Idiomatic Kotlin DSL for configuring HTTP security
Issue: gh-5558
This commit is contained in:
Eleftheria Stein-Kousathana
committed by
GitHub
GitHub
parent
e306482a96
commit
2df1099da5
@@ -0,0 +1,31 @@
|
||||
import org.jetbrains.kotlin.gradle.tasks.KotlinCompile
|
||||
|
||||
plugins {
|
||||
id("io.spring.convention.spring-sample-boot")
|
||||
kotlin("jvm")
|
||||
kotlin("plugin.spring") version "1.3.61"
|
||||
}
|
||||
|
||||
repositories {
|
||||
mavenCentral()
|
||||
}
|
||||
|
||||
dependencies {
|
||||
implementation(project(":spring-security-core"))
|
||||
implementation(project(":spring-security-config"))
|
||||
implementation(project(":spring-security-web"))
|
||||
implementation("org.springframework.boot:spring-boot-starter-web")
|
||||
implementation("org.springframework.boot:spring-boot-starter-thymeleaf")
|
||||
implementation("org.thymeleaf.extras:thymeleaf-extras-springsecurity5")
|
||||
implementation("org.jetbrains.kotlin:kotlin-reflect")
|
||||
implementation("org.jetbrains.kotlin:kotlin-stdlib-jdk8")
|
||||
testImplementation(project(":spring-security-test"))
|
||||
testImplementation("org.springframework.boot:spring-boot-starter-test")
|
||||
}
|
||||
|
||||
tasks.withType<KotlinCompile> {
|
||||
kotlinOptions {
|
||||
freeCompilerArgs = listOf("-Xjsr305=strict")
|
||||
jvmTarget = "1.8"
|
||||
}
|
||||
}
|
||||
+29
@@ -0,0 +1,29 @@
|
||||
/*
|
||||
* Copyright 2002-2019 the original author or authors.
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* https://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
package org.springframework.security.samples
|
||||
|
||||
import org.springframework.boot.autoconfigure.SpringBootApplication
|
||||
import org.springframework.boot.runApplication
|
||||
|
||||
/**
|
||||
* @author Eleftheria Stein
|
||||
*/
|
||||
@SpringBootApplication
|
||||
class KotlinApplication
|
||||
|
||||
fun main(args: Array<String>) {
|
||||
runApplication<KotlinApplication>(*args)
|
||||
}
|
||||
+55
@@ -0,0 +1,55 @@
|
||||
/*
|
||||
* Copyright 2002-2019 the original author or authors.
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* https://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
|
||||
package org.springframework.security.samples.config
|
||||
|
||||
import org.springframework.context.annotation.Bean
|
||||
import org.springframework.security.config.annotation.web.builders.HttpSecurity
|
||||
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity
|
||||
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter
|
||||
import org.springframework.security.config.web.servlet.invoke
|
||||
import org.springframework.security.core.userdetails.User
|
||||
import org.springframework.security.core.userdetails.UserDetailsService
|
||||
import org.springframework.security.provisioning.InMemoryUserDetailsManager
|
||||
|
||||
/**
|
||||
* @author Eleftheria Stein
|
||||
*/
|
||||
@EnableWebSecurity
|
||||
class SecurityConfig : WebSecurityConfigurerAdapter() {
|
||||
|
||||
override fun configure(http: HttpSecurity) {
|
||||
http {
|
||||
authorizeRequests {
|
||||
authorize("/css/**", permitAll)
|
||||
authorize("/user/**", hasAuthority("ROLE_USER"))
|
||||
}
|
||||
formLogin {
|
||||
loginPage = "/log-in"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@Bean
|
||||
public override fun userDetailsService(): UserDetailsService {
|
||||
val userDetails = User.withDefaultPasswordEncoder()
|
||||
.username("user")
|
||||
.password("password")
|
||||
.roles("USER")
|
||||
.build()
|
||||
return InMemoryUserDetailsManager(userDetails)
|
||||
}
|
||||
}
|
||||
+42
@@ -0,0 +1,42 @@
|
||||
/*
|
||||
* Copyright 2002-2019 the original author or authors.
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* https://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
|
||||
package org.springframework.security.samples.web
|
||||
|
||||
import org.springframework.stereotype.Controller
|
||||
import org.springframework.web.bind.annotation.GetMapping
|
||||
|
||||
/**
|
||||
* @author Eleftheria Stein
|
||||
*/
|
||||
@Controller
|
||||
class MainController {
|
||||
|
||||
@GetMapping("/")
|
||||
fun index(): String {
|
||||
return "index"
|
||||
}
|
||||
|
||||
@GetMapping("/user/index")
|
||||
fun userIndex(): String {
|
||||
return "user/index"
|
||||
}
|
||||
|
||||
@GetMapping("/log-in")
|
||||
fun login(): String {
|
||||
return "login"
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,6 @@
|
||||
server:
|
||||
port: 8080
|
||||
|
||||
spring:
|
||||
thymeleaf:
|
||||
cache: false
|
||||
@@ -0,0 +1,8 @@
|
||||
body {
|
||||
font-family: sans;
|
||||
font-size: 1em;
|
||||
}
|
||||
|
||||
div.logout {
|
||||
float: right;
|
||||
}
|
||||
@@ -0,0 +1,40 @@
|
||||
<!--
|
||||
~ Copyright 2002-2019 the original author or authors.
|
||||
~
|
||||
~ Licensed under the Apache License, Version 2.0 (the "License");
|
||||
~ you may not use this file except in compliance with the License.
|
||||
~ You may obtain a copy of the License at
|
||||
~
|
||||
~ https://www.apache.org/licenses/LICENSE-2.0
|
||||
~
|
||||
~ Unless required by applicable law or agreed to in writing, software
|
||||
~ distributed under the License is distributed on an "AS IS" BASIS,
|
||||
~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
~ See the License for the specific language governing permissions and
|
||||
~ limitations under the License.
|
||||
-->
|
||||
|
||||
<!DOCTYPE html>
|
||||
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:th="https://www.thymeleaf.org" xmlns:sec="https://www.thymeleaf.org/thymeleaf-extras-springsecurity5">
|
||||
<head>
|
||||
<title>Hello Spring Security</title>
|
||||
<meta charset="utf-8" />
|
||||
<link rel="stylesheet" href="/static/css/main.css" th:href="@{/css/main.css}" />
|
||||
</head>
|
||||
<body>
|
||||
<div th:fragment="logout" class="logout" sec:authorize="isAuthenticated()">
|
||||
Logged in user: <span sec:authentication="name"></span> |
|
||||
Roles: <span sec:authentication="principal.authorities"></span>
|
||||
<div>
|
||||
<form action="#" th:action="@{/logout}" method="post">
|
||||
<input type="submit" value="Logout" />
|
||||
</form>
|
||||
</div>
|
||||
</div>
|
||||
<h1>Hello Spring Security</h1>
|
||||
<p>This is an unsecured page, but you can access the secured pages after authenticating.</p>
|
||||
<ul>
|
||||
<li>Go to the <a href="/user/index" th:href="@{/user/index}">secured pages</a></li>
|
||||
</ul>
|
||||
</body>
|
||||
</html>
|
||||
@@ -0,0 +1,20 @@
|
||||
<!DOCTYPE html>
|
||||
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:th="https://www.thymeleaf.org">
|
||||
<head>
|
||||
<title>Login page</title>
|
||||
<meta charset="utf-8" />
|
||||
<link rel="stylesheet" href="/static/css/main.css" th:href="@{/css/main.css}" />
|
||||
</head>
|
||||
<body>
|
||||
<h1>Login page</h1>
|
||||
<p>Example user: user / password</p>
|
||||
<form th:action="@{/log-in}" method="post">
|
||||
<label for="username">Username</label>:
|
||||
<input type="text" id="username" name="username" autofocus="autofocus" /> <br />
|
||||
<label for="password">Password</label>:
|
||||
<input type="password" id="password" name="password" /> <br />
|
||||
<input type="submit" value="Log in" />
|
||||
</form>
|
||||
<p><a href="/" th:href="@{/}">Back to home page</a></p>
|
||||
</body>
|
||||
</html>
|
||||
@@ -0,0 +1,29 @@
|
||||
<!--
|
||||
~ Copyright 2002-2019 the original author or authors.
|
||||
~
|
||||
~ Licensed under the Apache License, Version 2.0 (the "License");
|
||||
~ you may not use this file except in compliance with the License.
|
||||
~ You may obtain a copy of the License at
|
||||
~
|
||||
~ https://www.apache.org/licenses/LICENSE-2.0
|
||||
~
|
||||
~ Unless required by applicable law or agreed to in writing, software
|
||||
~ distributed under the License is distributed on an "AS IS" BASIS,
|
||||
~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
~ See the License for the specific language governing permissions and
|
||||
~ limitations under the License.
|
||||
-->
|
||||
|
||||
<!DOCTYPE html>
|
||||
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:th="https://www.thymeleaf.org">
|
||||
<head>
|
||||
<title>Hello Spring Security</title>
|
||||
<meta charset="utf-8" />
|
||||
<link rel="stylesheet" href="/static/css/main.css" th:href="@{/css/main.css}" />
|
||||
</head>
|
||||
<body>
|
||||
<div th:substituteby="index::logout"></div>
|
||||
<h1>This is a secured page!</h1>
|
||||
<p><a href="/" th:href="@{/}">Back to home page</a></p>
|
||||
</body>
|
||||
</html>
|
||||
+85
@@ -0,0 +1,85 @@
|
||||
/*
|
||||
* Copyright 2002-2019 the original author or authors.
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* https://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
|
||||
package org.springframework.security.samples
|
||||
|
||||
import org.assertj.core.api.Assertions.assertThat
|
||||
import org.junit.Test
|
||||
import org.junit.runner.RunWith
|
||||
import org.springframework.beans.factory.annotation.Autowired
|
||||
import org.springframework.boot.test.autoconfigure.web.servlet.AutoConfigureMockMvc
|
||||
import org.springframework.boot.test.context.SpringBootTest
|
||||
import org.springframework.mock.web.MockHttpSession
|
||||
import org.springframework.security.test.web.servlet.request.SecurityMockMvcRequestBuilders.formLogin
|
||||
import org.springframework.security.test.web.servlet.response.SecurityMockMvcResultMatchers.authenticated
|
||||
import org.springframework.security.test.web.servlet.response.SecurityMockMvcResultMatchers.unauthenticated
|
||||
import org.springframework.test.context.junit4.SpringRunner
|
||||
import org.springframework.test.web.servlet.MockMvc
|
||||
import org.springframework.test.web.servlet.get
|
||||
import org.springframework.test.web.servlet.result.MockMvcResultMatchers.status
|
||||
|
||||
@RunWith(SpringRunner::class)
|
||||
@SpringBootTest
|
||||
@AutoConfigureMockMvc
|
||||
class KotlinApplicationTests {
|
||||
|
||||
@Autowired
|
||||
private lateinit var mockMvc: MockMvc
|
||||
|
||||
@Test
|
||||
fun `index page is not protected`() {
|
||||
this.mockMvc.get("/")
|
||||
.andExpect {
|
||||
status { isOk }
|
||||
}
|
||||
}
|
||||
|
||||
@Test
|
||||
fun `protected page redirects to login`() {
|
||||
val mvcResult = this.mockMvc.get("/user/index")
|
||||
.andExpect { status { is3xxRedirection } }
|
||||
.andReturn()
|
||||
|
||||
assertThat(mvcResult.response.redirectedUrl).endsWith("/log-in")
|
||||
}
|
||||
|
||||
@Test
|
||||
fun `valid user permitted to log in`() {
|
||||
this.mockMvc.perform(formLogin("/log-in").user("user").password("password"))
|
||||
.andExpect(authenticated())
|
||||
}
|
||||
|
||||
@Test
|
||||
fun `invalid user not permitted to log in`() {
|
||||
this.mockMvc.perform(formLogin("/log-in").user("invalid").password("invalid"))
|
||||
.andExpect(unauthenticated())
|
||||
.andExpect(status().is3xxRedirection)
|
||||
}
|
||||
|
||||
@Test
|
||||
fun `logged in user can access protected page`() {
|
||||
val mvcResult = this.mockMvc.perform(formLogin("/log-in").user("user").password("password"))
|
||||
.andExpect(authenticated()).andReturn()
|
||||
|
||||
val httpSession = mvcResult.request.getSession(false) as MockHttpSession
|
||||
|
||||
this.mockMvc.get("/user/index") {
|
||||
session = httpSession
|
||||
}.andExpect {
|
||||
status { isOk }
|
||||
}
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user