Cwikius-Spring/spring-security
1
0
Fork 0
mirror of https://github.com/spring-projects/spring-security.git synced 2025-06-01 09:42:13 +00:00
Code Issues Packages Projects Releases Wiki Activity

DelegatingSecurityContextRepository should call loadContext

Browse Source 
Closes gh-12314
This commit is contained in:
Marcus Da Coregio 2023-03-17 15:32:42 -03:00
parent 889fa55c9c
commit 8d664bc4c2
2 changed files with 70 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
web/src/main/java/org/springframework/security/web/context/DelegatingSecurityContextRepository.java
View File

@ -1,5 +1,5 @@
/* /*
* Copyright 2002-2022 the original author or authors. * Copyright 2002-2023 the original author or authors.
* *
* Licensed under the Apache License, Version 2.0 (the "License"); * Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License. * you may not use this file except in compliance with the License.
@ -46,7 +46,14 @@ public final class DelegatingSecurityContextRepository implements SecurityContex
@Override @Override
public SecurityContext loadContext(HttpRequestResponseHolder requestResponseHolder) { public SecurityContext loadContext(HttpRequestResponseHolder requestResponseHolder) {
return loadContext(requestResponseHolder.getRequest()).get(); SecurityContext result = null;
for (SecurityContextRepository delegate : this.delegates) {
SecurityContext delegateResult = delegate.loadContext(requestResponseHolder);
if (result == null || delegate.containsContext(requestResponseHolder.getRequest())) {
result = delegateResult;
}
}
return result;
} }
@Override @Override

62
web/src/test/java/org/springframework/security/web/context/DelegatingSecurityContextRepositoryTests.java
View File

@ -1,5 +1,5 @@
/* /*
* Copyright 2002-2022 the original author or authors. * Copyright 2002-2023 the original author or authors.
* *
* Licensed under the Apache License, Version 2.0 (the "License"); * Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License. * you may not use this file except in compliance with the License.
@ -141,4 +141,64 @@ public class DelegatingSecurityContextRepositoryTests {
verifyNoInteractions(delegates.get(2)); verifyNoInteractions(delegates.get(2));
} }
// gh-12314
@Test
public void loadContextWhenSecondDelegateReturnsThenContextFromSecondDelegate() {
SecurityContextRepository delegate1 = mock(SecurityContextRepository.class);
SecurityContextRepository delegate2 = mock(SecurityContextRepository.class);
HttpRequestResponseHolder holder = new HttpRequestResponseHolder(this.request, this.response);
SecurityContext securityContext1 = mock(SecurityContext.class);
SecurityContext securityContext2 = mock(SecurityContext.class);
given(delegate1.loadContext(holder)).willReturn(securityContext1);
given(delegate1.containsContext(holder.getRequest())).willReturn(false);
given(delegate2.loadContext(holder)).willReturn(securityContext2);
given(delegate2.containsContext(holder.getRequest())).willReturn(true);
DelegatingSecurityContextRepository repository = new DelegatingSecurityContextRepository(delegate1, delegate2);
SecurityContext returnedSecurityContext = repository.loadContext(holder);
assertThat(returnedSecurityContext).isSameAs(securityContext2);
}
// gh-12314
@Test
public void loadContextWhenBothDelegateReturnsThenContextFromSecondDelegate() {
SecurityContextRepository delegate1 = mock(SecurityContextRepository.class);
SecurityContextRepository delegate2 = mock(SecurityContextRepository.class);
HttpRequestResponseHolder holder = new HttpRequestResponseHolder(this.request, this.response);
SecurityContext securityContext1 = mock(SecurityContext.class);
SecurityContext securityContext2 = mock(SecurityContext.class);
given(delegate1.loadContext(holder)).willReturn(securityContext1);
given(delegate1.containsContext(holder.getRequest())).willReturn(true);
given(delegate2.loadContext(holder)).willReturn(securityContext2);
given(delegate2.containsContext(holder.getRequest())).willReturn(true);
DelegatingSecurityContextRepository repository = new DelegatingSecurityContextRepository(delegate1, delegate2);
SecurityContext returnedSecurityContext = repository.loadContext(holder);
assertThat(returnedSecurityContext).isSameAs(securityContext2);
}
// gh-12314
@Test
public void loadContextWhenFirstDelegateReturnsThenContextFromFirstDelegate() {
SecurityContextRepository delegate1 = mock(SecurityContextRepository.class);
SecurityContextRepository delegate2 = mock(SecurityContextRepository.class);
HttpRequestResponseHolder holder = new HttpRequestResponseHolder(this.request, this.response);
SecurityContext securityContext1 = mock(SecurityContext.class);
SecurityContext securityContext2 = mock(SecurityContext.class);
given(delegate1.loadContext(holder)).willReturn(securityContext1);
given(delegate1.containsContext(holder.getRequest())).willReturn(true);
given(delegate2.loadContext(holder)).willReturn(securityContext2);
given(delegate2.containsContext(holder.getRequest())).willReturn(false);
DelegatingSecurityContextRepository repository = new DelegatingSecurityContextRepository(delegate1, delegate2);
SecurityContext returnedSecurityContext = repository.loadContext(holder);
assertThat(returnedSecurityContext).isSameAs(securityContext1);
}
} }