Cwikius-Spring/spring-security
1
0
Fork 0
mirror of synced 2026-08-05 09:47:05 +00:00
Code Issues Packages Projects Releases Wiki Activity

SEC-588: Added extra tests to check cookie values.

Browse Source
This commit is contained in:
Luke Taylor
2007-11-04 12:07:49 +00:00
parent 55b1f9348d
commit 4c44bd782f
3 changed files with 31 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
core/src/test/java/org/springframework/security/ui/rememberme/AbstractRememberMeServicesTests.java
-1
View File
@@ -220,7 +220,6 @@ public class AbstractRememberMeServicesTests {
}
private Cookie[] createLoginCookie(String cookieToken) {
MockRememberMeServices services = new MockRememberMeServices();
Cookie cookie = new Cookie(AbstractRememberMeServices.SPRING_SECURITY_PERSISTENT_REMEMBER_ME_COOKIE_KEY,
core/src/test/java/org/springframework/security/ui/rememberme/PersistentTokenBasedRememberMeServicesTests.java
+29 -9
View File
@@ -19,26 +19,40 @@ public class PersistentTokenBasedRememberMeServicesTests {
@Before
public void setUpData() throws Exception {
services = new PersistentTokenBasedRememberMeServices();
services.setCookieName("mycookiename");
}
@Test(expected = InvalidCookieException.class)
public void loginIsRejectedWithWrongNumberOfCookieTokens() {
services.setCookieName("mycookiename");
services.processAutoLoginCookie(new String[] {"series", "token", "extra"}, new MockHttpServletRequest(),
new MockHttpServletResponse());
}
@Test(expected = RememberMeAuthenticationException.class)
public void loginIsRejectedWhenNoTokenMatchingSeriesIsFound() {
services.setCookieName("mycookiename");
services.setTokenRepository(new MockTokenRepository(null));
services.processAutoLoginCookie(new String[] {"series", "token"}, new MockHttpServletRequest(),
new MockHttpServletResponse());
}
@Test(expected = RememberMeAuthenticationException.class)
public void loginIsRejectedWhenTokenIsExpired() {
MockTokenRepository repo =
new MockTokenRepository(new PersistentRememberMeToken("joe", "series","token", new Date()));
services.setTokenRepository(repo);
services.setTokenValiditySeconds(1);
try {
Thread.sleep(1100);
} catch (InterruptedException e) {
}
services.setTokenRepository(repo);
services.processAutoLoginCookie(new String[] {"series", "token"}, new MockHttpServletRequest(),
new MockHttpServletResponse());
}
@Test(expected = CookieTheftException.class)
public void cookieTheftIsDetectedWhenSeriesAndTokenDontMatch() {
services.setCookieName("mycookiename");
PersistentRememberMeToken token = new PersistentRememberMeToken("joe", "series","wrongtoken", new Date());
services.setTokenRepository(new MockTokenRepository(token));
services.processAutoLoginCookie(new String[] {"series", "token"}, new MockHttpServletRequest(),
@@ -47,16 +61,18 @@ public class PersistentTokenBasedRememberMeServicesTests {
@Test
public void successfulAutoLoginCreatesNewTokenAndCookieWithSameSeries() {
services.setCookieName("mycookiename");
MockTokenRepository repo =
new MockTokenRepository(new PersistentRememberMeToken("joe", "series","token", new Date()));
services.setTokenRepository(repo);
// 12 => b64 length will be 16
services.setTokenLength(12);
services.processAutoLoginCookie(new String[] {"series", "token"}, new MockHttpServletRequest(),
new MockHttpServletResponse());
MockHttpServletResponse response = new MockHttpServletResponse();
services.processAutoLoginCookie(new String[] {"series", "token"}, new MockHttpServletRequest(), response);
assertEquals("series",repo.getStoredToken().getSeries());
assertEquals(16, repo.getStoredToken().getTokenValue().length());
String[] cookie = services.decodeCookie(response.getCookie("mycookiename").getValue());
assertEquals("series", cookie[0]);
assertEquals(repo.getStoredToken().getTokenValue(), cookie[1]);
}
@Test
@@ -66,14 +82,18 @@ public class PersistentTokenBasedRememberMeServicesTests {
services.setTokenRepository(repo);
services.setTokenLength(12);
services.setSeriesLength(12);
MockHttpServletResponse response = new MockHttpServletResponse();
services.loginSuccess(new MockHttpServletRequest(),
new MockHttpServletResponse(), new UsernamePasswordAuthenticationToken("joe","password"));
response, new UsernamePasswordAuthenticationToken("joe","password"));
assertEquals(16, repo.getStoredToken().getSeries().length());
assertEquals(16, repo.getStoredToken().getTokenValue().length());
String[] cookie = services.decodeCookie(response.getCookie("mycookiename").getValue());
assertEquals(repo.getStoredToken().getSeries(), cookie[0]);
assertEquals(repo.getStoredToken().getTokenValue(), cookie[1]);
}
private class MockTokenRepository implements PersistentTokenRepository {
private PersistentRememberMeToken storedToken;