Cwikius-Spring/spring-security
1
0
Fork 0
mirror of https://github.com/spring-projects/spring-security.git synced 2025-06-28 06:42:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Updated integration tests to detect case reported as SPR-7563.

Browse Source
This commit is contained in:
Luke Taylor 2010-09-19 18:09:59 +01:00
parent 265cdaf2a6
commit 8d867e8b67
8 changed files with 108 additions and 32 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

32
itest/web/src/main/webapp/WEB-INF/http-security-concurrency.xml Normal file
View File

@ -0,0 +1,32 @@
<?xml version="1.0" encoding="UTF-8"?>
<beans:beans xmlns="http://www.springframework.org/schema/security"
xmlns:beans="http://www.springframework.org/schema/beans"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-3.0.xsd
http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security-3.1.xsd">
<debug />
<!--
Http App Context to test form login, remember-me and concurrent session control.
Needs to be supplemented with authentication provider(s)
-->
<http pattern="/login.jsp" security="none" />
<http use-expressions="true">
<intercept-url pattern="/secure/**" access="hasAnyRole('ROLE_DEVELOPER','ROLE_USER')" />
<intercept-url pattern="/**" access="hasAnyRole('ROLE_DEVELOPER','ROLE_USER')" />
<form-login login-page="/login.jsp" authentication-failure-url="/login.jsp?login_error=true"/>
<http-basic/>
<!-- Default logout configuration -->
<logout logout-url="/logout"/>
<session-management>
<concurrency-control max-sessions="1" error-if-maximum-exceeded="true" />
</session-management>
</http>
</beans:beans>

1
itest/web/src/main/webapp/WEB-INF/http-security-custom-concurrency.xml
View File

@ -12,6 +12,7 @@
<intercept-url pattern="/**" access="ROLE_DEVELOPER,ROLE_USER" /> <intercept-url pattern="/**" access="ROLE_DEVELOPER,ROLE_USER" />
<session-management session-authentication-strategy-ref="sas"/> <session-management session-authentication-strategy-ref="sas"/>
<logout />
<custom-filter position="CONCURRENT_SESSION_FILTER" ref="concurrencyFilter" /> <custom-filter position="CONCURRENT_SESSION_FILTER" ref="concurrencyFilter" />
<custom-filter position="FORM_LOGIN_FILTER" ref="myAuthFilter" /> <custom-filter position="FORM_LOGIN_FILTER" ref="myAuthFilter" />

6
itest/web/src/main/webapp/login.jsp
View File

@ -1,5 +1,3 @@
<!-- %@ taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core" % -->
<!-- Not used unless you declare a <form-login login-page="/login.jsp"/> element --> <!-- Not used unless you declare a <form-login login-page="/login.jsp"/> element -->
<html> <html>
@ -13,9 +11,7 @@
<% <%
if (request.getParameter("login_error") != null) { if (request.getParameter("login_error") != null) {
%> %>
<font color="red"> Your login attempt was not successful, try again. ${SPRING_SECURITY_LAST_EXCEPTION.message}<br/><br/>
Your login attempt was not successful, try again.<br/><br/>
</font>
<% <%
} }
%> %>

2
itest/web/src/test/java/org/springframework/security/integration/AbstractWebServerIntegrationTests.java
View File

@ -108,7 +108,7 @@ public abstract class AbstractWebServerIntegrationTests {
return getAppContext().getBean(beanName); return getAppContext().getBean(beanName);
} }
private WebApplicationContext getAppContext() { protected final WebApplicationContext getAppContext() {
ServletContext servletCtx = ((WebAppContext)server.getHandler()).getServletContext(); ServletContext servletCtx = ((WebAppContext)server.getHandler()).getServletContext();
WebApplicationContext appCtx = WebApplicationContext appCtx =
WebApplicationContextUtils.getRequiredWebApplicationContext(servletCtx); WebApplicationContextUtils.getRequiredWebApplicationContext(servletCtx);

44
itest/web/src/test/java/org/springframework/security/integration/ConcurrentSessionManagementTests.java Normal file
View File

@ -0,0 +1,44 @@
package org.springframework.security.integration;
import net.sourceforge.jwebunit.junit.WebTester;
import org.testng.annotations.Test;
/**
* @author Luke Taylor
*/
public class ConcurrentSessionManagementTests extends AbstractWebServerIntegrationTests {
protected String getContextConfigLocations() {
return "/WEB-INF/http-security-concurrency.xml /WEB-INF/in-memory-provider.xml";
}
@Test
public void maxConcurrentLoginsValueIsRespected() throws Exception {
System.out.println("Client: ******* First login ******* ");
beginAt("secure/index.html");
login("jimi", "jimispassword");
// Login again
System.out.println("Client: ******* Second login ******* ");
WebTester tester2 = new WebTester();
tester2.getTestContext().setBaseUrl(getBaseUrl());
tester2.beginAt("secure/index.html");
// seems to be a bug in checking for form here (it fails)
//tester2.assertFormPresent();
tester2.setTextField("j_username", "jimi");
tester2.setTextField("j_password", "jimispassword");
// tester2.submit() also fails to detect the form
tester2.getTestingEngine().submit();
tester2.assertTextPresent("Maximum sessions of 1 for this principal exceeded");
// Now logout to kill first session
tester.gotoPage("/logout");
// Try second session again
tester2.setTextField("j_username", "jimi");
tester2.setTextField("j_password", "jimispassword");
// tester2.submit() also fails to detect the form
tester2.getTestingEngine().submit();
tester2.assertTextPresent("A Secure Page");
}
}

20
itest/web/src/test/java/org/springframework/security/integration/CustomConcurrentSessionManagementTests.java
View File

@ -3,6 +3,7 @@ package org.springframework.security.integration;
import net.sourceforge.jwebunit.junit.WebTester; import net.sourceforge.jwebunit.junit.WebTester;
import org.junit.Assert; import org.junit.Assert;
import org.springframework.security.core.session.SessionRegistry;
import org.testng.annotations.Test; import org.testng.annotations.Test;
/** /**
@ -30,4 +31,23 @@ public class CustomConcurrentSessionManagementTests extends AbstractWebServerInt
Assert.assertTrue(tester2.getServerResponse().contains("Maximum sessions of 1 for this principal exceeded")); Assert.assertTrue(tester2.getServerResponse().contains("Maximum sessions of 1 for this principal exceeded"));
} }
@Test
public void logoutClearsSessionRegistryAndAllowsSecondLogin() throws Exception {
beginAt("secure/index.html");
login("bessie", "bessiespassword");
SessionRegistry reg = getAppContext().getBean(SessionRegistry.class);
tester.gotoPage("/j_spring_security_logout");
// Login again
System.out.println("Client: ******* Second login ******* ");
WebTester tester2 = new WebTester();
tester2.getTestContext().setBaseUrl(getBaseUrl());
tester2.beginAt("secure/index.html");
tester2.setTextField("j_username", "bessie");
tester2.setTextField("j_password", "bessiespassword");
tester2.setIgnoreFailingStatusCodes(true);
tester2.submit();
Assert.assertTrue(tester2.getServerResponse().contains("A secure page"));
}
} }

22
itest/web/src/test/java/org/springframework/security/integration/InMemoryProviderWebAppTests.java
View File

@ -72,26 +72,4 @@ public class InMemoryProviderWebAppTests extends AbstractWebServerIntegrationTes
beginAt("secure/index.html"); beginAt("secure/index.html");
assertTextPresent("A Secure Page"); assertTextPresent("A Secure Page");
} }
@Test
public void maxConcurrentLoginsValueIsRespected() throws Exception {
System.out.println("Client: ******* First login ******* ");
beginAt("secure/index.html");
login("jimi", "jimispassword");
// Login again
System.out.println("Client: ******* Second login ******* ");
WebTester tester2 = new WebTester();
tester2.getTestContext().setBaseUrl(getBaseUrl());
tester2.beginAt("secure/index.html");
// seems to be a bug in checking for form here (it fails)
//tester2.assertFormPresent();
tester2.setTextField("j_username", "jimi");
tester2.setTextField("j_password", "jimispassword");
// tester2.submit() also fails to detect the form
tester2.getTestingEngine().submit();
// Try an use the original
System.out.println("Client: ******* Retry Original Session ******* ");
tester.gotoPage("secure/index.html");
tester.assertTextPresent("This session has been expired");
}
} }

9
web/src/main/java/org/springframework/security/web/authentication/logout/SecurityContextLogoutHandler.java
View File

@ -16,6 +16,8 @@
package org.springframework.security.web.authentication.logout; package org.springframework.security.web.authentication.logout;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
import org.springframework.security.core.Authentication; import org.springframework.security.core.Authentication;
import org.springframework.security.core.context.SecurityContextHolder; import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.util.Assert; import org.springframework.util.Assert;
@ -27,12 +29,14 @@ import javax.servlet.http.HttpSession;
/** /**
* Performs a logout by modifying the {@link org.springframework.security.core.context.SecurityContextHolder}. * Performs a logout by modifying the {@link org.springframework.security.core.context.SecurityContextHolder}.
* <p> * <p>
* Will also invalidate the {@link HttpSession} if {@link #isInvalidateHttpSession()} is <code>true</code> and the * Will also invalidate the {@link HttpSession} if {@link #isInvalidateHttpSession()} is {@code true} and the
* session is not <code>null</code>. * session is not {@code null}.
* *
* @author Ben Alex * @author Ben Alex
*/ */
public class SecurityContextLogoutHandler implements LogoutHandler { public class SecurityContextLogoutHandler implements LogoutHandler {
protected final Log logger = LogFactory.getLog(this.getClass());
private boolean invalidateHttpSession = true; private boolean invalidateHttpSession = true;
//~ Methods ======================================================================================================== //~ Methods ========================================================================================================
@ -49,6 +53,7 @@ public class SecurityContextLogoutHandler implements LogoutHandler {
if (invalidateHttpSession) { if (invalidateHttpSession) {
HttpSession session = request.getSession(false); HttpSession session = request.getSession(false);
if (session != null) { if (session != null) {
logger.debug("Invalidating session: " + session.getId());
session.invalidate(); session.invalidate();
} }
} }