Cwikius-Spring/spring-security
1
0
Fork 0
mirror of https://github.com/spring-projects/spring-security.git synced 2025-03-01 02:49:11 +00:00
Code Issues Packages Projects Releases Wiki Activity

Use relative URLs in /login redirects

Browse Source 
Closes gh-7273
This commit is contained in:
Michal Okosy 2024-03-10 12:53:16 +01:00 committed by Josh Cummings
parent 25740db819
commit 7848b959da
24 changed files with 105 additions and 107 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
config/src/test/java/org/springframework/security/config/annotation/web/builders/NamespaceHttpTests.java
View File

@ -1,5 +1,5 @@
/*
* Copyright 2002-2022 the original author or authors.
* Copyright 2002-2024 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@ -77,7 +77,7 @@ import static org.springframework.security.test.web.servlet.request.SecurityMock
import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get;
import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.forwardedUrl;
import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.header;
import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.redirectedUrlPattern;
import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.redirectedUrl;
import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;
/**
@ -167,7 +167,7 @@ public class NamespaceHttpTests {
// @formatter:off
this.mockMvc.perform(get("/"))
.andExpect(status().is3xxRedirection())
.andExpect(redirectedUrlPattern("**/entry-point"));
.andExpect(redirectedUrl("/entry-point"));
// @formatter:on
}

2
config/src/test/java/org/springframework/security/config/annotation/web/configurers/DefaultLoginPageConfigurerTests.java
View File

@ -82,7 +82,7 @@ public class DefaultLoginPageConfigurerTests {
@Test
public void getWhenFormLoginEnabledThenRedirectsToLoginPage() throws Exception {
this.spring.register(DefaultLoginPageConfig.class).autowire();
this.mvc.perform(get("/")).andExpect(redirectedUrl("http://localhost/login"));
this.mvc.perform(get("/")).andExpect(redirectedUrl("/login"));
}
@Test

5
config/src/test/java/org/springframework/security/config/annotation/web/configurers/ExceptionHandlingConfigurerTests.java
View File

@ -1,5 +1,5 @@
/*
* Copyright 2002-2022 the original author or authors.
* Copyright 2002-2024 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@ -213,8 +213,7 @@ public class ExceptionHandlingConfigurerTests {
@Test
public void getWhenUsingDefaultsAndUnauthenticatedThenRedirectsToLogin() throws Exception {
this.spring.register(DefaultHttpConfig.class).autowire();
this.mvc.perform(get("/").header(HttpHeaders.ACCEPT, "bogus/type"))
.andExpect(redirectedUrl("http://localhost/login"));
this.mvc.perform(get("/").header(HttpHeaders.ACCEPT, "bogus/type")).andExpect(redirectedUrl("/login"));
}
@Test

8
config/src/test/java/org/springframework/security/config/annotation/web/configurers/FormLoginConfigurerTests.java
View File

@ -1,5 +1,5 @@
/*
* Copyright 2002-2022 the original author or authors.
* Copyright 2002-2024 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@ -162,7 +162,7 @@ public class FormLoginConfigurerTests {
// @formatter:off
this.mockMvc.perform(get("/private"))
.andExpect(status().isFound())
.andExpect(redirectedUrl("http://localhost/login"));
.andExpect(redirectedUrl("/login"));
// @formatter:on
}
@ -217,7 +217,7 @@ public class FormLoginConfigurerTests {
// @formatter:off
this.mockMvc.perform(get("/private"))
.andExpect(status().isFound())
.andExpect(redirectedUrl("http://localhost/login"));
.andExpect(redirectedUrl("/login"));
// @formatter:on
}
@ -331,7 +331,7 @@ public class FormLoginConfigurerTests {
// @formatter:off
this.mockMvc.perform(get("/login?error"))
.andExpect(status().isFound())
.andExpect(redirectedUrl("http://localhost/login"));
.andExpect(redirectedUrl("/login"));
// @formatter:on
}

8
config/src/test/java/org/springframework/security/config/annotation/web/configurers/NamespaceHttpFormLoginTests.java
View File

@ -1,5 +1,5 @@
/*
* Copyright 2002-2022 the original author or authors.
* Copyright 2002-2024 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@ -65,7 +65,7 @@ public class NamespaceHttpFormLoginTests {
@Test
public void formLoginWhenDefaultConfigurationThenMatchesNamespace() throws Exception {
this.spring.register(FormLoginConfig.class, UserDetailsServiceConfig.class).autowire();
this.mvc.perform(get("/")).andExpect(redirectedUrl("http://localhost/login"));
this.mvc.perform(get("/")).andExpect(redirectedUrl("/login"));
this.mvc.perform(post("/login").with(csrf())).andExpect(redirectedUrl("/login?error"));
// @formatter:off
MockHttpServletRequestBuilder loginRequest = post("/login")
@ -79,7 +79,7 @@ public class NamespaceHttpFormLoginTests {
@Test
public void formLoginWithCustomEndpointsThenBehaviorMatchesNamespace() throws Exception {
this.spring.register(FormLoginCustomConfig.class, UserDetailsServiceConfig.class).autowire();
this.mvc.perform(get("/")).andExpect(redirectedUrl("http://localhost/authentication/login"));
this.mvc.perform(get("/")).andExpect(redirectedUrl("/authentication/login"));
this.mvc.perform(post("/authentication/login/process").with(csrf()))
.andExpect(redirectedUrl("/authentication/login?failed"));
// @formatter:off
@ -94,7 +94,7 @@ public class NamespaceHttpFormLoginTests {
@Test
public void formLoginWithCustomHandlersThenBehaviorMatchesNamespace() throws Exception {
this.spring.register(FormLoginCustomRefsConfig.class, UserDetailsServiceConfig.class).autowire();
this.mvc.perform(get("/")).andExpect(redirectedUrl("http://localhost/login"));
this.mvc.perform(get("/")).andExpect(redirectedUrl("/login"));
this.mvc.perform(post("/login").with(csrf())).andExpect(redirectedUrl("/custom/failure"));
verifyBean(WebAuthenticationDetailsSource.class).buildDetails(any(HttpServletRequest.class));
// @formatter:off

6
config/src/test/java/org/springframework/security/config/annotation/web/configurers/NamespaceRememberMeTests.java
View File

@ -1,5 +1,5 @@
/*
* Copyright 2002-2022 the original author or authors.
* Copyright 2002-2024 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@ -104,7 +104,7 @@ public class NamespaceRememberMeTests {
.with(csrf())
.cookie(rememberMe);
this.mvc.perform(authenticationClassRequest)
.andExpect(redirectedUrl("http://localhost/login"))
.andExpect(redirectedUrl("/login"))
.andReturn();
// @formatter:on
}
@ -150,7 +150,7 @@ public class NamespaceRememberMeTests {
// @formatter:off
this.mvc.perform(somewhereRequest)
.andExpect(status().isFound())
.andExpect(redirectedUrl("http://localhost/login"));
.andExpect(redirectedUrl("/login"));
MockHttpServletRequestBuilder loginWithRememberme = post("/login").with(rememberMeLogin());
Cookie withKey = this.mvc.perform(loginWithRememberme)
.andReturn()

4
config/src/test/java/org/springframework/security/config/annotation/web/configurers/RememberMeConfigurerTests.java
View File

@ -1,5 +1,5 @@
/*
* Copyright 2002-2023 the original author or authors.
* Copyright 2002-2024 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@ -240,7 +240,7 @@ public class RememberMeConfigurerTests {
.with(csrf())
.cookie(expiredRememberMeCookie);
// @formatter:on
this.mvc.perform(expiredRequest).andExpect(redirectedUrl("http://localhost/login"));
this.mvc.perform(expiredRequest).andExpect(redirectedUrl("/login"));
}
@Test

20
config/src/test/java/org/springframework/security/config/annotation/web/configurers/RequestCacheConfigurerTests.java
View File

@ -1,5 +1,5 @@
/*
* Copyright 2002-2022 the original author or authors.
* Copyright 2002-2024 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@ -90,7 +90,7 @@ public class RequestCacheConfigurerTests {
this.spring.register(RequestCacheDefaultsConfig.class, DefaultSecurityConfig.class).autowire();
// @formatter:off
MockHttpSession session = (MockHttpSession) this.mvc.perform(get("/favicon.ico"))
.andExpect(redirectedUrl("http://localhost/login"))
.andExpect(redirectedUrl("/login"))
.andReturn()
.getRequest()
.getSession();
@ -104,7 +104,7 @@ public class RequestCacheConfigurerTests {
this.spring.register(RequestCacheDefaultsConfig.class, DefaultSecurityConfig.class).autowire();
// @formatter:off
MockHttpSession session = (MockHttpSession) this.mvc.perform(get("/favicon.png"))
.andExpect(redirectedUrl("http://localhost/login"))
.andExpect(redirectedUrl("/login"))
.andReturn()
.getRequest()
.getSession();
@ -120,7 +120,7 @@ public class RequestCacheConfigurerTests {
MockHttpServletRequestBuilder request = get("/messages").header(HttpHeaders.ACCEPT, MediaType.APPLICATION_JSON);
// @formatter:off
MockHttpSession session = (MockHttpSession) this.mvc.perform(request)
.andExpect(redirectedUrl("http://localhost/login"))
.andExpect(redirectedUrl("/login"))
.andReturn()
.getRequest()
.getSession();
@ -140,7 +140,7 @@ public class RequestCacheConfigurerTests {
.header("X-Requested-With", "XMLHttpRequest");
MockHttpSession session = (MockHttpSession) this.mvc
.perform(xRequestedWith)
.andExpect(redirectedUrl("http://localhost/login"))
.andExpect(redirectedUrl("/login"))
.andReturn()
.getRequest()
.getSession();
@ -157,7 +157,7 @@ public class RequestCacheConfigurerTests {
MediaType.TEXT_EVENT_STREAM);
// @formatter:off
MockHttpSession session = (MockHttpSession) this.mvc.perform(request)
.andExpect(redirectedUrl("http://localhost/login"))
.andExpect(redirectedUrl("/login"))
.andReturn()
.getRequest()
.getSession();
@ -174,7 +174,7 @@ public class RequestCacheConfigurerTests {
MockHttpServletRequestBuilder request = get("/messages").header(HttpHeaders.ACCEPT, MediaType.ALL);
// @formatter:off
MockHttpSession session = (MockHttpSession) this.mvc.perform(request)
.andExpect(redirectedUrl("http://localhost/login"))
.andExpect(redirectedUrl("/login"))
.andReturn()
.getRequest()
.getSession();
@ -188,7 +188,7 @@ public class RequestCacheConfigurerTests {
MockHttpServletRequestBuilder request = get("/messages").header(HttpHeaders.ACCEPT, MediaType.TEXT_HTML);
// @formatter:off
MockHttpSession session = (MockHttpSession) this.mvc.perform(request)
.andExpect(redirectedUrl("http://localhost/login"))
.andExpect(redirectedUrl("/login"))
.andReturn()
.getRequest()
.getSession();
@ -203,7 +203,7 @@ public class RequestCacheConfigurerTests {
MockHttpServletRequestBuilder request = get("/messages")
.header(HttpHeaders.ACCEPT, "text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8");
MockHttpSession session = (MockHttpSession) this.mvc.perform(request)
.andExpect(redirectedUrl("http://localhost/login"))
.andExpect(redirectedUrl("/login"))
.andReturn()
.getRequest()
.getSession();
@ -218,7 +218,7 @@ public class RequestCacheConfigurerTests {
MockHttpServletRequestBuilder request = get("/messages")
.header("X-Requested-With", "com.android");
MockHttpSession session = (MockHttpSession) this.mvc.perform(request)
.andExpect(redirectedUrl("http://localhost/login"))
.andExpect(redirectedUrl("/login"))
.andReturn()
.getRequest()
.getSession();

14
config/src/test/java/org/springframework/security/config/annotation/web/configurers/oauth2/client/OAuth2LoginConfigurerTests.java
View File

@ -437,7 +437,7 @@ public class OAuth2LoginConfigurerTests {
this.request = new MockHttpServletRequest("GET", requestUri);
this.request.setServletPath(requestUri);
this.springSecurityFilterChain.doFilter(this.request, this.response, this.filterChain);
assertThat(this.response.getRedirectedUrl()).matches("http://localhost/oauth2/authorization/google");
assertThat(this.response.getRedirectedUrl()).matches("/oauth2/authorization/google");
}
// gh-6802
@ -448,7 +448,7 @@ public class OAuth2LoginConfigurerTests {
this.request = new MockHttpServletRequest("GET", requestUri);
this.request.setServletPath(requestUri);
this.springSecurityFilterChain.doFilter(this.request, this.response, this.filterChain);
assertThat(this.response.getRedirectedUrl()).matches("http://localhost/login");
assertThat(this.response.getRedirectedUrl()).matches("/login");
}
// gh-5347
@ -461,7 +461,7 @@ public class OAuth2LoginConfigurerTests {
this.request.setServletPath(requestUri);
this.request.addHeader(HttpHeaders.ACCEPT, new MediaType("image", "*").toString());
this.springSecurityFilterChain.doFilter(this.request, this.response, this.filterChain);
assertThat(this.response.getRedirectedUrl()).matches("http://localhost/login");
assertThat(this.response.getRedirectedUrl()).matches("/login");
}
// gh-5347
@ -472,7 +472,7 @@ public class OAuth2LoginConfigurerTests {
this.request = new MockHttpServletRequest("GET", requestUri);
this.request.setServletPath(requestUri);
this.springSecurityFilterChain.doFilter(this.request, this.response, this.filterChain);
assertThat(this.response.getRedirectedUrl()).matches("http://localhost/login");
assertThat(this.response.getRedirectedUrl()).matches("/login");
}
// gh-6812
@ -521,7 +521,7 @@ public class OAuth2LoginConfigurerTests {
this.request = new MockHttpServletRequest("GET", requestUri);
this.request.setServletPath(requestUri);
this.springSecurityFilterChain.doFilter(this.request, this.response, this.filterChain);
assertThat(this.response.getRedirectedUrl()).matches("http://localhost/oauth2/authorization/google");
assertThat(this.response.getRedirectedUrl()).matches("/oauth2/authorization/google");
}
@Test
@ -531,7 +531,7 @@ public class OAuth2LoginConfigurerTests {
this.request = new MockHttpServletRequest("GET", requestUri);
this.request.setServletPath(requestUri);
this.springSecurityFilterChain.doFilter(this.request, this.response, this.filterChain);
assertThat(this.response.getRedirectedUrl()).matches("http://localhost/custom-login");
assertThat(this.response.getRedirectedUrl()).matches("/custom-login");
}
@Test
@ -541,7 +541,7 @@ public class OAuth2LoginConfigurerTests {
this.request = new MockHttpServletRequest("GET", requestUri);
this.request.setServletPath(requestUri);
this.springSecurityFilterChain.doFilter(this.request, this.response, this.filterChain);
assertThat(this.response.getRedirectedUrl()).matches("http://localhost/custom-login");
assertThat(this.response.getRedirectedUrl()).matches("/custom-login");
}
@Test

4
config/src/test/java/org/springframework/security/config/annotation/web/configurers/oauth2/server/resource/OAuth2ResourceServerConfigurerTests.java
View File

@ -1,5 +1,5 @@
/*
* Copyright 2002-2022 the original author or authors.
* Copyright 2002-2024 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@ -1210,7 +1210,7 @@ public class OAuth2ResourceServerConfigurerTests {
MvcResult result = this.mvc.perform(get("/authenticated")
.header("Accept", "text/html"))
.andExpect(status().isFound())
.andExpect(redirectedUrl("http://localhost/login"))
.andExpect(redirectedUrl("/login"))
.andReturn();
// @formatter:on
assertThat(result.getRequest().getSession(false)).isNotNull();

7
config/src/test/java/org/springframework/security/config/annotation/web/configurers/saml2/Saml2LoginConfigurerTests.java
View File

@ -1,5 +1,5 @@
/*
* Copyright 2002-2022 the original author or authors.
* Copyright 2002-2024 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@ -412,10 +412,11 @@ public class Saml2LoginConfigurerTests {
this.spring.register(Saml2LoginConfig.class).autowire();
this.mvc.perform(get("/favicon.ico").accept(MediaType.TEXT_HTML))
.andExpect(status().isFound())
.andExpect(redirectedUrl("http://localhost/login"));
.andExpect(redirectedUrl("/login"));
this.mvc.perform(get("/").accept(MediaType.TEXT_HTML))
.andExpect(status().isFound())
.andExpect(header().string("Location", startsWith("http://localhost/saml2/authenticate")));
.andExpect(header().string("Location", startsWith("/saml2/authenticate")));
}
@Test

8
config/src/test/java/org/springframework/security/config/http/CsrfConfigTests.java
View File

@ -1,5 +1,5 @@
/*
* Copyright 2002-2022 the original author or authors.
* Copyright 2002-2024 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@ -342,7 +342,7 @@ public class CsrfConfigTests {
this.spring.configLocations(this.xml("CsrfEnabled")).autowire();
// simulates a request that has no authentication (e.g. session time-out)
MvcResult result = this.mvc.perform(post("/authenticated").with(csrf()))
.andExpect(redirectedUrl("http://localhost/login"))
.andExpect(redirectedUrl("/login"))
.andReturn();
MockHttpSession session = (MockHttpSession) result.getRequest().getSession();
// if the request cache is consulted, then it will redirect back to /some-url,
@ -363,9 +363,7 @@ public class CsrfConfigTests {
throws Exception {
this.spring.configLocations(this.xml("CsrfEnabled")).autowire();
// simulates a request that has no authentication (e.g. session time-out)
MvcResult result = this.mvc.perform(get("/authenticated"))
.andExpect(redirectedUrl("http://localhost/login"))
.andReturn();
MvcResult result = this.mvc.perform(get("/authenticated")).andExpect(redirectedUrl("/login")).andReturn();
MockHttpSession session = (MockHttpSession) result.getRequest().getSession();
// if the request cache is consulted, then it will redirect back to /some-url,
// which we do want

6
config/src/test/java/org/springframework/security/config/http/FormLoginConfigTests.java
View File

@ -1,5 +1,5 @@
/*
* Copyright 2002-2018 the original author or authors.
* Copyright 2002-2024 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@ -73,7 +73,7 @@ public class FormLoginConfigTests {
this.spring.configLocations(this.xml("WithAntRequestMatcher")).autowire();
// @formatter:off
this.mvc.perform(get("/"))
.andExpect(redirectedUrl("http://localhost/login"));
.andExpect(redirectedUrl("/login"));
// @formatter:on
}
@ -107,7 +107,7 @@ public class FormLoginConfigTests {
this.mvc.perform(invalidPassword)
.andExpect(redirectedUrl(WebConfigUtilsTests.URL + "/failure"));
this.mvc.perform(get("/"))
.andExpect(redirectedUrl("http://localhost" + WebConfigUtilsTests.URL + "/login"));
.andExpect(redirectedUrl(WebConfigUtilsTests.URL + "/login"));
// @formatter:on
}

8
config/src/test/java/org/springframework/security/config/http/HttpConfigTests.java
View File

@ -71,7 +71,7 @@ public class HttpConfigTests {
// @formatter:off
this.mvc.perform(get("/"))
.andExpect(status().isFound())
.andExpect(redirectedUrl("http://localhost/login"));
.andExpect(redirectedUrl("/login"));
// @formatter:on
}
@ -81,7 +81,7 @@ public class HttpConfigTests {
// @formatter:off
this.mvc.perform(get("/"))
.andExpect(status().isFound())
.andExpect(redirectedUrl("http://localhost/login"));
.andExpect(redirectedUrl("/login"));
// @formatter:on
}
@ -95,7 +95,7 @@ public class HttpConfigTests {
// @formatter:off
this.mvc.perform(get("/"))
.andExpect(status().isFound())
.andExpect(redirectedUrl("http://localhost/login"));
.andExpect(redirectedUrl("/login"));
// @formatter:on
verify(authorizationManager).check(any(), any());
}
@ -109,7 +109,7 @@ public class HttpConfigTests {
proxy.doFilter(request, new EncodeUrlDenyingHttpServletResponseWrapper(response), (req, resp) -> {
});
assertThat(response.getStatus()).isEqualTo(HttpStatus.SC_MOVED_TEMPORARILY);
assertThat(response.getRedirectedUrl()).isEqualTo("http://localhost/login");
assertThat(response.getRedirectedUrl()).isEqualTo("/login");
}
@Test

6
config/src/test/java/org/springframework/security/config/http/MiscHttpConfigTests.java
View File

@ -1,5 +1,5 @@
/*
* Copyright 2002-2022 the original author or authors.
* Copyright 2002-2024 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@ -573,7 +573,7 @@ public class MiscHttpConfigTests {
proxy.doFilter(request, new EncodeUrlDenyingHttpServletResponseWrapper(response), (req, resp) -> {
});
assertThat(response.getStatus()).isEqualTo(HttpStatus.SC_MOVED_TEMPORARILY);
assertThat(response.getRedirectedUrl()).isEqualTo("http://localhost/login");
assertThat(response.getRedirectedUrl()).isEqualTo("/login");
}
@Test
@ -802,7 +802,7 @@ public class MiscHttpConfigTests {
this.spring.configLocations(xml("PortsMappedRequiresHttps")).autowire();
// @formatter:off
MockHttpSession session = (MockHttpSession) this.mvc.perform(get("https://localhost:9080/protected"))
.andExpect(redirectedUrl("https://localhost:9443/login"))
.andExpect(redirectedUrl("/login"))
.andReturn()
.getRequest()
.getSession(false);

14
config/src/test/java/org/springframework/security/config/http/OAuth2LoginBeanDefinitionParserTests.java
View File

@ -1,5 +1,5 @@
/*
* Copyright 2002-2022 the original author or authors.
* Copyright 2002-2024 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@ -174,7 +174,7 @@ public class OAuth2LoginBeanDefinitionParserTests {
// @formatter:off
this.mvc.perform(get("/"))
.andExpect(status().is3xxRedirection())
.andExpect(redirectedUrl("http://localhost/oauth2/authorization/google-login"));
.andExpect(redirectedUrl("/oauth2/authorization/google-login"));
// @formatter:on
verify(this.requestCache).saveRequest(any(), any());
}
@ -187,7 +187,7 @@ public class OAuth2LoginBeanDefinitionParserTests {
// @formatter:off
this.mvc.perform(get("/favicon.ico").accept(new MediaType("image", "*")))
.andExpect(status().is3xxRedirection())
.andExpect(redirectedUrl("http://localhost/login"));
.andExpect(redirectedUrl("/login"));
// @formatter:on
}
@ -199,7 +199,7 @@ public class OAuth2LoginBeanDefinitionParserTests {
// @formatter:off
this.mvc.perform(get("/").header("X-Requested-With", "XMLHttpRequest"))
.andExpect(status().is3xxRedirection())
.andExpect(redirectedUrl("http://localhost/login"));
.andExpect(redirectedUrl("/login"));
// @formatter:on
}
@ -411,7 +411,7 @@ public class OAuth2LoginBeanDefinitionParserTests {
// @formatter:off
this.mvc.perform(get("/"))
.andExpect(status().is3xxRedirection())
.andExpect(redirectedUrl("http://localhost/login"));
.andExpect(redirectedUrl("/login"));
// @formatter:on
}
@ -421,7 +421,7 @@ public class OAuth2LoginBeanDefinitionParserTests {
// @formatter:off
this.mvc.perform(get("/"))
.andExpect(status().is3xxRedirection())
.andExpect(redirectedUrl("http://localhost/custom-login"));
.andExpect(redirectedUrl("/custom-login"));
// @formatter:on
}
@ -433,7 +433,7 @@ public class OAuth2LoginBeanDefinitionParserTests {
// @formatter:off
this.mvc.perform(get("/"))
.andExpect(status().is3xxRedirection())
.andExpect(redirectedUrl("http://localhost/login"));
.andExpect(redirectedUrl("/login"));
// @formatter:on
}

6
config/src/test/java/org/springframework/security/config/http/PlaceHolderAndELConfigTests.java
View File

@ -1,5 +1,5 @@
/*
* Copyright 2002-2018 the original author or authors.
* Copyright 2002-2024 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@ -73,7 +73,7 @@ public class PlaceHolderAndELConfigTests {
// login-page setting
// @formatter:off
this.mvc.perform(get("/secured"))
.andExpect(redirectedUrl("http://localhost/loginPage"));
.andExpect(redirectedUrl("/loginPage"));
// login-processing-url setting
// default-target-url setting
this.mvc.perform(post("/loginPage").param("username", "user").param("password", "password"))
@ -98,7 +98,7 @@ public class PlaceHolderAndELConfigTests {
// login-page setting
// @formatter:off
this.mvc.perform(get("/secured"))
.andExpect(redirectedUrl("http://localhost/loginPage"));
.andExpect(redirectedUrl("/loginPage"));
// login-processing-url setting
// default-target-url setting
this.mvc.perform(post("/loginPage").param("username", "user").param("password", "password"))

6
config/src/test/java/org/springframework/security/config/http/Saml2LoginBeanDefinitionParserTests.java
View File

@ -1,5 +1,5 @@
/*
* Copyright 2002-2022 the original author or authors.
* Copyright 2002-2024 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@ -161,7 +161,7 @@ public class Saml2LoginBeanDefinitionParserTests {
// @formatter:off
this.mvc.perform(get("/"))
.andExpect(status().is3xxRedirection())
.andExpect(redirectedUrl("http://localhost/saml2/authenticate/one"));
.andExpect(redirectedUrl("/saml2/authenticate/one"));
// @formatter:on
verify(this.requestCache).saveRequest(any(), any());
}
@ -172,7 +172,7 @@ public class Saml2LoginBeanDefinitionParserTests {
// @formatter:off
this.mvc.perform(get("/"))
.andExpect(status().is3xxRedirection())
.andExpect(redirectedUrl("http://localhost/login"));
.andExpect(redirectedUrl("/login"));
// @formatter:on
}

16
config/src/test/java/org/springframework/security/config/http/SecurityContextHolderAwareRequestConfigTests.java
View File

@ -1,5 +1,5 @@
/*
* Copyright 2002-2018 the original author or authors.
* Copyright 2002-2024 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@ -78,7 +78,7 @@ public class SecurityContextHolderAwareRequestConfigTests {
// @formatter:off
this.mvc.perform(get("/authenticate"))
.andExpect(status().isFound())
.andExpect(redirectedUrl("http://localhost/login"));
.andExpect(redirectedUrl("/login"));
// @formatter:on
}
@ -114,7 +114,7 @@ public class SecurityContextHolderAwareRequestConfigTests {
// @formatter:off
this.mvc.perform(get("/authenticate"))
.andExpect(status().isFound())
.andExpect(redirectedUrl("http://localhost/login"));
.andExpect(redirectedUrl("/login"));
// @formatter:on
}
@ -137,10 +137,10 @@ public class SecurityContextHolderAwareRequestConfigTests {
// @formatter:off
this.mvc.perform(get("/authenticate"))
.andExpect(status().isFound())
.andExpect(redirectedUrl("http://localhost/login"));
.andExpect(redirectedUrl("/login"));
this.mvc.perform(get("/v2/authenticate"))
.andExpect(status().isFound())
.andExpect(redirectedUrl("http://localhost/login2"));
.andExpect(redirectedUrl("/login2"));
// @formatter:on
}
@ -177,10 +177,10 @@ public class SecurityContextHolderAwareRequestConfigTests {
@Test
public void servletLogoutWhenUsingCustomLogoutThenUsesSpringSecurity() throws Exception {
this.spring.configLocations(this.xml("Logout")).autowire();
this.mvc.perform(get("/authenticate"))
.andExpect(status().isFound())
.andExpect(redirectedUrl("http://localhost/signin"));
// @formatter:off
this.mvc.perform(get("/authenticate"))
.andExpect(status().isFound())
.andExpect(redirectedUrl("/signin"));
MvcResult result = this.mvc.perform(get("/good-login"))
.andReturn();
// @formatter:on

8
config/src/test/kotlin/org/springframework/security/config/annotation/web/ExceptionHandlingDslTests.kt
View File

@ -1,5 +1,5 @@
/*
* Copyright 2002-2022 the original author or authors.
* Copyright 2002-2024 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@ -217,7 +217,7 @@ class ExceptionHandlingDslTests {
this.mockMvc.get("/")
.andExpect {
status { isFound() }
redirectedUrl("http://localhost/custom-login")
redirectedUrl("/custom-login")
}
}
@ -246,13 +246,13 @@ class ExceptionHandlingDslTests {
this.mockMvc.get("/secured1")
.andExpect {
status { isFound() }
redirectedUrl("http://localhost/custom-login1")
redirectedUrl("/custom-login1")
}
this.mockMvc.get("/secured2")
.andExpect {
status { isFound() }
redirectedUrl("http://localhost/custom-login2")
redirectedUrl("/custom-login2")
}
}

4
config/src/test/kotlin/org/springframework/security/config/annotation/web/FormLoginDslTests.kt
View File

@ -143,7 +143,7 @@ class FormLoginDslTests {
this.mockMvc.get("/")
.andExpect {
status { isFound() }
redirectedUrl("http://localhost/login")
redirectedUrl("/login")
}
}
@ -169,7 +169,7 @@ class FormLoginDslTests {
this.mockMvc.get("/")
.andExpect {
status { isFound() }
redirectedUrl("http://localhost/log-in")
redirectedUrl("/log-in")
}
}

6
config/src/test/kotlin/org/springframework/security/config/annotation/web/RememberMeDslTests.kt
View File

@ -1,5 +1,5 @@
/*
* Copyright 2002-2022 the original author or authors.
* Copyright 2002-2024 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@ -153,7 +153,7 @@ internal class RememberMeDslTests {
cookie(expiredRememberMeCookie)
}.andExpect {
status { isFound() }
redirectedUrl("http://localhost/login")
redirectedUrl("/login")
}
}
@ -229,7 +229,7 @@ internal class RememberMeDslTests {
cookie(withoutKeyRememberMeCookie)
}.andExpect {
status { isFound() }
redirectedUrl("http://localhost/login")
redirectedUrl("/login")
}
val keyMvcResult = mockMvc.post("/login") {
loginRememberMeRequest()

26
web/src/main/java/org/springframework/security/web/authentication/LoginUrlAuthenticationEntryPoint.java
View File

@ -61,6 +61,7 @@ import org.springframework.util.StringUtils;
* @author colin sampaleanu
* @author Omri Spector
* @author Luke Taylor
* @author Michal Okosy
* @since 3.0
*/
public class LoginUrlAuthenticationEntryPoint implements AuthenticationEntryPoint, InitializingBean {
@ -143,29 +144,22 @@ public class LoginUrlAuthenticationEntryPoint implements AuthenticationEntryPoin
protected String buildRedirectUrlToLoginPage(HttpServletRequest request, HttpServletResponse response,
AuthenticationException authException) {
String loginForm = determineUrlToUseForThisRequest(request, response, authException);
if (UrlUtils.isAbsoluteUrl(loginForm)) {
if (UrlUtils.isAbsoluteUrl(loginForm) || !this.forceHttps || "https".equals(request.getScheme())) {
return loginForm;
}
int serverPort = this.portResolver.getServerPort(request);
String scheme = request.getScheme();
Integer httpsPort = this.portMapper.lookupHttpsPort(serverPort);
if (httpsPort == null) {
logger.warn(LogMessage.format("Unable to redirect to HTTPS as no port mapping found for HTTP port %s",
serverPort));
return loginForm;
}
RedirectUrlBuilder urlBuilder = new RedirectUrlBuilder();
urlBuilder.setScheme(scheme);
urlBuilder.setScheme("https");
urlBuilder.setServerName(request.getServerName());
urlBuilder.setPort(serverPort);
urlBuilder.setPort(httpsPort);
urlBuilder.setContextPath(request.getContextPath());
urlBuilder.setPathInfo(loginForm);
if (this.forceHttps && "http".equals(scheme)) {
Integer httpsPort = this.portMapper.lookupHttpsPort(serverPort);
if (httpsPort != null) {
// Overwrite scheme and port in the redirect URL
urlBuilder.setScheme("https");
urlBuilder.setPort(httpsPort);
}
else {
logger.warn(LogMessage.format("Unable to redirect to HTTPS as no port mapping found for HTTP port %s",
serverPort));
}
}
return urlBuilder.getUrl();
}

14
web/src/test/java/org/springframework/security/web/authentication/LoginUrlAuthenticationEntryPointTests.java
View File

@ -129,12 +129,18 @@ public class LoginUrlAuthenticationEntryPointTests {
ep.setPortResolver(new MockPortResolver(80, 443));
ep.afterPropertiesSet();
ep.commence(request, response, null);
assertThat(response.getRedirectedUrl()).isEqualTo("https://www.example.com/bigWebApp/hello");
assertThat(response.getRedirectedUrl()).isEqualTo("/bigWebApp/hello");
request.setServerPort(8443);
response = new MockHttpServletResponse();
ep.setPortResolver(new MockPortResolver(8080, 8443));
ep.commence(request, response, null);
assertThat(response.getRedirectedUrl()).isEqualTo("https://www.example.com:8443/bigWebApp/hello");
assertThat(response.getRedirectedUrl()).isEqualTo("/bigWebApp/hello");
// access to https via http port
request.setServerPort(8080);
response = new MockHttpServletResponse();
ep.setPortResolver(new MockPortResolver(8080, 8443));
ep.commence(request, response, null);
assertThat(response.getRedirectedUrl()).isEqualTo("/bigWebApp/hello");
}
@Test
@ -152,7 +158,7 @@ public class LoginUrlAuthenticationEntryPointTests {
request.setServerPort(80);
MockHttpServletResponse response = new MockHttpServletResponse();
ep.commence(request, response, null);
assertThat(response.getRedirectedUrl()).isEqualTo("http://localhost/bigWebApp/hello");
assertThat(response.getRedirectedUrl()).isEqualTo("/bigWebApp/hello");
}
@Test
@ -172,7 +178,7 @@ public class LoginUrlAuthenticationEntryPointTests {
ep.commence(request, response, null);
// Response doesn't switch to HTTPS, as we didn't know HTTP port 8888 to HTTP port
// mapping
assertThat(response.getRedirectedUrl()).isEqualTo("http://localhost:8888/bigWebApp/hello");
assertThat(response.getRedirectedUrl()).isEqualTo("/bigWebApp/hello");
}
@Test