Add Reactive Clear-Site-Data Support
1. A new implementation of ServerHttpHeadersWriter has been created to add Clear-Site-Data header support. 2. A new implementation of ServerLogoutHandler has been created which can be configured to write response headers during logout. 3. Added unit tests for both implementations. Fixes gh-6743
This commit is contained in:
parent
19e823f8d3
commit
2c136f7b6c
|
@ -0,0 +1,50 @@
|
||||||
|
/*
|
||||||
|
* Copyright 2002-2019 the original author or authors.
|
||||||
|
*
|
||||||
|
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
* you may not use this file except in compliance with the License.
|
||||||
|
* You may obtain a copy of the License at
|
||||||
|
*
|
||||||
|
* https://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
*
|
||||||
|
* Unless required by applicable law or agreed to in writing, software
|
||||||
|
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
* See the License for the specific language governing permissions and
|
||||||
|
* limitations under the License.
|
||||||
|
*/
|
||||||
|
package org.springframework.security.web.server.authentication.logout;
|
||||||
|
|
||||||
|
import org.springframework.security.core.Authentication;
|
||||||
|
import org.springframework.security.web.server.WebFilterExchange;
|
||||||
|
import org.springframework.security.web.server.header.ServerHttpHeadersWriter;
|
||||||
|
import org.springframework.util.Assert;
|
||||||
|
|
||||||
|
import reactor.core.publisher.Mono;
|
||||||
|
|
||||||
|
/**
|
||||||
|
* <p>A {@link ServerLogoutHandler} implementation which writes HTTP headers during logout.</p>
|
||||||
|
*
|
||||||
|
* @author MD Sayem Ahmed
|
||||||
|
* @since 5.2
|
||||||
|
*/
|
||||||
|
public final class HeaderWriterServerLogoutHandler implements ServerLogoutHandler {
|
||||||
|
private final ServerHttpHeadersWriter headersWriter;
|
||||||
|
|
||||||
|
/**
|
||||||
|
* <p>Constructs a new instance using the {@link ServerHttpHeadersWriter} implementation.</p>
|
||||||
|
|
||||||
|
* @param headersWriter a {@link ServerHttpHeadersWriter} implementation
|
||||||
|
* @throws IllegalArgumentException if the argument is null
|
||||||
|
*/
|
||||||
|
public HeaderWriterServerLogoutHandler(ServerHttpHeadersWriter headersWriter) {
|
||||||
|
Assert.notNull(headersWriter, "headersWriter cannot be null");
|
||||||
|
this.headersWriter = headersWriter;
|
||||||
|
}
|
||||||
|
|
||||||
|
@Override
|
||||||
|
public Mono<Void> logout(WebFilterExchange exchange, Authentication authentication) {
|
||||||
|
return this.headersWriter
|
||||||
|
.writeHttpHeaders(exchange.getExchange());
|
||||||
|
}
|
||||||
|
}
|
|
@ -0,0 +1,95 @@
|
||||||
|
/*
|
||||||
|
* Copyright 2002-2019 the original author or authors.
|
||||||
|
*
|
||||||
|
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
* you may not use this file except in compliance with the License.
|
||||||
|
* You may obtain a copy of the License at
|
||||||
|
*
|
||||||
|
* https://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
*
|
||||||
|
* Unless required by applicable law or agreed to in writing, software
|
||||||
|
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
* See the License for the specific language governing permissions and
|
||||||
|
* limitations under the License.
|
||||||
|
*/
|
||||||
|
package org.springframework.security.web.server.header;
|
||||||
|
|
||||||
|
import org.springframework.util.Assert;
|
||||||
|
import org.springframework.web.server.ServerWebExchange;
|
||||||
|
|
||||||
|
import reactor.core.publisher.Mono;
|
||||||
|
|
||||||
|
import java.util.stream.Collectors;
|
||||||
|
import java.util.stream.Stream;
|
||||||
|
|
||||||
|
/**
|
||||||
|
* <p>Writes the {@code Clear-Site-Data} response header when the request is secure.</p>
|
||||||
|
*
|
||||||
|
* <p>For further details pleaes consult <a href="https://www.w3.org/TR/clear-site-data/">W3C Documentation</a>.</p>
|
||||||
|
*
|
||||||
|
* @author MD Sayem Ahmed
|
||||||
|
* @since 5.2
|
||||||
|
*/
|
||||||
|
public final class ClearSiteDataServerHttpHeadersWriter implements ServerHttpHeadersWriter {
|
||||||
|
public static final String CLEAR_SITE_DATA_HEADER = "Clear-Site-Data";
|
||||||
|
|
||||||
|
private final StaticServerHttpHeadersWriter headerWriterDelegate;
|
||||||
|
|
||||||
|
/**
|
||||||
|
* <p>Constructs a new instance using the given directives.</p>
|
||||||
|
*
|
||||||
|
* @param directives directives that will be written as the header value
|
||||||
|
* @throws IllegalArgumentException if the argument is null or empty
|
||||||
|
*/
|
||||||
|
public ClearSiteDataServerHttpHeadersWriter(Directive... directives) {
|
||||||
|
Assert.notEmpty(directives, "directives cannot be empty or null.");
|
||||||
|
this.headerWriterDelegate = StaticServerHttpHeadersWriter.builder()
|
||||||
|
.header(CLEAR_SITE_DATA_HEADER, transformToHeaderValue(directives))
|
||||||
|
.build();
|
||||||
|
}
|
||||||
|
|
||||||
|
@Override
|
||||||
|
public Mono<Void> writeHttpHeaders(ServerWebExchange exchange) {
|
||||||
|
if (isSecure(exchange)) {
|
||||||
|
return this.headerWriterDelegate
|
||||||
|
.writeHttpHeaders(exchange);
|
||||||
|
} else {
|
||||||
|
return Mono.empty();
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
/**
|
||||||
|
* <p>Represents the directive values expected by the {@link ClearSiteDataServerHttpHeadersWriter}</p>.
|
||||||
|
*/
|
||||||
|
public enum Directive {
|
||||||
|
CACHE("cache"),
|
||||||
|
COOKIES("cookies"),
|
||||||
|
STORAGE("storage"),
|
||||||
|
EXECUTION_CONTEXTS("executionContexts"),
|
||||||
|
ALL("*");
|
||||||
|
|
||||||
|
private final String headerValue;
|
||||||
|
|
||||||
|
Directive(String headerValue) {
|
||||||
|
this.headerValue = "\"" + headerValue + "\"";
|
||||||
|
}
|
||||||
|
|
||||||
|
public String getHeaderValue() {
|
||||||
|
return this.headerValue;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
private String transformToHeaderValue(Directive... directives) {
|
||||||
|
return Stream.of(directives)
|
||||||
|
.map(Directive::getHeaderValue)
|
||||||
|
.collect(Collectors.joining(", "));
|
||||||
|
}
|
||||||
|
|
||||||
|
private boolean isSecure(ServerWebExchange exchange) {
|
||||||
|
String scheme = exchange.getRequest()
|
||||||
|
.getURI()
|
||||||
|
.getScheme();
|
||||||
|
return scheme != null && scheme.equalsIgnoreCase("https");
|
||||||
|
}
|
||||||
|
}
|
|
@ -0,0 +1,55 @@
|
||||||
|
/*
|
||||||
|
* Copyright 2002-2019 the original author or authors.
|
||||||
|
*
|
||||||
|
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
* you may not use this file except in compliance with the License.
|
||||||
|
* You may obtain a copy of the License at
|
||||||
|
*
|
||||||
|
* https://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
*
|
||||||
|
* Unless required by applicable law or agreed to in writing, software
|
||||||
|
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
* See the License for the specific language governing permissions and
|
||||||
|
* limitations under the License.
|
||||||
|
*/
|
||||||
|
package org.springframework.security.web.server.authentication.logout;
|
||||||
|
|
||||||
|
import org.springframework.security.core.Authentication;
|
||||||
|
import org.springframework.security.web.server.WebFilterExchange;
|
||||||
|
import org.springframework.security.web.server.header.ServerHttpHeadersWriter;
|
||||||
|
import org.springframework.web.server.ServerWebExchange;
|
||||||
|
|
||||||
|
import org.junit.Test;
|
||||||
|
|
||||||
|
import static org.assertj.core.api.Assertions.assertThatExceptionOfType;
|
||||||
|
import static org.mockito.Mockito.mock;
|
||||||
|
import static org.mockito.Mockito.verify;
|
||||||
|
import static org.mockito.Mockito.when;
|
||||||
|
|
||||||
|
/**
|
||||||
|
* @author MD Sayem Ahmed
|
||||||
|
* @since 5.2
|
||||||
|
*/
|
||||||
|
public class HeaderWriterServerLogoutHandlerTests {
|
||||||
|
|
||||||
|
@Test
|
||||||
|
public void constructorWhenHeadersWriterIsNullThenExceptionThrown() {
|
||||||
|
assertThatExceptionOfType(IllegalArgumentException.class)
|
||||||
|
.isThrownBy(() -> new HeaderWriterServerLogoutHandler(null));
|
||||||
|
}
|
||||||
|
|
||||||
|
@Test
|
||||||
|
public void logoutWhenInvokedThenWritesResponseHeaders() {
|
||||||
|
ServerHttpHeadersWriter headersWriter = mock(ServerHttpHeadersWriter.class);
|
||||||
|
HeaderWriterServerLogoutHandler handler = new HeaderWriterServerLogoutHandler(headersWriter);
|
||||||
|
ServerWebExchange serverWebExchange = mock(ServerWebExchange.class);
|
||||||
|
WebFilterExchange filterExchange = mock(WebFilterExchange.class);
|
||||||
|
when(filterExchange.getExchange()).thenReturn(serverWebExchange);
|
||||||
|
Authentication authentication = mock(Authentication.class);
|
||||||
|
|
||||||
|
handler.logout(filterExchange, authentication);
|
||||||
|
|
||||||
|
verify(headersWriter).writeHttpHeaders(serverWebExchange);
|
||||||
|
}
|
||||||
|
}
|
|
@ -0,0 +1,120 @@
|
||||||
|
/*
|
||||||
|
* Copyright 2002-2019 the original author or authors.
|
||||||
|
*
|
||||||
|
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||||
|
* you may not use this file except in compliance with the License.
|
||||||
|
* You may obtain a copy of the License at
|
||||||
|
*
|
||||||
|
* https://www.apache.org/licenses/LICENSE-2.0
|
||||||
|
*
|
||||||
|
* Unless required by applicable law or agreed to in writing, software
|
||||||
|
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||||
|
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||||
|
* See the License for the specific language governing permissions and
|
||||||
|
* limitations under the License.
|
||||||
|
*/
|
||||||
|
package org.springframework.security.web.server.header;
|
||||||
|
|
||||||
|
import org.springframework.http.server.reactive.ServerHttpResponse;
|
||||||
|
import org.springframework.mock.http.server.reactive.MockServerHttpRequest;
|
||||||
|
import org.springframework.mock.web.server.MockServerWebExchange;
|
||||||
|
import org.springframework.security.web.server.header.ClearSiteDataServerHttpHeadersWriter.Directive;
|
||||||
|
import org.springframework.util.CollectionUtils;
|
||||||
|
import org.springframework.web.server.ServerWebExchange;
|
||||||
|
|
||||||
|
import org.assertj.core.api.AbstractAssert;
|
||||||
|
import org.junit.Test;
|
||||||
|
|
||||||
|
import java.util.List;
|
||||||
|
import java.util.stream.Collectors;
|
||||||
|
import java.util.stream.Stream;
|
||||||
|
|
||||||
|
import static org.assertj.core.api.Assertions.assertThatExceptionOfType;
|
||||||
|
|
||||||
|
/**
|
||||||
|
* @author MD Sayem Ahmed
|
||||||
|
* @since 5.2
|
||||||
|
*/
|
||||||
|
public class ClearSiteDataServerHttpHeadersWriterTests {
|
||||||
|
|
||||||
|
@Test
|
||||||
|
public void constructorWhenMissingDirectivesThenThrowsException() {
|
||||||
|
assertThatExceptionOfType(IllegalArgumentException.class)
|
||||||
|
.isThrownBy(ClearSiteDataServerHttpHeadersWriter::new);
|
||||||
|
}
|
||||||
|
|
||||||
|
@Test
|
||||||
|
public void writeHttpHeadersWhenSecureConnectionThenHeaderWritten() {
|
||||||
|
ClearSiteDataServerHttpHeadersWriter writer = new ClearSiteDataServerHttpHeadersWriter(Directive.ALL);
|
||||||
|
ServerWebExchange secureExchange = MockServerWebExchange.from(
|
||||||
|
MockServerHttpRequest.get("https://localhost")
|
||||||
|
.build());
|
||||||
|
|
||||||
|
writer.writeHttpHeaders(secureExchange);
|
||||||
|
|
||||||
|
assertThat(secureExchange.getResponse()).hasClearSiteDataHeaderDirectives(Directive.ALL);
|
||||||
|
}
|
||||||
|
|
||||||
|
@Test
|
||||||
|
public void writeHttpHeadersWhenInsecureConnectionThenHeaderNotWritten() {
|
||||||
|
ClearSiteDataServerHttpHeadersWriter writer = new ClearSiteDataServerHttpHeadersWriter(Directive.ALL);
|
||||||
|
ServerWebExchange insecureExchange = MockServerWebExchange.from(
|
||||||
|
MockServerHttpRequest.get("/")
|
||||||
|
.build());
|
||||||
|
|
||||||
|
writer.writeHttpHeaders(insecureExchange);
|
||||||
|
|
||||||
|
assertThat(insecureExchange.getResponse()).doesNotHaveClearSiteDataHeaderSet();
|
||||||
|
}
|
||||||
|
|
||||||
|
@Test
|
||||||
|
public void writeHttpHeadersWhenMultipleDirectivesSpecifiedThenHeaderContainsAll() {
|
||||||
|
ClearSiteDataServerHttpHeadersWriter writer = new ClearSiteDataServerHttpHeadersWriter(
|
||||||
|
Directive.CACHE, Directive.COOKIES);
|
||||||
|
ServerWebExchange secureExchange = MockServerWebExchange.from(
|
||||||
|
MockServerHttpRequest.get("https://localhost")
|
||||||
|
.build());
|
||||||
|
|
||||||
|
writer.writeHttpHeaders(secureExchange);
|
||||||
|
|
||||||
|
assertThat(secureExchange.getResponse()).hasClearSiteDataHeaderDirectives(Directive.CACHE, Directive.COOKIES);
|
||||||
|
}
|
||||||
|
|
||||||
|
private static ClearSiteDataAssert assertThat(ServerHttpResponse response) {
|
||||||
|
return new ClearSiteDataAssert(response);
|
||||||
|
}
|
||||||
|
|
||||||
|
private static class ClearSiteDataAssert extends AbstractAssert<ClearSiteDataAssert, ServerHttpResponse> {
|
||||||
|
|
||||||
|
ClearSiteDataAssert(ServerHttpResponse response) {
|
||||||
|
super(response, ClearSiteDataAssert.class);
|
||||||
|
}
|
||||||
|
|
||||||
|
void hasClearSiteDataHeaderDirectives(Directive... directives) {
|
||||||
|
isNotNull();
|
||||||
|
List<String> header = getHeader();
|
||||||
|
String actualHeaderValue = String.join("", header);
|
||||||
|
String expectedHeaderVale = Stream.of(directives)
|
||||||
|
.map(Directive::getHeaderValue)
|
||||||
|
.collect(Collectors.joining(", "));
|
||||||
|
if (!actualHeaderValue.equals(expectedHeaderVale)) {
|
||||||
|
failWithMessage("Expected to have %s as Clear-Site-Data header value but found %s",
|
||||||
|
expectedHeaderVale, actualHeaderValue);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
void doesNotHaveClearSiteDataHeaderSet() {
|
||||||
|
isNotNull();
|
||||||
|
List<String> header = getHeader();
|
||||||
|
if (!CollectionUtils.isEmpty(header)) {
|
||||||
|
failWithMessage("Expected not to have Clear-Site-Data header set but found %s",
|
||||||
|
String.join("", header));
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
List<String> getHeader() {
|
||||||
|
return actual.getHeaders()
|
||||||
|
.get(ClearSiteDataServerHttpHeadersWriter.CLEAR_SITE_DATA_HEADER);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
Loading…
Reference in New Issue