Cwikius-Spring/spring-security
1
0
Fork 0
mirror of https://github.com/spring-projects/spring-security.git synced 2025-06-28 23:02:15 +00:00
Code Issues Packages Projects Releases Wiki Activity

Polish HeadersSpec

Browse Source 
Fixes: gh-5187
This commit is contained in:
Rob Winch 2018-03-26 20:01:40 -05:00
parent 9b692b9616
commit 6e1e977778
2 changed files with 50 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

32
config/src/main/java/org/springframework/security/config/web/server/ServerHttpSecurity.java
View File

@ -644,6 +644,11 @@ public class ServerHttpSecurity {
return ServerHttpSecurity.this; return ServerHttpSecurity.this;
} }
public ServerHttpSecurity disable() {
ServerHttpSecurity.this.headers = null;
return ServerHttpSecurity.this;
}
public CacheSpec cache() { public CacheSpec cache() {
return new CacheSpec(); return new CacheSpec();
} }
@ -671,27 +676,36 @@ public class ServerHttpSecurity {
} }
public class CacheSpec { public class CacheSpec {
public void disable() { public HeaderSpec disable() {
HeaderSpec.this.writers.remove(HeaderSpec.this.cacheControl); HeaderSpec.this.writers.remove(HeaderSpec.this.cacheControl);
return HeaderSpec.this;
} }
private CacheSpec() {} private CacheSpec() {}
} }
public class ContentTypeOptionsSpec { public class ContentTypeOptionsSpec {
public void disable() { public HeaderSpec disable() {
HeaderSpec.this.writers.remove(HeaderSpec.this.contentTypeOptions); HeaderSpec.this.writers.remove(HeaderSpec.this.contentTypeOptions);
return HeaderSpec.this;
} }
private ContentTypeOptionsSpec() {} private ContentTypeOptionsSpec() {}
} }
public class FrameOptionsSpec { public class FrameOptionsSpec {
public void mode(XFrameOptionsServerHttpHeadersWriter.Mode mode) { public FrameOptionsSpec mode(XFrameOptionsServerHttpHeadersWriter.Mode mode) {
HeaderSpec.this.frameOptions.setMode(mode); HeaderSpec.this.frameOptions.setMode(mode);
return this;
} }
public void disable() {
public HeaderSpec and() {
return HeaderSpec.this;
}
public HeaderSpec disable() {
HeaderSpec.this.writers.remove(HeaderSpec.this.frameOptions); HeaderSpec.this.writers.remove(HeaderSpec.this.frameOptions);
return HeaderSpec.this;
} }
private FrameOptionsSpec() {} private FrameOptionsSpec() {}
@ -706,16 +720,22 @@ public class ServerHttpSecurity {
HeaderSpec.this.hsts.setIncludeSubDomains(includeSubDomains); HeaderSpec.this.hsts.setIncludeSubDomains(includeSubDomains);
} }
public void disable() { public HeaderSpec and() {
return HeaderSpec.this;
}
public HeaderSpec disable() {
HeaderSpec.this.writers.remove(HeaderSpec.this.hsts); HeaderSpec.this.writers.remove(HeaderSpec.this.hsts);
return HeaderSpec.this;
} }
private HstsSpec() {} private HstsSpec() {}
} }
public class XssProtectionSpec { public class XssProtectionSpec {
public void disable() { public HeaderSpec disable() {
HeaderSpec.this.writers.remove(HeaderSpec.this.xss); HeaderSpec.this.writers.remove(HeaderSpec.this.xss);
return HeaderSpec.this;
} }
private XssProtectionSpec() {} private XssProtectionSpec() {}

27
config/src/test/java/org/springframework/security/config/web/server/HeaderSpecTests.java
View File

@ -60,6 +60,23 @@ public class HeaderSpecTests {
.add(XXssProtectionServerHttpHeadersWriter.X_XSS_PROTECTION, "1 ; mode=block"); .add(XXssProtectionServerHttpHeadersWriter.X_XSS_PROTECTION, "1 ; mode=block");
} }
@Test
public void headersWhenDisableThenNoSecurityHeaders() {
new HashSet<>(this.expectedHeaders.keySet()).forEach(this::expectHeaderNamesNotPresent);
this.headers.disable();
assertHeaders();
}
@Test
public void headersWhenDisableAndInvokedExplicitlyThenDefautsUsed() {
this.headers.disable()
.headers();
assertHeaders();
}
@Test @Test
public void headersWhenDefaultsThenAllDefaultsWritten() { public void headersWhenDefaultsThenAllDefaultsWritten() {
assertHeaders(); assertHeaders();
@ -110,7 +127,9 @@ public class HeaderSpecTests {
@Test @Test
public void headersWhenFrameOptionsModeThenFrameOptionsCustomMode() { public void headersWhenFrameOptionsModeThenFrameOptionsCustomMode() {
this.expectedHeaders.set(XFrameOptionsServerHttpHeadersWriter.X_FRAME_OPTIONS, "SAMEORIGIN"); this.expectedHeaders.set(XFrameOptionsServerHttpHeadersWriter.X_FRAME_OPTIONS, "SAMEORIGIN");
this.headers.frameOptions().mode(XFrameOptionsServerHttpHeadersWriter.Mode.SAMEORIGIN); this.headers
.frameOptions()
.mode(XFrameOptionsServerHttpHeadersWriter.Mode.SAMEORIGIN);
assertHeaders(); assertHeaders();
} }
@ -139,8 +158,10 @@ public class HeaderSpecTests {
Map<String, List<String>> responseHeaders = response.getResponseHeaders(); Map<String, List<String>> responseHeaders = response.getResponseHeaders();
assertThat(responseHeaders).describedAs(response.toString()).containsAllEntriesOf( if (!this.expectedHeaders.isEmpty()) {
this.expectedHeaders); assertThat(responseHeaders).describedAs(response.toString())
.containsAllEntriesOf(this.expectedHeaders);
}
if (!this.headerNamesNotPresent.isEmpty()) { if (!this.headerNamesNotPresent.isEmpty()) {
assertThat(responseHeaders.keySet()).doesNotContainAnyElementsOf(this.headerNamesNotPresent); assertThat(responseHeaders.keySet()).doesNotContainAnyElementsOf(this.headerNamesNotPresent);
} }