diff --git a/config/src/main/java/org/springframework/security/config/annotation/web/configurers/ott/OneTimeTokenLoginConfigurer.java b/config/src/main/java/org/springframework/security/config/annotation/web/configurers/ott/OneTimeTokenLoginConfigurer.java index 03b75e87ee..a8ae662e60 100644 --- a/config/src/main/java/org/springframework/security/config/annotation/web/configurers/ott/OneTimeTokenLoginConfigurer.java +++ b/config/src/main/java/org/springframework/security/config/annotation/web/configurers/ott/OneTimeTokenLoginConfigurer.java @@ -46,6 +46,7 @@ import org.springframework.security.web.authentication.ott.GeneratedOneTimeToken import org.springframework.security.web.authentication.ott.OneTimeTokenAuthenticationConverter; import org.springframework.security.web.authentication.ui.DefaultLoginPageGeneratingFilter; import org.springframework.security.web.authentication.ui.DefaultOneTimeTokenSubmitPageGeneratingFilter; +import org.springframework.security.web.authentication.ui.DefaultResourcesFilter; import org.springframework.security.web.context.HttpSessionSecurityContextRepository; import org.springframework.security.web.context.SecurityContextRepository; import org.springframework.security.web.csrf.CsrfToken; @@ -136,6 +137,7 @@ public final class OneTimeTokenLoginConfigurer> generateFilter.setGeneratedOneTimeTokenHandler(getGeneratedOneTimeTokenHandler(http)); generateFilter.setRequestMatcher(antMatcher(HttpMethod.POST, this.generateTokenUrl)); http.addFilter(postProcess(generateFilter)); + http.addFilter(DefaultResourcesFilter.css()); } private GeneratedOneTimeTokenHandler getGeneratedOneTimeTokenHandler(H http) { diff --git a/config/src/test/java/org/springframework/security/config/annotation/web/configurers/ott/OneTimeTokenLoginConfigurerTests.java b/config/src/test/java/org/springframework/security/config/annotation/web/configurers/ott/OneTimeTokenLoginConfigurerTests.java index 8e63b4a729..691fd41729 100644 --- a/config/src/test/java/org/springframework/security/config/annotation/web/configurers/ott/OneTimeTokenLoginConfigurerTests.java +++ b/config/src/test/java/org/springframework/security/config/annotation/web/configurers/ott/OneTimeTokenLoginConfigurerTests.java @@ -21,6 +21,7 @@ import java.io.IOException; import jakarta.servlet.ServletException; import jakarta.servlet.http.HttpServletRequest; import jakarta.servlet.http.HttpServletResponse; +import org.hamcrest.Matchers; import org.junit.jupiter.api.Test; import org.junit.jupiter.api.extension.ExtendWith; @@ -53,6 +54,7 @@ import static org.springframework.security.test.web.servlet.response.SecurityMoc import static org.springframework.security.test.web.servlet.response.SecurityMockMvcResultMatchers.unauthenticated; import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get; import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.post; +import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.content; import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.redirectedUrl; import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status; @@ -64,143 +66,6 @@ public class OneTimeTokenLoginConfigurerTests { @Autowired(required = false) MockMvc mvc; - public static final String EXPECTED_HTML_HEAD = """ - - - - - - - - Please sign in - - - """; - @Test void oneTimeTokenWhenCorrectTokenThenCanAuthenticate() throws Exception { this.spring.register(OneTimeTokenDefaultConfig.class).autowire(); @@ -252,6 +117,14 @@ public class OneTimeTokenLoginConfigurerTests { .andExpectAll(status().isFound(), redirectedUrl("/login?error"), unauthenticated()); } + @Test + void oneTimeTokenWhenConfiguredThenServesCss() throws Exception { + this.spring.register(OneTimeTokenDefaultConfig.class).autowire(); + this.mvc.perform(get("/default-ui.css")) + .andExpect(status().isOk()) + .andExpect(content().string(Matchers.containsString("body {"))); + } + @Test void oneTimeTokenWhenFormLoginConfiguredThenRendersRequestTokenForm() throws Exception { this.spring.register(OneTimeTokenFormLoginConfig.class).autowire(); @@ -262,8 +135,17 @@ public class OneTimeTokenLoginConfigurerTests { .andExpect((result) -> { CsrfToken token = (CsrfToken) result.getRequest().getAttribute(CsrfToken.class.getName()); assertThat(result.getResponse().getContentAsString()).isEqualTo( - EXPECTED_HTML_HEAD + """ + + + + + + + + Please sign in + +