Cwikius-Spring/spring-security
1
0
Fork 0
mirror of https://github.com/spring-projects/spring-security.git synced 2025-06-28 14:52:24 +00:00
Code Issues Packages Projects Releases Wiki Activity

Polish CompositeLogoutHandler

Browse Source 
Issue gh-3895
This commit is contained in:
Rob Winch 2016-07-08 14:39:35 -05:00
parent 1effc1882a
commit 70787fc548
4 changed files with 27 additions and 58 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
web/src/main/java/org/springframework/security/web/authentication/logout/CompositeLogoutHandler.java
View File

@ -29,7 +29,7 @@ import org.springframework.util.Assert;
* Performs a logout through all the {@link LogoutHandler} implementations. * Performs a logout through all the {@link LogoutHandler} implementations.
* If any exception is thrown by * If any exception is thrown by
* {@link #logout(HttpServletRequest, HttpServletResponse, Authentication)}, * {@link #logout(HttpServletRequest, HttpServletResponse, Authentication)},
* next element in {@link #logoutHandlers} is not invoked. * no additional LogoutHandler are invoked.
* *
* @author Eddú Meléndez * @author Eddú Meléndez
* @since 4.2.0 * @since 4.2.0
@ -54,5 +54,4 @@ public final class CompositeLogoutHandler implements LogoutHandler {
handler.logout(request, response, authentication); handler.logout(request, response, authentication);
} }
} }
} }

2
web/src/main/java/org/springframework/security/web/authentication/logout/LogoutFilter.java
View File

@ -56,7 +56,7 @@ public class LogoutFilter extends GenericFilterBean {
private RequestMatcher logoutRequestMatcher; private RequestMatcher logoutRequestMatcher;
private LogoutHandler handler; private final LogoutHandler handler;
private final LogoutSuccessHandler logoutSuccessHandler; private final LogoutSuccessHandler logoutSuccessHandler;
// ~ Constructors // ~ Constructors

13
web/src/main/java/org/springframework/security/web/servletapi/HttpServlet3RequestFactory.java
View File

@ -45,6 +45,7 @@ import org.springframework.security.web.AuthenticationEntryPoint;
import org.springframework.security.web.authentication.logout.CompositeLogoutHandler; import org.springframework.security.web.authentication.logout.CompositeLogoutHandler;
import org.springframework.security.web.authentication.logout.LogoutHandler; import org.springframework.security.web.authentication.logout.LogoutHandler;
import org.springframework.util.Assert; import org.springframework.util.Assert;
import org.springframework.util.CollectionUtils;
/** /**
* Provides integration with the Servlet 3 APIs in addition to the ones found in * Provides integration with the Servlet 3 APIs in addition to the ones found in
@ -81,7 +82,6 @@ final class HttpServlet3RequestFactory implements HttpServletRequestFactory {
private AuthenticationTrustResolver trustResolver = new AuthenticationTrustResolverImpl(); private AuthenticationTrustResolver trustResolver = new AuthenticationTrustResolverImpl();
private AuthenticationEntryPoint authenticationEntryPoint; private AuthenticationEntryPoint authenticationEntryPoint;
private AuthenticationManager authenticationManager; private AuthenticationManager authenticationManager;
private List<LogoutHandler> logoutHandlers;
private LogoutHandler logoutHandler; private LogoutHandler logoutHandler;
HttpServlet3RequestFactory(String rolePrefix) { HttpServlet3RequestFactory(String rolePrefix) {
@ -146,7 +146,7 @@ final class HttpServlet3RequestFactory implements HttpServletRequestFactory {
* {@link HttpServletRequest#logout()}. * {@link HttpServletRequest#logout()}.
*/ */
public void setLogoutHandlers(List<LogoutHandler> logoutHandlers) { public void setLogoutHandlers(List<LogoutHandler> logoutHandlers) {
this.logoutHandlers = logoutHandlers; this.logoutHandler = CollectionUtils.isEmpty(logoutHandlers) ? null : new CompositeLogoutHandler(logoutHandlers);
} }
/** /**
@ -246,19 +246,16 @@ final class HttpServlet3RequestFactory implements HttpServletRequestFactory {
@Override @Override
public void logout() throws ServletException { public void logout() throws ServletException {
List<LogoutHandler> handlers = HttpServlet3RequestFactory.this.logoutHandlers; LogoutHandler handler = HttpServlet3RequestFactory.this.logoutHandler;
if (handlers == null) { if (handler == null) {
HttpServlet3RequestFactory.this.logger.debug( HttpServlet3RequestFactory.this.logger.debug(
"logoutHandlers is null, so allowing original HttpServletRequest to handle logout"); "logoutHandlers is null, so allowing original HttpServletRequest to handle logout");
super.logout(); super.logout();
return; return;
} else {
HttpServlet3RequestFactory.this.logoutHandler = new
CompositeLogoutHandler(handlers);
} }
Authentication authentication = SecurityContextHolder.getContext() Authentication authentication = SecurityContextHolder.getContext()
.getAuthentication(); .getAuthentication();
HttpServlet3RequestFactory.this.logoutHandler.logout(this, this.response, authentication); handler.logout(this, this.response, authentication);
} }
private boolean isAuthenticated() { private boolean isAuthenticated() {

65
web/src/test/java/org/springframework/security/web/authentication/logout/CompositeLogoutHandlerTests.java
View File

@ -28,9 +28,8 @@ import org.junit.rules.ExpectedException;
import org.mockito.InOrder; import org.mockito.InOrder;
import org.springframework.security.core.Authentication; import org.springframework.security.core.Authentication;
import org.springframework.test.util.ReflectionTestUtils;
import static org.assertj.core.api.Assertions.assertThat; import static org.assertj.core.api.Assertions.fail;
import static org.mockito.Matchers.any; import static org.mockito.Matchers.any;
import static org.mockito.Mockito.doThrow; import static org.mockito.Mockito.doThrow;
import static org.mockito.Mockito.inOrder; import static org.mockito.Mockito.inOrder;
@ -41,6 +40,8 @@ import static org.mockito.Mockito.verify;
/** /**
* @author Eddú Meléndez * @author Eddú Meléndez
* @author Rob Winch
* @since 4.2.0
*/ */
public class CompositeLogoutHandlerTests { public class CompositeLogoutHandlerTests {
@ -55,24 +56,16 @@ public class CompositeLogoutHandlerTests {
} }
@Test @Test
public void buildCompositeLogoutHandlerWithArray() { public void callLogoutHandlersSuccessfullyWithArray() {
LogoutHandler[] logoutHandlers = {new SecurityContextLogoutHandler()}; LogoutHandler securityContextLogoutHandler = mock(SecurityContextLogoutHandler.class);
LogoutHandler handler = new CompositeLogoutHandler(logoutHandlers); LogoutHandler csrfLogoutHandler = mock(SecurityContextLogoutHandler.class);
assertThat(ReflectionTestUtils.getField(handler, "logoutHandlers")).isNotNull();
assertThat(((List<LogoutHandler>)ReflectionTestUtils.getField(handler,
"logoutHandlers")).size())
.isEqualTo(1);
}
@Test LogoutHandler handler = new CompositeLogoutHandler(securityContextLogoutHandler, csrfLogoutHandler);
public void buildCompositeLogoutHandlerWithList() {
LogoutHandler securityContextLogoutHandler = new SecurityContextLogoutHandler(); handler.logout(mock(HttpServletRequest.class), mock(HttpServletResponse.class), mock(Authentication.class));
List<LogoutHandler> logoutHandlers = Arrays.asList(securityContextLogoutHandler);
LogoutHandler handler = new CompositeLogoutHandler(logoutHandlers); verify(securityContextLogoutHandler, times(1)).logout(any(HttpServletRequest.class), any(HttpServletResponse.class), any(Authentication.class));
assertThat(ReflectionTestUtils.getField(handler, "logoutHandlers")).isNotNull(); verify(csrfLogoutHandler, times(1)).logout(any(HttpServletRequest.class), any(HttpServletResponse.class), any(Authentication.class));
assertThat(((List<LogoutHandler>)ReflectionTestUtils.getField(handler,
"logoutHandlers")).size())
.isEqualTo(1);
} }
@Test @Test
@ -82,8 +75,6 @@ public class CompositeLogoutHandlerTests {
List<LogoutHandler> logoutHandlers = Arrays.asList(securityContextLogoutHandler, csrfLogoutHandler); List<LogoutHandler> logoutHandlers = Arrays.asList(securityContextLogoutHandler, csrfLogoutHandler);
LogoutHandler handler = new CompositeLogoutHandler(logoutHandlers); LogoutHandler handler = new CompositeLogoutHandler(logoutHandlers);
assertThat(ReflectionTestUtils.getField(handler, "logoutHandlers")).isNotNull();
assertThat(((List<LogoutHandler>)ReflectionTestUtils.getField(handler, "logoutHandlers")).size()).isEqualTo(2);
handler.logout(mock(HttpServletRequest.class), mock(HttpServletResponse.class), mock(Authentication.class)); handler.logout(mock(HttpServletRequest.class), mock(HttpServletResponse.class), mock(Authentication.class));
@ -93,42 +84,24 @@ public class CompositeLogoutHandlerTests {
@Test @Test
public void callLogoutHandlersThrowException() { public void callLogoutHandlersThrowException() {
LogoutHandler firstLogoutHandler = mock(FirstLogoutHandler.class); LogoutHandler firstLogoutHandler = mock(LogoutHandler.class);
LogoutHandler secondLogoutHandler = mock(SecondLogoutHandler.class); LogoutHandler secondLogoutHandler = mock(LogoutHandler.class);
doThrow(new IllegalArgumentException()).when(firstLogoutHandler).logout(any(HttpServletRequest.class), any(HttpServletResponse.class), any(Authentication.class)); doThrow(new IllegalArgumentException()).when(firstLogoutHandler).logout(any(HttpServletRequest.class), any(HttpServletResponse.class), any(Authentication.class));
List<LogoutHandler> logoutHandlers = Arrays.asList(firstLogoutHandler, secondLogoutHandler); List<LogoutHandler> logoutHandlers = Arrays.asList(firstLogoutHandler, secondLogoutHandler);
LogoutHandler handler = new CompositeLogoutHandler(logoutHandlers); LogoutHandler handler = new CompositeLogoutHandler(logoutHandlers);
assertThat(ReflectionTestUtils.getField(handler, "logoutHandlers")).isNotNull();
assertThat(((List<LogoutHandler>)ReflectionTestUtils.getField(handler, "logoutHandlers")).size()).isEqualTo(2);
try { try {
handler.logout(mock(HttpServletRequest.class), mock(HttpServletResponse.class), mock(Authentication.class)); handler.logout(mock(HttpServletRequest.class), mock(HttpServletResponse.class), mock(Authentication.class));
} catch (IllegalArgumentException ex) { fail("Expected Exception");
// Do nothing } catch (IllegalArgumentException success) {
} finally {
InOrder logoutHandlersInOrder = inOrder(firstLogoutHandler, secondLogoutHandler);
logoutHandlersInOrder.verify(firstLogoutHandler, times(1)).logout(any(HttpServletRequest.class), any(HttpServletResponse.class), any(Authentication.class));
logoutHandlersInOrder.verify(secondLogoutHandler, never()).logout(any(HttpServletRequest.class), any(HttpServletResponse.class), any(Authentication.class));
} }
}
static class FirstLogoutHandler implements LogoutHandler { InOrder logoutHandlersInOrder = inOrder(firstLogoutHandler, secondLogoutHandler);
@Override logoutHandlersInOrder.verify(firstLogoutHandler, times(1)).logout(any(HttpServletRequest.class), any(HttpServletResponse.class), any(Authentication.class));
public void logout(HttpServletRequest request, HttpServletResponse response, Authentication authentication) { logoutHandlersInOrder.verify(secondLogoutHandler, never()).logout(any(HttpServletRequest.class), any(HttpServletResponse.class), any(Authentication.class));
}
}
static class SecondLogoutHandler implements LogoutHandler {
@Override
public void logout(HttpServletRequest request, HttpServletResponse response, Authentication authentication) {
}
} }
} }