org/springframework/session/web/http/SessionRepositoryFilterTests.java b/spring-session/src/test/java/org/springframework/session/web/http/SessionRepositoryFilterTests.java index 254d77f..d020fe6 100644 --- a/spring-session/src/test/java/org/springframework/session/web/http/SessionRepositoryFilterTests.java +++ b/spring-session/src/test/java/org/springframework/session/web/http/SessionRepositoryFilterTests.java @@ -19,6 +19,7 @@ package org.springframework.session.web.http; import java.io.IOException; import java.util.ArrayList; import java.util.Arrays; +import java.util.Base64; import java.util.Collections; import java.util.HashMap; import java.util.Map; @@ -186,7 +187,7 @@ public class SessionRepositoryFilterTests { }); final String id = (String) this.request.getAttribute(ID_ATTR); - assertThat(getSessionCookie().getValue()).isEqualTo(id); + assertThat(base64Decode(getSessionCookie().getValue())).isEqualTo(id); setSessionCookie(id); doFilter(new DoInFilter() { @@ -517,7 +518,7 @@ public class SessionRepositoryFilterTests { } }); - final String originalSessionId = getSessionCookie().getValue(); + final String originalSessionId = base64Decode(getSessionCookie().getValue()); nextRequest(); // change the session id @@ -1414,7 +1415,7 @@ public class SessionRepositoryFilterTests { } private void setSessionCookie(String sessionId) { - this.request.setCookies(new Cookie[] { new Cookie("SESSION", sessionId) }); + this.request.setCookies(new Cookie("SESSION", base64Encode(sessionId))); } private void setupRequest() { @@ -1458,6 +1459,14 @@ public class SessionRepositoryFilterTests { this.filter.doFilter(this.request, this.response, this.chain); } + private static String base64Encode(String value) { + return Base64.getEncoder().encodeToString(value.getBytes()); + } + + private static String base64Decode(String value) { + return new String(Base64.getDecoder().decode(value)); + } + abstract class DoInFilter { void doFilter(HttpServletRequest wrappedRequest, HttpServletResponse wrappedResponse)