From 80ff267749b77f559f0deee94effbc3165e4a580 Mon Sep 17 00:00:00 2001 From: Marten Deinum Date: Wed, 20 Apr 2016 09:44:34 +0200 Subject: [PATCH] Check RememberMe in ExceptionTranslationFilter This commit adds a check for rememberme to the ExceptionTranslationFilter. Using this when someone isn't fully authenticated he will be prompted with a login screen and after that will be redirected to the original requested URI. Fixes gh-2427 --- .../ExpressionUrlAuthorizationsTests.groovy | 14 +++--- .../access/ExceptionTranslationFilter.java | 27 +++++------ .../ExceptionTranslationFilterTests.java | 47 ++++++++++++++++--- 3 files changed, 59 insertions(+), 29 deletions(-) diff --git a/config/src/test/groovy/org/springframework/security/config/annotation/web/configurers/ExpressionUrlAuthorizationsTests.groovy b/config/src/test/groovy/org/springframework/security/config/annotation/web/configurers/ExpressionUrlAuthorizationsTests.groovy index c904fc0402..235e2e4bab 100644 --- a/config/src/test/groovy/org/springframework/security/config/annotation/web/configurers/ExpressionUrlAuthorizationsTests.groovy +++ b/config/src/test/groovy/org/springframework/security/config/annotation/web/configurers/ExpressionUrlAuthorizationsTests.groovy @@ -1,5 +1,5 @@ /* - * Copyright 2002-2013 the original author or authors. + * Copyright 2002-2016 the original author or authors. * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -13,7 +13,9 @@ * See the License for the specific language governing permissions and * limitations under the License. */ -package org.springframework.security.config.annotation.web.configurers; +package org.springframework.security.config.annotation.web.configurers + +import org.springframework.security.authentication.UsernamePasswordAuthenticationToken; import static org.springframework.security.config.annotation.web.configurers.ExpressionUrlAuthorizationConfigurerConfigs.* @@ -293,7 +295,7 @@ public class ExpressionUrlAuthorizationConfigurerTests extends BaseSpringSpec { response.status == HttpServletResponse.SC_UNAUTHORIZED when: super.setup() - login(new RememberMeAuthenticationToken("key", "user", AuthorityUtils.createAuthorityList("ROLE_USER"))) + login(new UsernamePasswordAuthenticationToken("key", "user", AuthorityUtils.createAuthorityList("ROLE_USER"))) springSecurityFilterChain.doFilter(request,response,chain) then: response.status == HttpServletResponse.SC_FORBIDDEN @@ -339,16 +341,12 @@ public class ExpressionUrlAuthorizationConfigurerTests extends BaseSpringSpec { def "authorizeRequests() fullyAuthenticated"() { setup: loadConfig(FullyAuthenticatedConfig) - when: - springSecurityFilterChain.doFilter(request,response,chain) - then: - response.status == HttpServletResponse.SC_UNAUTHORIZED when: super.setup() login(new RememberMeAuthenticationToken("key", "user", AuthorityUtils.createAuthorityList("ROLE_USER"))) springSecurityFilterChain.doFilter(request,response,chain) then: - response.status == HttpServletResponse.SC_FORBIDDEN + response.status == HttpServletResponse.SC_UNAUTHORIZED when: super.setup() login() diff --git a/web/src/main/java/org/springframework/security/web/access/ExceptionTranslationFilter.java b/web/src/main/java/org/springframework/security/web/access/ExceptionTranslationFilter.java index 4e0ebaca3c..633760f0c2 100644 --- a/web/src/main/java/org/springframework/security/web/access/ExceptionTranslationFilter.java +++ b/web/src/main/java/org/springframework/security/web/access/ExceptionTranslationFilter.java @@ -1,5 +1,5 @@ /* - * Copyright 2004, 2005, 2006 Acegi Technology Pty Limited + * Copyright 2004-2016 the original author or authors. * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -13,22 +13,13 @@ * See the License for the specific language governing permissions and * limitations under the License. */ - package org.springframework.security.web.access; -import java.io.IOException; - -import javax.servlet.FilterChain; -import javax.servlet.ServletException; -import javax.servlet.ServletRequest; -import javax.servlet.ServletResponse; -import javax.servlet.http.HttpServletRequest; -import javax.servlet.http.HttpServletResponse; - import org.springframework.security.access.AccessDeniedException; import org.springframework.security.authentication.AuthenticationTrustResolver; import org.springframework.security.authentication.AuthenticationTrustResolverImpl; import org.springframework.security.authentication.InsufficientAuthenticationException; +import org.springframework.security.core.Authentication; import org.springframework.security.core.AuthenticationException; import org.springframework.security.core.context.SecurityContextHolder; import org.springframework.security.web.AuthenticationEntryPoint; @@ -39,6 +30,14 @@ import org.springframework.security.web.util.ThrowableCauseExtractor; import org.springframework.util.Assert; import org.springframework.web.filter.GenericFilterBean; +import javax.servlet.FilterChain; +import javax.servlet.ServletException; +import javax.servlet.ServletRequest; +import javax.servlet.ServletResponse; +import javax.servlet.http.HttpServletRequest; +import javax.servlet.http.HttpServletResponse; +import java.io.IOException; + /** * Handles any AccessDeniedException and AuthenticationException * thrown within the filter chain. @@ -169,10 +168,10 @@ public class ExceptionTranslationFilter extends GenericFilterBean { (AuthenticationException) exception); } else if (exception instanceof AccessDeniedException) { - if (authenticationTrustResolver.isAnonymous(SecurityContextHolder - .getContext().getAuthentication())) { + Authentication authentication = SecurityContextHolder.getContext().getAuthentication(); + if (authenticationTrustResolver.isAnonymous(authentication) || authenticationTrustResolver.isRememberMe(authentication)) { logger.debug( - "Access is denied (user is anonymous); redirecting to authentication entry point", + "Access is denied (user is " + (authenticationTrustResolver.isAnonymous(authentication) ? "anonymous" : "not fully authenticated") + "); redirecting to authentication entry point", exception); sendStartAuthentication( diff --git a/web/src/test/java/org/springframework/security/web/access/ExceptionTranslationFilterTests.java b/web/src/test/java/org/springframework/security/web/access/ExceptionTranslationFilterTests.java index 155fa6fc06..0920772940 100644 --- a/web/src/test/java/org/springframework/security/web/access/ExceptionTranslationFilterTests.java +++ b/web/src/test/java/org/springframework/security/web/access/ExceptionTranslationFilterTests.java @@ -1,5 +1,5 @@ /* - * Copyright 2004, 2005, 2006 Acegi Technology Pty Limited + * Copyright 2004-2016 the original author or authors. * * Licensed under the Apache License, Version 2.0 (the "License"); * you may not use this file except in compliance with the License. @@ -13,14 +13,8 @@ * See the License for the specific language governing permissions and * limitations under the License. */ - package org.springframework.security.web.access; -import static org.assertj.core.api.Assertions.*; -import static org.mockito.Matchers.any; -import static org.mockito.Mockito.doThrow; -import static org.mockito.Mockito.mock; - import org.junit.After; import org.junit.Before; import org.junit.Test; @@ -31,8 +25,10 @@ import org.springframework.security.access.AccessDeniedException; import org.springframework.security.authentication.AnonymousAuthenticationToken; import org.springframework.security.authentication.AuthenticationTrustResolverImpl; import org.springframework.security.authentication.BadCredentialsException; +import org.springframework.security.authentication.RememberMeAuthenticationToken; import org.springframework.security.core.AuthenticationException; import org.springframework.security.core.authority.AuthorityUtils; +import org.springframework.security.core.context.SecurityContext; import org.springframework.security.core.context.SecurityContextHolder; import org.springframework.security.web.AuthenticationEntryPoint; import org.springframework.security.web.WebAttributes; @@ -46,6 +42,12 @@ import javax.servlet.http.HttpServletResponse; import javax.servlet.http.HttpSession; import java.io.IOException; +import static org.assertj.core.api.Assertions.assertThat; +import static org.assertj.core.api.Assertions.fail; +import static org.mockito.Matchers.any; +import static org.mockito.Mockito.doThrow; +import static org.mockito.Mockito.mock; + /** * Tests {@link ExceptionTranslationFilter}. * @@ -105,6 +107,37 @@ public class ExceptionTranslationFilterTests { assertThat(getSavedRequestUrl(request)).isEqualTo("http://www.example.com/mycontext/secure/page.html"); } + @Test + public void testAccessDeniedWithRememberMe() throws Exception { + // Setup our HTTP request + MockHttpServletRequest request = new MockHttpServletRequest(); + request.setServletPath("/secure/page.html"); + request.setServerPort(80); + request.setScheme("http"); + request.setServerName("www.example.com"); + request.setContextPath("/mycontext"); + request.setRequestURI("/mycontext/secure/page.html"); + + // Setup the FilterChain to thrown an access denied exception + FilterChain fc = mock(FilterChain.class); + doThrow(new AccessDeniedException("")).when(fc).doFilter( + any(HttpServletRequest.class), any(HttpServletResponse.class)); + + // Setup SecurityContextHolder, as filter needs to check if user is remembered + SecurityContext securityContext = SecurityContextHolder.createEmptyContext(); + securityContext.setAuthentication(new RememberMeAuthenticationToken("ignored", "ignored", AuthorityUtils + .createAuthorityList("IGNORED"))); + SecurityContextHolder.setContext(securityContext); + + // Test + ExceptionTranslationFilter filter = new ExceptionTranslationFilter(mockEntryPoint); + MockHttpServletResponse response = new MockHttpServletResponse(); + filter.doFilter(request, response, fc); + assertThat(response.getRedirectedUrl()).isEqualTo("/mycontext/login.jsp"); + assertThat(getSavedRequestUrl(request)).isEqualTo("http://www.example.com/mycontext/secure/page.html"); + } + + @Test public void testAccessDeniedWhenNonAnonymous() throws Exception { // Setup our HTTP request