Spring/spring-session
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Merge branch '3.1.x' into 3.2.x

Browse Source 
Closes gh-2827 in 3.2.x
Closes gh-2831
This commit is contained in:
Marcus Hert Da Coregio
2024-03-01 15:37:35 -03:00
parent 57860f7148 c2a982c4a7
commit ea14c336a9
17 changed files with 966 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

26
spring-session-samples/spring-session-sample-boot-jdbc-json-attribute/spring-session-sample-boot-jdbc-json-attribute.gradle Normal file
View File

@@ -0,0 +1,26 @@
apply plugin: 'io.spring.convention.spring-sample-boot'
dependencies {
management platform(project(":spring-session-dependencies"))
implementation project(':spring-session-jdbc')
implementation "org.springframework.boot:spring-boot-starter-jdbc"
implementation "org.springframework.boot:spring-boot-starter-web"
implementation "org.springframework.boot:spring-boot-starter-thymeleaf"
implementation "org.springframework.boot:spring-boot-starter-security"
implementation "nz.net.ultraq.thymeleaf:thymeleaf-layout-dialect"
implementation "org.webjars:bootstrap"
implementation "org.webjars:html5shiv"
implementation "org.webjars:webjars-locator-core"
runtimeOnly 'org.postgresql:postgresql'
testImplementation 'org.springframework.boot:spring-boot-starter-test'
testImplementation 'org.springframework.boot:spring-boot-testcontainers'
testImplementation 'org.springframework.security:spring-security-test'
testImplementation 'org.testcontainers:junit-jupiter'
testImplementation 'org.testcontainers:postgresql'
}
tasks.named('test') {
useJUnitPlatform()
}

36
spring-session-samples/spring-session-sample-boot-jdbc-json-attribute/src/main/java/sample/IndexController.java Normal file
View File

@@ -0,0 +1,36 @@
/*
* Copyright 2014-2019 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* https://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package sample;
import org.springframework.stereotype.Controller;
import org.springframework.web.bind.annotation.RequestMapping;
/**
* Controller for sending the user to the login view.
*
* @author Rob Winch
*
*/
@Controller
public class IndexController {
@RequestMapping("/")
public String index() {
return "index";
}
}

32
spring-session-samples/spring-session-sample-boot-jdbc-json-attribute/src/main/java/sample/JdbcJsonAttributeApplication.java Normal file
View File

@@ -0,0 +1,32 @@
/*
* Copyright 2014-2019 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* https://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package sample;
import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
/**
* @author Rob Winch
*/
@SpringBootApplication
public class JdbcJsonAttributeApplication {
public static void main(String[] args) {
SpringApplication.run(JdbcJsonAttributeApplication.class, args);
}
}

37
spring-session-samples/spring-session-sample-boot-jdbc-json-attribute/src/main/java/sample/UserControllerAdvise.java Normal file
View File

@@ -0,0 +1,37 @@
/*
* Copyright 2014-2022 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* https://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package sample;
import java.security.Principal;
import org.springframework.web.bind.annotation.ControllerAdvice;
import org.springframework.web.bind.annotation.ModelAttribute;
/**
* {@link ControllerAdvice} to expose security related attributes.
*
* @author Rob Winch
*/
@ControllerAdvice
public class UserControllerAdvise {
@ModelAttribute("currentUserName")
String currentUser(Principal principal) {
return (principal != null) ? principal.getName() : null;
}
}

49
spring-session-samples/spring-session-sample-boot-jdbc-json-attribute/src/main/java/sample/config/SecurityConfig.java Normal file
View File

@@ -0,0 +1,49 @@
/*
* Copyright 2014-2022 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* https://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package sample.config;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.web.SecurityFilterChain;
/**
* Spring Security configuration.
*
* @author Rob Winch
* @author Vedran Pavic
*/
@Configuration
public class SecurityConfig {
// @formatter:off
// tag::config[]
@Bean
SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
return http
.authorizeHttpRequests((authorize) -> authorize
.anyRequest().authenticated()
)
.formLogin((formLogin) -> formLogin
.permitAll()
)
.build();
}
// end::config[]
// @formatter:on
}

81
spring-session-samples/spring-session-sample-boot-jdbc-json-attribute/src/main/java/sample/config/SessionConfig.java Normal file
View File

@@ -0,0 +1,81 @@
package sample.config;
import java.io.IOException;
import java.io.InputStream;
import java.io.OutputStream;
import com.fasterxml.jackson.databind.ObjectMapper;
import org.springframework.beans.factory.BeanClassLoaderAware;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.core.convert.support.GenericConversionService;
import org.springframework.core.serializer.Deserializer;
import org.springframework.core.serializer.Serializer;
import org.springframework.core.serializer.support.DeserializingConverter;
import org.springframework.core.serializer.support.SerializingConverter;
import org.springframework.security.jackson2.SecurityJackson2Modules;
import org.springframework.session.config.SessionRepositoryCustomizer;
import org.springframework.session.jdbc.JdbcIndexedSessionRepository;
@Configuration(proxyBeanMethods = false)
public class SessionConfig implements BeanClassLoaderAware {
private static final String CREATE_SESSION_ATTRIBUTE_QUERY = """
INSERT INTO %TABLE_NAME%_ATTRIBUTES (SESSION_PRIMARY_ID, ATTRIBUTE_NAME, ATTRIBUTE_BYTES)
VALUES (?, ?, encode(?, 'escape')::jsonb)
""";
private ClassLoader classLoader;
@Bean
SessionRepositoryCustomizer<JdbcIndexedSessionRepository> customizer() {
return (sessionRepository) -> sessionRepository.setCreateSessionAttributeQuery(CREATE_SESSION_ATTRIBUTE_QUERY);
}
@Bean("springSessionConversionService")
public GenericConversionService springSessionConversionService(ObjectMapper objectMapper) {
ObjectMapper copy = objectMapper.copy();
copy.registerModules(SecurityJackson2Modules.getModules(this.classLoader));
GenericConversionService converter = new GenericConversionService();
converter.addConverter(Object.class, byte[].class, new SerializingConverter(new JsonSerializer(copy)));
converter.addConverter(byte[].class, Object.class, new DeserializingConverter(new JsonDeserializer(copy)));
return converter;
}
@Override
public void setBeanClassLoader(ClassLoader classLoader) {
this.classLoader = classLoader;
}
static class JsonSerializer implements Serializer<Object> {
private final ObjectMapper objectMapper;
JsonSerializer(ObjectMapper objectMapper) {
this.objectMapper = objectMapper;
}
@Override
public void serialize(Object object, OutputStream outputStream) throws IOException {
this.objectMapper.writeValue(outputStream, object);
}
}
static class JsonDeserializer implements Deserializer<Object> {
private final ObjectMapper objectMapper;
JsonDeserializer(ObjectMapper objectMapper) {
this.objectMapper = objectMapper;
}
@Override
public Object deserialize(InputStream inputStream) throws IOException {
return this.objectMapper.readValue(inputStream, Object.class);
}
}
}

3
spring-session-samples/spring-session-sample-boot-jdbc-json-attribute/src/main/resources/application.properties Normal file
View File

@@ -0,0 +1,3 @@
spring.security.user.password=password
spring.session.jdbc.schema=classpath:schema.sql
spring.session.jdbc.initialize-schema=always

24
spring-session-samples/spring-session-sample-boot-jdbc-json-attribute/src/main/resources/schema.sql Normal file
View File

@@ -0,0 +1,24 @@
CREATE TABLE SPRING_SESSION
(
PRIMARY_ID CHAR(36) NOT NULL,
SESSION_ID CHAR(36) NOT NULL,
CREATION_TIME BIGINT NOT NULL,
LAST_ACCESS_TIME BIGINT NOT NULL,
MAX_INACTIVE_INTERVAL INT NOT NULL,
EXPIRY_TIME BIGINT NOT NULL,
PRINCIPAL_NAME VARCHAR(100),
CONSTRAINT SPRING_SESSION_PK PRIMARY KEY (PRIMARY_ID)
);
CREATE UNIQUE INDEX SPRING_SESSION_IX1 ON SPRING_SESSION (SESSION_ID);
CREATE INDEX SPRING_SESSION_IX2 ON SPRING_SESSION (EXPIRY_TIME);
CREATE INDEX SPRING_SESSION_IX3 ON SPRING_SESSION (PRINCIPAL_NAME);
CREATE TABLE SPRING_SESSION_ATTRIBUTES
(
SESSION_PRIMARY_ID CHAR(36) NOT NULL,
ATTRIBUTE_NAME VARCHAR(200) NOT NULL,
ATTRIBUTE_BYTES JSONB NOT NULL,
CONSTRAINT SPRING_SESSION_ATTRIBUTES_PK PRIMARY KEY (SESSION_PRIMARY_ID, ATTRIBUTE_NAME),
CONSTRAINT SPRING_SESSION_ATTRIBUTES_FK FOREIGN KEY (SESSION_PRIMARY_ID) REFERENCES SPRING_SESSION (PRIMARY_ID) ON DELETE CASCADE
);

BIN
spring-session-samples/spring-session-sample-boot-jdbc-json-attribute/src/main/resources/static/favicon.ico Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 1.1 KiB

BIN
spring-session-samples/spring-session-sample-boot-jdbc-json-attribute/src/main/resources/static/images/logo.png Normal file
View File

Binary file not shown.
Side by Side

After

Width:  |  Height:  |  Size: 1.1 KiB

11
spring-session-samples/spring-session-sample-boot-jdbc-json-attribute/src/main/resources/templates/index.html Normal file
View File

@@ -0,0 +1,11 @@
<html xmlns:th="https://www.thymeleaf.org" xmlns:layout="https://github.com/ultraq/thymeleaf-layout-dialect" layout:decorate="~{layout}">
<head>
<title>Secured Content</title>
</head>
<body>
<div layout:fragment="content">
<h1>Secured Page</h1>
<p>This page is secured using Spring Boot, Spring Session, and Spring Security.</p>
</div>
</body>
</html>

121
spring-session-samples/spring-session-sample-boot-jdbc-json-attribute/src/main/resources/templates/layout.html Normal file
View File

@@ -0,0 +1,121 @@
<!DOCTYPE html SYSTEM "https://www.thymeleaf.org/dtd/xhtml1-strict-thymeleaf-spring4-3.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
xmlns:th="https://www.thymeleaf.org"
xmlns:layout="https://github.com/ultraq/thymeleaf-layout-dialect">
<head>
<title layout:title-pattern="$LAYOUT_TITLE - $CONTENT_TITLE">Spring Session Sample</title>
<link rel="icon" type="image/x-icon" th:href="@{/favicon.ico}" href="../static/favicon.ico"/>
<link th:href="@{/webjars/bootstrap/css/bootstrap.min.css}" href="/webjars/bootstrap/css/bootstrap.min.css" rel="stylesheet"></link>
<style type="text/css">
/* Sticky footer styles
-------------------------------------------------- */
html,
body {
height: 100%;
/* The html and body elements cannot have any padding or margin. */
}
/* Wrapper for page content to push down footer */
#wrap {
min-height: 100%;
height: auto !important;
height: 100%;
/* Negative indent footer by it's height */
margin: 0 auto -60px;
}
/* Set the fixed height of the footer here */
#push,
#footer {
height: 60px;
}
#footer {
background-color: #f5f5f5;
}
/* Lastly, apply responsive CSS fixes as necessary */
@media (max-width: 767px) {
#footer {
margin-left: -20px;
margin-right: -20px;
padding-left: 20px;
padding-right: 20px;
}
}
/* Custom page CSS
-------------------------------------------------- */
/* Not required for template or sticky footer method. */
.container {
width: auto;
max-width: 680px;
}
.container .credit {
margin: 20px 0;
text-align: center;
}
a {
color: green;
}
.navbar-form {
margin-left: 1em;
}
</style>
<link th:href="@{/webjars/bootstrap/css/bootstrap-responsive.min.css}" href="/webjars/bootstrap/css/bootstrap-responsive.min.css" rel="stylesheet"></link>
<!-- HTML5 shim, for IE6-8 support of HTML5 elements -->
<!--[if lt IE 9]>
<script th:src="@{/webjars/html5shiv/html5shiv.min.js}" src="/webjars/html5shiv/html5shiv.min.js"></script>
<![endif]-->
</head>
<body>
<div id="wrap">
<div class="navbar navbar-inverse navbar-static-top">
<div class="navbar-inner">
<div class="container">
<a class="brand" th:href="@{/}"><img th:src="@{/images/logo.png}" alt="Spring Security Sample"/></a>
<div class="nav-collapse collapse">
<div th:if="${currentUserName != null}">
<form class="navbar-form pull-right" th:action="@{/logout}" method="post">
<input type="submit" value="Log out" />
</form>
<p id="un" class="navbar-text pull-right" th:text="${currentUserName}">
sample_user
</p>
</div>
<ul class="nav">
</ul>
</div>
</div>
</div>
</div>
<!-- Begin page content -->
<div class="container">
<div class="alert alert-success"
th:if="${globalMessage}"
th:text="${globalMessage}">
Some Success message
</div>
<div layout:fragment="content">
Fake content
</div>
</div>
<div id="push"><!-- --></div>
</div>
<div id="footer">
<div class="container">
<p class="muted credit">Visit the <a href="https://projects.spring.io/spring-session/">Spring Session</a> site for more <a href="https://github.com/spring-projects/spring-session/tree/main/spring-session-samples">samples</a>.</p>
</div>
</div>
</body>
</html>

11
spring-session-samples/spring-session-sample-boot-jdbc-json-attribute/src/test/java/sample/JdbcJsonAttributeTestApplication.java Normal file
View File

@@ -0,0 +1,11 @@
package sample;
import org.springframework.boot.SpringApplication;
public class JdbcJsonAttributeTestApplication {
public static void main(String[] args) {
SpringApplication.from(JdbcJsonAttributeApplication::main).with(TestContainersConfig.class).run(args);
}
}

85
spring-session-samples/spring-session-sample-boot-jdbc-json-attribute/src/test/java/sample/JdbcJsonAttributeTests.java Normal file
View File

@@ -0,0 +1,85 @@
package sample;
import java.sql.Types;
import java.util.Base64;
import java.util.List;
import java.util.Map;
import com.fasterxml.jackson.databind.ObjectMapper;
import jakarta.servlet.http.Cookie;
import org.assertj.core.api.Assertions;
import org.junit.jupiter.api.BeforeEach;
import org.junit.jupiter.api.Test;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.boot.test.autoconfigure.web.servlet.AutoConfigureMockMvc;
import org.springframework.boot.test.context.SpringBootTest;
import org.springframework.context.annotation.Import;
import org.springframework.jdbc.core.simple.JdbcClient;
import org.springframework.security.core.context.SecurityContext;
import org.springframework.security.jackson2.SecurityJackson2Modules;
import org.springframework.test.web.servlet.MockMvc;
import static org.assertj.core.api.Assertions.assertThat;
import static org.springframework.security.test.web.servlet.request.SecurityMockMvcRequestBuilders.formLogin;
import static org.springframework.security.test.web.servlet.response.SecurityMockMvcResultMatchers.authenticated;
@SpringBootTest(webEnvironment = SpringBootTest.WebEnvironment.RANDOM_PORT)
@AutoConfigureMockMvc
@Import(TestContainersConfig.class)
public class JdbcJsonAttributeTests {
@Autowired
MockMvc mvc;
@Autowired
ObjectMapper objectMapper;
ObjectMapper objectMapperWithModules;
@Autowired
JdbcClient jdbcClient;
@BeforeEach
void setup() {
ObjectMapper copy = this.objectMapper.copy();
copy.registerModules(SecurityJackson2Modules.getModules(getClass().getClassLoader()));
this.objectMapperWithModules = copy;
this.jdbcClient.sql("DELETE FROM spring_session_attributes").update();
this.jdbcClient.sql("DELETE FROM spring_session").update();
}
@Test
void loginShouldSaveSecurityContextAsJson() throws Exception {
Cookie sessionCookie = this.mvc.perform(formLogin().user("user").password("password"))
.andExpect(authenticated())
.andReturn()
.getResponse()
.getCookie("SESSION");
String sessionId = new String(Base64.getDecoder().decode(sessionCookie.getValue()));
Object attributeBytes = this.jdbcClient.sql("""
SELECT attribute_bytes::text FROM spring_session_attributes
INNER JOIN spring_session s ON s.primary_id = session_primary_id
WHERE attribute_name = 'SPRING_SECURITY_CONTEXT'
AND s.session_id = :id
""").param("id", sessionId).query().singleValue();
SecurityContext securityContext = this.objectMapperWithModules.readValue((String) attributeBytes,
SecurityContext.class);
assertThat(securityContext).isNotNull();
assertThat(securityContext.getAuthentication().getName()).isEqualTo("user");
}
@Test
void loginWhenQueryUsingJsonbOperatorThenReturns() throws Exception {
this.mvc.perform(formLogin().user("user").password("password")).andExpect(authenticated());
Object attributeBytes = this.jdbcClient.sql("""
SELECT attribute_bytes::text FROM spring_session_attributes
WHERE attribute_bytes -> 'authentication' -> 'principal' ->> 'username' = 'user'
""").query().singleValue();
SecurityContext securityContext = this.objectMapperWithModules.readValue((String) attributeBytes,
SecurityContext.class);
assertThat(securityContext).isNotNull();
assertThat(securityContext.getAuthentication().getName()).isEqualTo("user");
}
}

26
spring-session-samples/spring-session-sample-boot-jdbc-json-attribute/src/test/java/sample/TestContainersConfig.java Normal file
View File

@@ -0,0 +1,26 @@
package sample;
import org.testcontainers.containers.PostgreSQLContainer;
import org.testcontainers.utility.DockerImageName;
import org.springframework.boot.test.context.TestConfiguration;
import org.springframework.boot.testcontainers.service.connection.ServiceConnection;
import org.springframework.context.annotation.Bean;
@TestConfiguration(proxyBeanMethods = false)
public class TestContainersConfig {
static PostgreSQLContainer<?> postgresql = new PostgreSQLContainer<>(DockerImageName.parse("postgres:16.1"))
.withExposedPorts(5432);
static {
postgresql.start();
}
@Bean
@ServiceConnection
PostgreSQLContainer<?> postgresContainer() {
return postgresql;
}
}