Spring/spring-session
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Polishing

Browse Source 
1. fix deprecations
2. fix generics
3. use lambda instead of anonymous class
4. mark some fields as final
This commit is contained in:
Yanming Zhou
2023-08-23 10:39:53 +08:00
committed by Marcus Hert Da Coregio
parent 831d65a97c
commit 11ce4b4561
18 changed files with 96 additions and 98 deletions
Download Patch File Download Diff File Expand all files Collapse all files

88
spring-session-data-mongodb/src/integration-test/java/org/springframework/session/data/mongo/MongoDbDeleteJacksonSessionVerificationTest.java
View File

@@ -36,6 +36,7 @@ import org.springframework.data.mongodb.core.ReactiveMongoTemplate;
import org.springframework.http.HttpHeaders;
import org.springframework.http.MediaType;
import org.springframework.http.ResponseEntity;
import org.springframework.security.config.Customizer;
import org.springframework.security.config.annotation.web.reactive.EnableWebFluxSecurity;
import org.springframework.security.config.web.server.ServerHttpSecurity;
import org.springframework.security.core.userdetails.MapReactiveUserDetailsService;
@@ -72,57 +73,62 @@ public class MongoDbDeleteJacksonSessionVerificationTest {
void logoutShouldDeleteOldSessionFromMongoDB() {
// 1. Login and capture the SESSION cookie value.
// @formatter:off
FluxExchangeResult<String> loginResult = this.client.post().uri("/login")
.contentType(MediaType.APPLICATION_FORM_URLENCODED) //
.body(BodyInserters //
.fromFormData("username", "admin") //
.with("password", "password")) //
.exchange() //
.contentType(MediaType.APPLICATION_FORM_URLENCODED)
.body(BodyInserters
.fromFormData("username", "admin")
.with("password", "password"))
.exchange()
.returnResult(String.class);
// @formatter:on
AssertionsForClassTypes.assertThat(loginResult.getResponseHeaders().getLocation()).isEqualTo(URI.create("/"));
String originalSessionId = loginResult.getResponseCookies().getFirst("SESSION").getValue();
// 2. Fetch a protected resource using the SESSION cookie.
this.client.get().uri("/hello") //
.cookie("SESSION", originalSessionId) //
.exchange() //
.expectStatus().isOk() //
.returnResult(String.class).getResponseBody() //
.as(StepVerifier::create) //
.expectNext("HelloWorld") //
// @formatter:off
this.client.get().uri("/hello")
.cookie("SESSION", originalSessionId)
.exchange()
.expectStatus().isOk()
.returnResult(String.class).getResponseBody()
.as(StepVerifier::create)
.expectNext("HelloWorld")
.verifyComplete();
// @formatter:on
// 3. Logout using the SESSION cookie, and capture the new SESSION cookie.
String newSessionId = this.client.post().uri("/logout") //
.cookie("SESSION", originalSessionId) //
.exchange() //
.expectStatus().isFound() //
// @formatter:off
String newSessionId = this.client.post().uri("/logout")
.cookie("SESSION", originalSessionId)
.exchange()
.expectStatus().isFound()
.returnResult(String.class).getResponseCookies().getFirst("SESSION").getValue();
// @formatter:on
AssertionsForClassTypes.assertThat(newSessionId).isNotEqualTo(originalSessionId);
// 4. Verify the new SESSION cookie is not yet authorized.
this.client.get().uri("/hello") //
.cookie("SESSION", newSessionId) //
.exchange() //
.expectStatus().isFound() //
// @formatter:off
this.client.get().uri("/hello")
.cookie("SESSION", newSessionId)
.exchange()
.expectStatus().isFound()
.expectHeader()
.value(HttpHeaders.LOCATION, (value) -> AssertionsForClassTypes.assertThat(value).isEqualTo("/login"));
// @formatter:on
// 5. Verify the original SESSION cookie no longer works.
this.client.get().uri("/hello") //
.cookie("SESSION", originalSessionId) //
.exchange() //
.expectStatus().isFound() //
// @formatter:off
this.client.get().uri("/hello")
.cookie("SESSION", originalSessionId)
.exchange()
.expectStatus().isFound()
.expectHeader()
.value(HttpHeaders.LOCATION, (value) -> AssertionsForClassTypes.assertThat(value).isEqualTo("/login"));
// @formatter:on
}
@RestController
@@ -141,24 +147,24 @@ public class MongoDbDeleteJacksonSessionVerificationTest {
@Bean
SecurityWebFilterChain securityWebFilterChain(ServerHttpSecurity http) {
return http //
.logout()//
/**/.and() //
.formLogin() //
/**/.and() //
.csrf().disable() //
.authorizeExchange() //
.anyExchange().authenticated() //
/**/.and() //
// @formatter:off
return http
.logout(Customizer.withDefaults())
.formLogin(Customizer.withDefaults())
.csrf((csrf) -> csrf.disable())
.authorizeExchange((ae) -> ae.anyExchange().authenticated())
.build();
// @formatter:on
}
@Bean
MapReactiveUserDetailsService userDetailsService() {
return new MapReactiveUserDetailsService(User.withUsername("admin") //
.password("{noop}password") //
.roles("USER,ADMIN") //
// @formatter:off
return new MapReactiveUserDetailsService(User.withUsername("admin")
.password("{noop}password")
.roles("USER,ADMIN")
.build());
// @formatter:on
}
@Bean

27
spring-session-data-mongodb/src/integration-test/java/org/springframework/session/data/mongo/MongoDbLogoutVerificationTest.java
View File

@@ -36,6 +36,7 @@ import org.springframework.data.mongodb.core.ReactiveMongoTemplate;
import org.springframework.http.HttpHeaders;
import org.springframework.http.MediaType;
import org.springframework.http.ResponseEntity;
import org.springframework.security.config.Customizer;
import org.springframework.security.config.annotation.web.reactive.EnableWebFluxSecurity;
import org.springframework.security.config.web.server.ServerHttpSecurity;
import org.springframework.security.core.userdetails.MapReactiveUserDetailsService;
@@ -141,26 +142,24 @@ public class MongoDbLogoutVerificationTest {
@Bean
SecurityWebFilterChain securityWebFilterChain(ServerHttpSecurity http) {
return http //
.logout()//
/**/.and() //
.formLogin() //
/**/.and() //
.csrf().disable() //
.authorizeExchange() //
.anyExchange().authenticated() //
/**/.and() //
// @formatter:off
return http
.logout(Customizer.withDefaults())
.formLogin(Customizer.withDefaults())
.csrf((csrf) -> csrf.disable())
.authorizeExchange((ae) -> ae.anyExchange().authenticated())
.build();
// @formatter:on
}
@Bean
MapReactiveUserDetailsService userDetailsService() {
return new MapReactiveUserDetailsService(User.withUsername("admin") //
.password("{noop}password") //
.roles("USER,ADMIN") //
// @formatter:off
return new MapReactiveUserDetailsService(User.withUsername("admin")
.password("{noop}password")
.roles("USER,ADMIN")
.build());
// @formatter:on
}
}

10
spring-session-data-mongodb/src/main/java/org/springframework/session/data/mongo/MongoSession.java
View File

@@ -48,15 +48,14 @@ class MongoSession implements Session {
* NOTE: This was originally stored in unicode format. Delomboking the code caused it
* to get converted to another encoding, which isn't supported on all systems, so we
* migrated back to unicode. The same character is being represented ensuring binary
* compatibility.
*
* See https://www.compart.com/en/unicode/U+F607
* compatibility. See <a href=
* "https://www.compart.com/en/unicode/U+F607">https://www.compart.com/en/unicode/U+F607</a>
*/
private static final char DOT_COVER_CHAR = '\uF607';
private String id;
private String originalSessionId;
private final String originalSessionId;
private long createdMillis = System.currentTimeMillis();
@@ -66,7 +65,7 @@ class MongoSession implements Session {
private Date expireAt;
private Map<String, Object> attrs = new HashMap<>();
private final Map<String, Object> attrs = new HashMap<>();
private transient SessionIdGenerator sessionIdGenerator = UuidSessionIdGenerator.getInstance();
@@ -135,6 +134,7 @@ class MongoSession implements Session {
@Override
@Nullable
@SuppressWarnings("unchecked")
public <T> T getAttribute(String attributeName) {
return (T) this.attrs.get(coverDot(attributeName));
}