Skip to content

Commit ab098f1

Browse files
marcusdacoregiomarcusdacoregio
committed
Propagate TestSecurityContextHolder to SecurityContextHolder
Create SecurityMockMvcResultHandlers to define security related MockMvc ResultHandlers Create a method to allow copying the SecurityContext from the TestSecurityContextHolder to SecurityContextHolder Closes gh-9565
1 parent 017c218 commit ab098f1

File tree

4 files changed

+230
-0
lines changed

4 files changed

+230
-0
lines changed

‎docs/manual/src/docs/asciidoc/_includes/servlet/test/mockmvc.adoc

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1889,3 +1889,65 @@ mvc
18891889
}
18901890
----
18911891
====
1892+
1893+
=== SecurityMockMvcResultHandlers
1894+
1895+
Spring Security provides a few ``ResultHandler``s implementations.
1896+
In order to use Spring Security's ``ResultHandler``s implementations ensure the following static import is used:
1897+
1898+
[source,java]
1899+
----
1900+
import static org.springframework.security.test.web.servlet.response.SecurityMockMvcResultHandlers.*;
1901+
----
1902+
1903+
==== Exporting the SecurityContext
1904+
1905+
Often times we want to query a repository to see if some `MockMvc` request actually persisted in the database.
1906+
In some cases our repository query uses the <<data,Spring Data Integration>> to filter the results based on current user's username or any other property.
1907+
Let's see an example:
1908+
1909+
A repository interface:
1910+
[source,java]
1911+
----
1912+
private interface MessageRepository extends JpaRepository<Message, Long> {
1913+
@Query("SELECT m.content FROM Message m WHERE m.sentBy = ?#{ principal?.name }")
1914+
List<String> findAllUserMessages();
1915+
}
1916+
----
1917+
1918+
Our test scenario:
1919+
1920+
[source,java]
1921+
----
1922+
mvc
1923+
.perform(post("/message")
1924+
.content("New Message")
1925+
.contentType(MediaType.TEXT_PLAIN)
1926+
)
1927+
.andExpect(status().isOk());
1928+
1929+
List<String> userMessages = messageRepository.findAllUserMessages();
1930+
assertThat(userMessages).hasSize(1);
1931+
----
1932+
1933+
This test won't pass because after our request finishes, the `SecurityContextHolder` will be cleared out by the filter chain.
1934+
We can then export the `TestSecurityContextHolder` to our `SecurityContextHolder` and use it as we want:
1935+
1936+
[source,java]
1937+
----
1938+
mvc
1939+
.perform(post("/message")
1940+
.content("New Message")
1941+
.contentType(MediaType.TEXT_PLAIN)
1942+
)
1943+
.andDo(exportTestSecurityContext())
1944+
.andExpect(status().isOk());
1945+
1946+
List<String> userMessages = messageRepository.findAllUserMessages();
1947+
assertThat(userMessages).hasSize(1);
1948+
----
1949+
1950+
[NOTE]
1951+
====
1952+
Remember to clear the `SecurityContextHolder` between your tests, or it may leak amongst them
1953+
====

‎etc/checkstyle/checkstyle.xml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@
1414
<module name="io.spring.javaformat.checkstyle.SpringChecks">
1515
<property name="excludes" value="io.spring.javaformat.checkstyle.check.SpringHeaderCheck" />
1616
<property name="avoidStaticImportExcludes" value="org.springframework.security.test.web.reactive.server.SecurityMockServerConfigurers.*" />
17+
<property name="avoidStaticImportExcludes" value="org.springframework.security.test.web.servlet.response.SecurityMockMvcResultHandlers.*" />
1718
</module>
1819
<module name="com.puppycrawl.tools.checkstyle.TreeWalker">
1920
<module name="com.puppycrawl.tools.checkstyle.checks.regexp.RegexpSinglelineJavaCheck">

‎test/src/main/java/org/springframework/security/test/web/servlet/response/SecurityMockMvcResultHandlers.java

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
/*
2+
* Copyright 2002-2021 the original author or authors.
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* https://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
package org.springframework.security.test.web.servlet.response;
18+
19+
import org.springframework.security.core.context.SecurityContext;
20+
import org.springframework.security.core.context.SecurityContextHolder;
21+
import org.springframework.security.test.context.TestSecurityContextHolder;
22+
import org.springframework.test.web.servlet.MockMvc;
23+
import org.springframework.test.web.servlet.MvcResult;
24+
import org.springframework.test.web.servlet.ResultHandler;
25+
26+
/**
27+
* Security related {@link MockMvc} {@link ResultHandler}s
28+
*
29+
* @author Marcus da Coregio
30+
* @since 5.6
31+
*/
32+
public final class SecurityMockMvcResultHandlers {
33+
34+
private SecurityMockMvcResultHandlers() {
35+
}
36+
37+
/**
38+
* Exports the {@link SecurityContext} from {@link TestSecurityContextHolder} to
39+
* {@link SecurityContextHolder}
40+
*/
41+
public static ResultHandler exportTestSecurityContext() {
42+
return new ExportTestSecurityContextHandler();
43+
}
44+
45+
/**
46+
* A {@link ResultHandler} that copies the {@link SecurityContext} from
47+
* {@link TestSecurityContextHolder} to {@link SecurityContextHolder}
48+
*
49+
* @author Marcus da Coregio
50+
* @since 5.6
51+
*/
52+
private static class ExportTestSecurityContextHandler implements ResultHandler {
53+
54+
@Override
55+
public void handle(MvcResult result) {
56+
SecurityContextHolder.setContext(TestSecurityContextHolder.getContext());
57+
}
58+
59+
}
60+
61+
}

‎test/src/test/java/org/springframework/security/test/web/servlet/response/SecurityMockMvcResultHandlersTest.java

Lines changed: 106 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,106 @@
1+
/*
2+
* Copyright 2002-2021 the original author or authors.
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* https://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
package org.springframework.security.test.web.servlet.response;
18+
19+
import org.junit.jupiter.api.AfterEach;
20+
import org.junit.jupiter.api.BeforeEach;
21+
import org.junit.jupiter.api.Test;
22+
import org.junit.jupiter.api.extension.ExtendWith;
23+
24+
import org.springframework.beans.factory.annotation.Autowired;
25+
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
26+
import org.springframework.security.core.Authentication;
27+
import org.springframework.security.core.context.SecurityContextHolder;
28+
import org.springframework.security.test.context.support.WithMockUser;
29+
import org.springframework.test.context.ContextConfiguration;
30+
import org.springframework.test.context.junit.jupiter.SpringExtension;
31+
import org.springframework.test.context.web.WebAppConfiguration;
32+
import org.springframework.test.web.servlet.MockMvc;
33+
import org.springframework.test.web.servlet.setup.MockMvcBuilders;
34+
import org.springframework.web.bind.annotation.RequestMapping;
35+
import org.springframework.web.bind.annotation.RestController;
36+
import org.springframework.web.context.WebApplicationContext;
37+
import org.springframework.web.servlet.config.annotation.EnableWebMvc;
38+
39+
import static org.assertj.core.api.Assertions.assertThat;
40+
import static org.springframework.security.test.web.servlet.response.SecurityMockMvcResultHandlers.exportTestSecurityContext;
41+
import static org.springframework.security.test.web.servlet.setup.SecurityMockMvcConfigurers.springSecurity;
42+
import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get;
43+
44+
@ExtendWith(SpringExtension.class)
45+
@ContextConfiguration(classes = SecurityMockMvcResultHandlersTest.Config.class)
46+
@WebAppConfiguration
47+
public class SecurityMockMvcResultHandlersTest {
48+
49+
@Autowired
50+
private WebApplicationContext context;
51+
52+
private MockMvc mockMvc;
53+
54+
@BeforeEach
55+
public void setup() {
56+
// @formatter:off
57+
this.mockMvc = MockMvcBuilders
58+
.webAppContextSetup(this.context)
59+
.apply(springSecurity())
60+
.build();
61+
// @formatter:on
62+
}
63+
64+
@AfterEach
65+
public void tearDown() {
66+
SecurityContextHolder.clearContext();
67+
}
68+
69+
@Test
70+
@WithMockUser
71+
public void withTestSecurityContextCopiedToSecurityContextHolder() throws Exception {
72+
this.mockMvc.perform(get("/")).andDo(exportTestSecurityContext());
73+
74+
Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
75+
76+
assertThat(authentication.getName()).isEqualTo("user");
77+
assertThat(authentication.getAuthorities()).hasSize(1).first().hasToString("ROLE_USER");
78+
}
79+
80+
@Test
81+
@WithMockUser
82+
public void withTestSecurityContextNotCopiedToSecurityContextHolder() throws Exception {
83+
this.mockMvc.perform(get("/"));
84+
85+
Authentication authentication = SecurityContextHolder.getContext().getAuthentication();
86+
87+
assertThat(authentication).isNull();
88+
}
89+
90+
@EnableWebSecurity
91+
@EnableWebMvc
92+
static class Config {
93+
94+
@RestController
95+
static class Controller {
96+
97+
@RequestMapping("/")
98+
String ok() {
99+
return "ok";
100+
}
101+
102+
}
103+
104+
}
105+
106+
}

0 commit comments

Comments
 (0)