Add Modular Spring Security Configuration
Closes gh-16258
This commit is contained in:
Rob Winch
@@ -242,3 +242,72 @@ It matches the requests in order by the `securityMatcher` definition.
|
||||
In this case, that means that, if the URL path starts with `/api`, Spring Security uses `apiHttpSecurity`.
|
||||
If the URL does not start with `/api`, Spring Security defaults to `webHttpSecurity`, which has an implied `securityMatcher` that matches any request.
|
||||
|
||||
|
||||
[[modular-serverhttpsecurity-configuration]]
|
||||
== Modular ServerHttpSecurity Configuration
|
||||
|
||||
Many users prefer that their Spring Security configuration lives in a centralized place and will choose to configure it within the `SecurityWebFilterChain` Bean declaration.
|
||||
However, there are times that users may want to modularize the configuration.
|
||||
This can be done using:
|
||||
|
||||
* xref:#serverhttpsecurity-customizer-bean[Customizer<ServerHttpSecurity> Beans]
|
||||
* xref:#top-level-customizer-bean[Top Level ServerHttpSecurity Customizer Beans]
|
||||
|
||||
// FIXME: this needs to link to appropriate spot
|
||||
// NOTE: If you are using Spring Security's xref:servlet/configuration/kotlin.adoc[], then you can also expose `*Dsl -> Unit` Beans as outlined in xref:./kotlin.adoc#modular-httpsecuritydsl-configuration[Modular HttpSecurityDsl Configuration].
|
||||
|
||||
|
||||
[[serverhttpsecurity-customizer-bean]]
|
||||
=== Customizer<ServerHttpSecurity> Beans
|
||||
|
||||
If you would like to modularize your security configuration you can place logic in a `Customizer<ServerHttpSecurity>` Bean.
|
||||
For example, the following configuration will ensure all `ServerHttpSecurity` instances are configured to:
|
||||
|
||||
include-code::./ServerHttpSecurityCustomizerBeanConfiguration[tag=httpSecurityCustomizer,indent=0]
|
||||
|
||||
<1> Set the xref:servlet/exploits/headers.adoc#servlet-headers-csp[Content Security Policy] to `object-src 'none'`
|
||||
<2> xref:servlet/exploits/http.adoc#servlet-http-redirect[Redirect any request to https]
|
||||
|
||||
|
||||
[[top-level-customizer-bean]]
|
||||
=== Top Level ServerHttpSecurity Customizer Beans
|
||||
|
||||
If you prefer to have further modularization of your security configuration, Spring Security will automatically apply any top level `HttpSecurity` `Customizer` Beans.
|
||||
|
||||
A top level `HttpSecurity` `Customizer` type can be summarized as any `Customizer<T>` that matches `public HttpSecurity.*(Customizer<T>)`.
|
||||
This translates to any `Customizer<T>` that is a single argument to a public method on javadoc:org.springframework.security.config.annotation.web.builders.HttpSecurity[].
|
||||
|
||||
A few examples can help to clarify.
|
||||
If `Customizer<ContentTypeOptionsConfig>` is published as a Bean, it will not be be automatically applied because it is an argument to javadoc:org.springframework.security.config.annotation.web.configurers.HeadersConfigurer#contentTypeOptions(org.springframework.security.config.Customizer)[] which is not a method defined on `HttpSecurity`.
|
||||
However, if `Customizer<HeadersConfigurer<HttpSecurity>>` is published as a Bean, it will be automatically applied because it is an argument to javadoc:org.springframework.security.config.annotation.web.builders.HttpSecurity#headers(org.springframework.security.config.Customizer)[].
|
||||
|
||||
For example, the following configuration will ensure that the xref:servlet/exploits/headers.adoc#servlet-headers-csp[Content Security Policy] is set to `object-src 'none'`:
|
||||
|
||||
include-code::./TopLevelCustomizerBeanConfiguration[tag=headersCustomizer,indent=0]
|
||||
|
||||
[[customizer-bean-ordering]]
|
||||
=== Customizer Bean Ordering
|
||||
|
||||
First each xref:#httpsecurity-customizer-bean[Customizer<HttpSecurity> Bean] is applied using https://docs.spring.io/spring-framework/docs/current/javadoc-api/org/springframework/beans/factory/ObjectProvider.html#orderedStream()[ObjectProvider#orderedStream()].
|
||||
This means that if there are multiple `Customizer<HttpSecurity>` Beans, the https://docs.spring.io/spring-framework/docs/current/javadoc-api/org/springframework/core/annotation/Order.html[@Order] annotation can be added to the Bean definitions to control the ordering.
|
||||
|
||||
Next every xref:#top-level-customizer-bean[Top Level HttpSecurity Customizer Beans] type is looked up and each is is applied using `ObjectProvider#orderedStream()`.
|
||||
If there is are two `Customizer<HeadersConfigurer<HttpSecurity>>` beans and two `Customizer<HttpsRedirectConfigurer<HttpSecurity>>` instances, the order that each `Customizer` type is invoked is undefined.
|
||||
However, the order that each instance of `Customizer<HttpsRedirectConfigurer<HttpSecurity>>` is defined by `ObjectProvider#orderedStream()` and can be controlled using `@Order` on the Bean the definitions.
|
||||
|
||||
Finally, the `HttpSecurity` Bean is injected as a Bean.
|
||||
All `Customizer` instances are applied before the `HttpSecurity` Bean is created.
|
||||
This allows overriding the customizations provided by the `Customizer` Beans.
|
||||
|
||||
You can find an example below that illustrates the ordering:
|
||||
|
||||
include-code::./CustomizerBeanOrderingConfiguration[tag=sample,indent=0]
|
||||
|
||||
<1> First all `Customizer<HttpSecurity>` instances are applied.
|
||||
The `adminAuthorization` Bean has the highest `@Order` so it is applied first.
|
||||
If there are no `@Order` annotations on the `Customizer<HttpSecurity>` Beans or the `@Order` annotations had the same value, then the order that the `Customizer<HttpSecurity>` instances are applied is undefined.
|
||||
<2> The `userAuthorization` is applied next due to being an instance of `Customizer<HttpSecurity>`
|
||||
<3> The order that the `Customizer` types are undefined.
|
||||
In this example, the order of `contentSecurityPolicy`, `contentTypeOptions`, and `httpsRedirect` are undefined.
|
||||
If `@Order(Ordered.HIGHEST_PRECEDENCE)` was added to `contentTypeOptions`, then we would know that `contentTypeOptions` is before `contentSecurityPolicy` (they are the same type), but we do not know if `httpsRedirect` is before or after the `Customizer<HeadersConfigurer<HttpSecurity>>` Beans.
|
||||
<4> After all of the `Customizer` Beans are applied, the `HttpSecurity` is passed in as a Bean.
|
||||
|
||||
@@ -664,6 +664,75 @@ class Config {
|
||||
----
|
||||
======
|
||||
|
||||
[[modular-httpsecurity-configuration]]
|
||||
== Modular HttpSecurity Configuration
|
||||
|
||||
Many users prefer that their Spring Security configuration lives in a centralized place and will choose to configure it in a single `SecurityFilterChain` instance.
|
||||
However, there are times that users may want to modularize the configuration.
|
||||
This can be done using:
|
||||
|
||||
* xref:#httpsecurity-customizer-bean[Customizer<HttpSecurity> Beans]
|
||||
* xref:#top-level-customizer-bean[Top Level HttpSecurity Customizer Beans]
|
||||
|
||||
NOTE: If you are using Spring Security's xref:servlet/configuration/kotlin.adoc[], then you can also expose `*Dsl -> Unit` Beans as outlined in xref:./kotlin.adoc#modular-httpsecuritydsl-configuration[Modular HttpSecurityDsl Configuration].
|
||||
|
||||
|
||||
[[httpsecurity-customizer-bean]]
|
||||
=== Customizer<HttpSecurity> Beans
|
||||
|
||||
If you would like to modularize your security configuration you can place logic in a `Customizer<HttpSecurity>` Bean.
|
||||
For example, the following configuration will ensure all `HttpSecurity` instances are configured to:
|
||||
|
||||
include-code::./HttpSecurityCustomizerBeanConfiguration[tag=httpSecurityCustomizer,indent=0]
|
||||
|
||||
<1> Set the xref:servlet/exploits/headers.adoc#servlet-headers-csp[Content Security Policy] to `object-src 'none'`
|
||||
<2> xref:servlet/exploits/http.adoc#servlet-http-redirect[Redirect any request to https]
|
||||
|
||||
|
||||
[[top-level-customizer-bean]]
|
||||
=== Top Level HttpSecurity Customizer Beans
|
||||
|
||||
If you prefer to have further modularization of your security configuration, Spring Security will automatically apply any top level `HttpSecurity` `Customizer` Beans.
|
||||
|
||||
A top level `HttpSecurity` `Customizer` type can be summarized as any `Customizer<T>` that matches `public HttpSecurity.*(Customizer<T>)`.
|
||||
This translates to any `Customizer<T>` that is a single argument to a public method on javadoc:org.springframework.security.config.annotation.web.builders.HttpSecurity[].
|
||||
|
||||
A few examples can help to clarify.
|
||||
If `Customizer<ContentTypeOptionsConfig>` is published as a Bean, it will not be be automatically applied because it is an argument to javadoc:org.springframework.security.config.annotation.web.configurers.HeadersConfigurer#contentTypeOptions(org.springframework.security.config.Customizer)[] which is not a method defined on `HttpSecurity`.
|
||||
However, if `Customizer<HeadersConfigurer<HttpSecurity>>` is published as a Bean, it will be automatically applied because it is an argument to javadoc:org.springframework.security.config.annotation.web.builders.HttpSecurity#headers(org.springframework.security.config.Customizer)[].
|
||||
|
||||
For example, the following configuration will ensure that the xref:servlet/exploits/headers.adoc#servlet-headers-csp[Content Security Policy] is set to `object-src 'none'`:
|
||||
|
||||
include-code::./TopLevelCustomizerBeanConfiguration[tag=headersCustomizer,indent=0]
|
||||
|
||||
[[customizer-bean-ordering]]
|
||||
=== Customizer Bean Ordering
|
||||
|
||||
First each xref:#httpsecurity-customizer-bean[Customizer<HttpSecurity> Bean] is applied using https://docs.spring.io/spring-framework/docs/current/javadoc-api/org/springframework/beans/factory/ObjectProvider.html#orderedStream()[ObjectProvider#orderedStream()].
|
||||
This means that if there are multiple `Customizer<HttpSecurity>` Beans, the https://docs.spring.io/spring-framework/docs/current/javadoc-api/org/springframework/core/annotation/Order.html[@Order] annotation can be added to the Bean definitions to control the ordering.
|
||||
|
||||
Next every xref:#top-level-customizer-bean[Top Level HttpSecurity Customizer Beans] type is looked up and each is is applied using `ObjectProvider#orderedStream()`.
|
||||
If there is are two `Customizer<HeadersConfigurer<HttpSecurity>>` beans and two `Customizer<HttpsRedirectConfigurer<HttpSecurity>>` instances, the order that each `Customizer` type is invoked is undefined.
|
||||
However, the order that each instance of `Customizer<HttpsRedirectConfigurer<HttpSecurity>>` is defined by `ObjectProvider#orderedStream()` and can be controlled using `@Order` on the Bean the definitions.
|
||||
|
||||
Finally, the `HttpSecurity` Bean is injected as a Bean.
|
||||
All `Customizer` instances are applied before the `HttpSecurity` Bean is created.
|
||||
This allows overriding the customizations provided by the `Customizer` Beans.
|
||||
|
||||
You can find an example below that illustrates the ordering:
|
||||
|
||||
include-code::./CustomizerBeanOrderingConfiguration[tag=sample,indent=0]
|
||||
|
||||
<1> First all `Customizer<HttpSecurity>` instances are applied.
|
||||
The `adminAuthorization` Bean has the highest `@Order` so it is applied first.
|
||||
If there are no `@Order` annotations on the `Customizer<HttpSecurity>` Beans or the `@Order` annotations had the same value, then the order that the `Customizer<HttpSecurity>` instances are applied is undefined.
|
||||
<2> The `userAuthorization` is applied next due to being an instance of `Customizer<HttpSecurity>`
|
||||
<3> The order that the `Customizer` types are undefined.
|
||||
In this example, the order of `contentSecurityPolicy`, `contentTypeOptions`, and `httpsRedirect` are undefined.
|
||||
If `@Order(Ordered.HIGHEST_PRECEDENCE)` was added to `contentTypeOptions`, then we would know that `contentTypeOptions` is before `contentSecurityPolicy` (they are the same type), but we do not know if `httpsRedirect` is before or after the `Customizer<HeadersConfigurer<HttpSecurity>>` Beans.
|
||||
<4> After all of the `Customizer` Beans are applied, the `HttpSecurity` is passed in as a Bean.
|
||||
|
||||
|
||||
[[post-processing-configured-objects]]
|
||||
== Post Processing Configured Objects
|
||||
|
||||
|
||||
@@ -346,3 +346,76 @@ class BankingSecurityConfig {
|
||||
This configuration will handle requests not covered by the other filter chains and will be processed last (no `@Order` defaults to last).
|
||||
Requests that match `/`, `/user-login`, `/user-logout`, `/notices`, `/contact` and `/register` allow access without authentication.
|
||||
Any other requests require the user to be authenticated to access any URL not explicitly allowed or protected by other filter chains.
|
||||
|
||||
|
||||
[[modular-httpsecuritydsl-configuration]]
|
||||
== Modular HttpSecurityDsl Configuration
|
||||
|
||||
Many users prefer that their Spring Security configuration lives in a centralized place and will choose to configure it in a single `SecurityFilterChain` instance.
|
||||
However, there are times that users may want to modularize the configuration.
|
||||
This can be done using:
|
||||
|
||||
* xref:#httpsecuritydsl-bean[HttpSecurityDsl.() -> Unit Beans]
|
||||
* xref:#top-level-dsl-bean[Top Level Security Dsl Beans]
|
||||
|
||||
NOTE: Since the Spring Security Kotlin Dsl (`HttpSecurityDsl`) uses `HttpSecurity`, all of the Java xref:./kotlin.adoc#modular-bean-configuration[Modular Bean Customization] is applied before xref:#modular-httpsecuritydsl-configuration[Modular HttpSecurity Configuration].
|
||||
|
||||
[[httpsecuritydsl-bean]]
|
||||
=== HttpSecurityDsl.() -> Unit Beans
|
||||
|
||||
If you would like to modularize your security configuration you can place logic in a `HttpSecurityDsl.() -> Unit` Bean.
|
||||
For example, the following configuration will ensure all `HttpSecurityDsl` instances are configured to:
|
||||
|
||||
include-code::./HttpSecurityDslBeanConfiguration[tag=httpSecurityDslBean,indent=0]
|
||||
|
||||
<1> Set the xref:servlet/exploits/headers.adoc#servlet-headers-csp[Content Security Policy] to `object-src 'none'`
|
||||
<2> xref:servlet/exploits/http.adoc#servlet-http-redirect[Redirect any request to https]
|
||||
|
||||
|
||||
[[top-level-dsl-bean]]
|
||||
=== Top Level Security Dsl Beans
|
||||
|
||||
If you prefer to have further modularization of your security configuration, Spring Security will automatically apply any top level Security Dsl Beans.
|
||||
|
||||
A top level Security Dsl can be summarized as any class Dsl class that matches `public HttpSecurityDsl.*(<Dsl>)`.
|
||||
This translates to any Security Dsl that is a single argument to a public method on `HttpSecurityDsl`.
|
||||
|
||||
A few examples can help to clarify.
|
||||
If `ContentTypeOptionsDsl.() -> Unit` is published as a Bean, it will not be be automatically applied because it is an argument to `HeadersDsl#contentTypeOptions(ContentTypeOptionsDsl.() -> Unit)` and is not an argument to a method defined on `HttpSecurityDsl`.
|
||||
However, if `HeadersDsl.() -> Unit` is published as a Bean, it will be automatically applied because it is an argument to `HttpSecurityDsl.headers(HeadersDsl.() -> Unit)`.
|
||||
|
||||
For example, the following configuration ensure all `HttpSecurityDsl` instances are configured to:
|
||||
|
||||
include-code::./TopLevelDslBeanConfiguration[tag=headersSecurity,indent=0]
|
||||
|
||||
<1> Set the xref:servlet/exploits/headers.adoc#servlet-headers-csp[Content Security Policy] to `object-src 'none'`
|
||||
|
||||
[[dsl-bean-ordering]]
|
||||
=== Dsl Bean Ordering
|
||||
|
||||
First, all xref:servlet/configuration/java.adoc#modular-httpsecurity-configuration[Modular HttpSecurity Configuration] is applied since the Kotlin Dsl uses an `HttpSecurity` Bean.
|
||||
|
||||
Second, each xref:#httpsecuritydsl-bean[HttpSecurityDsl.() -> Unit Beans] is applied using https://docs.spring.io/spring-framework/docs/current/javadoc-api/org/springframework/beans/factory/ObjectProvider.html#orderedStream()[ObjectProvider#orderedStream()].
|
||||
This means that if there are multiple `HttpSecurity.() -> Unit` Beans, the https://docs.spring.io/spring-framework/docs/current/javadoc-api/org/springframework/core/annotation/Order.html[@Order] annotation can be added to the Bean definitions to control the ordering.
|
||||
|
||||
Next, every xref:#top-level-dsl-bean[Top Level Security Dsl Beans] type is looked up and each is is applied using `ObjectProvider#orderedStream()`.
|
||||
If there is are differt types of top level security Beans (.e.g. `HeadersDsl.() -> Unit` and `HttpsRedirectDsl.() -> Unit`), then the order that each Dsl type is invoked is undefined.
|
||||
However, the order that each instance of of the same top level security Bean type is defined by `ObjectProvider#orderedStream()` and can be controlled using `@Order` on the Bean the definitions.
|
||||
|
||||
Finally, the `HttpSecurityDsl` Bean is injected as a Bean.
|
||||
All `*Dsl.() -> Unit` Beans are applied before the `HttpSecurityDsl` Bean is created.
|
||||
This allows overriding the customizations provided by the `*Dsl.() -> Unit` Beans.
|
||||
|
||||
You can find an example below that illustrates the ordering:
|
||||
|
||||
include-code::./DslBeanOrderingConfiguration[tag=sample,indent=0]
|
||||
|
||||
<1> All xref:servlet/configuration/java.adoc#modular-httpsecurity-configuration[Modular HttpSecurity Configuration] is applied since the Kotlin Dsl uses an `HttpSecurity` Bean.
|
||||
<2> All `HttpSecurity.() -> Unit` instances are applied.
|
||||
The `adminAuthorization` Bean has the highest `@Order` so it is applied first.
|
||||
If there are no `@Order` annotations on the `HttpSecurity.() -> Unit` Beans or the `@Order` annotations had the same value, then the order that the `HttpSecurity.() -> Unit` instances are applied is undefined.
|
||||
<3> The `userAuthorization` is applied next due to being an instance of `HttpSecurity.() -> Unit`
|
||||
<4> The order that the `*Dsl.() -> Unit` types are undefined.
|
||||
In this example, the order of `contentSecurityPolicy`, `contentTypeOptions`, and `httpsRedirect` are undefined.
|
||||
If `@Order(Ordered.HIGHEST_PRECEDENCE)` was added to `contentTypeOptions`, then we would know that `contentTypeOptions` is before `contentSecurityPolicy` (they are the same type), but we do not know if `httpsRedirect` is before or after the `HeadersDsl.() -> Unit` Beans.
|
||||
<5> After all of the `*Dsl.() -> Unit` Beans are applied, the `HttpSecurityDsl` is passed in as a Bean.
|
||||
|
||||
@@ -15,6 +15,7 @@ Each section that follows will indicate the more notable removals as well as the
|
||||
|
||||
== Config
|
||||
|
||||
* Support modular modular configuration in xref::servlet/configuration/java.adoc#modular-httpsecurity-configuration[Servlets] and xref::reactive/configuration/webflux.adoc#modular-serverhttpsecurity-configuration[WebFlux]
|
||||
* Removed `and()` from the `HttpSecurity` DSL in favor of using the lambda methods
|
||||
* Removed `authorizeRequests` in favor of `authorizeHttpRequests`
|
||||
* Simplified expression migration for `authorizeRequests`
|
||||
|
||||
+99
@@ -0,0 +1,99 @@
|
||||
/*
|
||||
* Copyright 2004-present the original author or authors.
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* https://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
|
||||
package org.springframework.security.docs.reactive.configuration.customizerbeanordering;
|
||||
|
||||
import org.springframework.context.annotation.Bean;
|
||||
import org.springframework.context.annotation.Configuration;
|
||||
import org.springframework.core.Ordered;
|
||||
import org.springframework.core.annotation.Order;
|
||||
import org.springframework.security.config.Customizer;
|
||||
import org.springframework.security.config.annotation.web.reactive.EnableWebFluxSecurity;
|
||||
import org.springframework.security.config.web.server.ServerHttpSecurity;
|
||||
import org.springframework.security.web.server.SecurityWebFilterChain;
|
||||
import org.springframework.web.reactive.config.EnableWebFlux;
|
||||
|
||||
/**
|
||||
*
|
||||
*/
|
||||
@EnableWebFlux
|
||||
@EnableWebFluxSecurity
|
||||
@Configuration(proxyBeanMethods = false)
|
||||
class CustomizerBeanOrderingConfiguration {
|
||||
|
||||
// tag::sample[]
|
||||
@Bean // <4>
|
||||
SecurityWebFilterChain springSecurity(ServerHttpSecurity http) {
|
||||
// @formatter:off
|
||||
http
|
||||
.authorizeExchange((exchange) -> exchange
|
||||
.anyExchange().authenticated()
|
||||
);
|
||||
return http.build();
|
||||
// @formatter:on
|
||||
}
|
||||
|
||||
@Bean
|
||||
@Order(Ordered.LOWEST_PRECEDENCE) // <2>
|
||||
Customizer<ServerHttpSecurity> userAuthorization() {
|
||||
// @formatter:off
|
||||
return (http) -> http
|
||||
.authorizeExchange((exchange) -> exchange
|
||||
.pathMatchers("/users/**").hasRole("USER")
|
||||
);
|
||||
// @formatter:on
|
||||
}
|
||||
|
||||
@Bean
|
||||
@Order(Ordered.HIGHEST_PRECEDENCE) // <1>
|
||||
Customizer<ServerHttpSecurity> adminAuthorization() {
|
||||
// @formatter:off
|
||||
return (http) -> http
|
||||
.authorizeExchange((exchange) -> exchange
|
||||
.pathMatchers("/admins/**").hasRole("ADMIN")
|
||||
);
|
||||
// @formatter:on
|
||||
}
|
||||
|
||||
// <3>
|
||||
|
||||
@Bean
|
||||
Customizer<ServerHttpSecurity.HeaderSpec> contentSecurityPolicy() {
|
||||
// @formatter:off
|
||||
return (headers) -> headers
|
||||
.contentSecurityPolicy((csp) -> csp
|
||||
.policyDirectives("object-src 'none'")
|
||||
);
|
||||
// @formatter:on
|
||||
}
|
||||
|
||||
@Bean
|
||||
Customizer<ServerHttpSecurity.HeaderSpec> contentTypeOptions() {
|
||||
// @formatter:off
|
||||
return (headers) -> headers
|
||||
.contentTypeOptions(Customizer.withDefaults());
|
||||
// @formatter:on
|
||||
}
|
||||
|
||||
@Bean
|
||||
Customizer<ServerHttpSecurity.HttpsRedirectSpec> httpsRedirect() {
|
||||
// @formatter:off
|
||||
return Customizer.withDefaults();
|
||||
// @formatter:on
|
||||
}
|
||||
// end::sample[]
|
||||
|
||||
}
|
||||
+76
@@ -0,0 +1,76 @@
|
||||
/*
|
||||
* Copyright 2004-present the original author or authors.
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* https://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
|
||||
package org.springframework.security.docs.reactive.configuration.customizerbeanordering;
|
||||
|
||||
import org.junit.jupiter.api.Test;
|
||||
import org.junit.jupiter.api.extension.ExtendWith;
|
||||
|
||||
import org.springframework.beans.factory.annotation.Autowired;
|
||||
import org.springframework.security.config.test.SpringTestContext;
|
||||
import org.springframework.security.config.test.SpringTestContextExtension;
|
||||
import org.springframework.test.web.reactive.server.WebTestClient;
|
||||
import org.springframework.test.web.servlet.MockMvc;
|
||||
|
||||
import static org.springframework.security.test.web.reactive.server.SecurityMockServerConfigurers.mockUser;
|
||||
import static org.springframework.security.test.web.servlet.request.SecurityMockMvcRequestPostProcessors.user;
|
||||
import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get;
|
||||
import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;
|
||||
|
||||
/**
|
||||
*
|
||||
*/
|
||||
@ExtendWith(SpringTestContextExtension.class)
|
||||
public class CustomizerBeanOrderingTests {
|
||||
public final SpringTestContext spring = new SpringTestContext(this);
|
||||
|
||||
@Autowired
|
||||
private WebTestClient webTest;
|
||||
|
||||
@Test
|
||||
void authorizationOrdered() throws Exception {
|
||||
this.spring.register(
|
||||
CustomizerBeanOrderingConfiguration.class).autowire();
|
||||
// @formatter:off
|
||||
this.webTest.mutateWith(mockUser("admin").roles("ADMIN"))
|
||||
.get()
|
||||
.uri("https://localhost/admins/1")
|
||||
.exchange()
|
||||
.expectStatus().isOk();
|
||||
this.webTest.mutateWith(mockUser("user").roles("USER"))
|
||||
.get()
|
||||
.uri("https://localhost/admins/1")
|
||||
.exchange()
|
||||
.expectStatus().isForbidden();
|
||||
this.webTest.mutateWith(mockUser("user").roles("USER"))
|
||||
.get()
|
||||
.uri("https://localhost/users/1")
|
||||
.exchange()
|
||||
.expectStatus().isOk();
|
||||
this.webTest.mutateWith(mockUser("user").roles("OTHER"))
|
||||
.get()
|
||||
.uri("https://localhost/users/1")
|
||||
.exchange()
|
||||
.expectStatus().isForbidden();
|
||||
this.webTest.mutateWith(mockUser("authenticated").roles("OTHER"))
|
||||
.get()
|
||||
.uri("https://localhost/other")
|
||||
.exchange()
|
||||
.expectStatus().isOk();
|
||||
// @formatter:on
|
||||
}
|
||||
|
||||
}
|
||||
+61
@@ -0,0 +1,61 @@
|
||||
/*
|
||||
* Copyright 2004-present the original author or authors.
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* https://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
|
||||
package org.springframework.security.docs.reactive.configuration.serverhttpsecuritycustomizerbean;
|
||||
|
||||
import org.springframework.context.annotation.Bean;
|
||||
import org.springframework.context.annotation.Configuration;
|
||||
import org.springframework.security.config.Customizer;
|
||||
import org.springframework.security.config.annotation.web.reactive.EnableWebFluxSecurity;
|
||||
import org.springframework.security.config.web.server.ServerHttpSecurity;
|
||||
import org.springframework.security.web.server.SecurityWebFilterChain;
|
||||
|
||||
/**
|
||||
*
|
||||
*/
|
||||
@EnableWebFluxSecurity
|
||||
@Configuration(proxyBeanMethods = false)
|
||||
class ServerHttpSecurityCustomizerBeanConfiguration {
|
||||
|
||||
@Bean
|
||||
SecurityWebFilterChain springSecurity(ServerHttpSecurity http) {
|
||||
// @formatter:off
|
||||
http
|
||||
.authorizeExchange((exchange) -> exchange
|
||||
.anyExchange().authenticated()
|
||||
);
|
||||
return http.build();
|
||||
// @formatter:on
|
||||
}
|
||||
|
||||
// tag::httpSecurityCustomizer[]
|
||||
@Bean
|
||||
Customizer<ServerHttpSecurity> httpSecurityCustomizer() {
|
||||
// @formatter:off
|
||||
return (http) -> http
|
||||
.headers((headers) -> headers
|
||||
.contentSecurityPolicy((csp) -> csp
|
||||
// <1>
|
||||
.policyDirectives("object-src 'none'")
|
||||
)
|
||||
)
|
||||
// <2>
|
||||
.redirectToHttps(Customizer.withDefaults());
|
||||
// @formatter:on
|
||||
}
|
||||
// end::httpSecurityCustomizer[]
|
||||
|
||||
}
|
||||
+56
@@ -0,0 +1,56 @@
|
||||
/*
|
||||
* Copyright 2004-present the original author or authors.
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* https://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
|
||||
package org.springframework.security.docs.reactive.configuration.serverhttpsecuritycustomizerbean;
|
||||
|
||||
import org.junit.jupiter.api.Test;
|
||||
import org.junit.jupiter.api.extension.ExtendWith;
|
||||
|
||||
import org.springframework.beans.factory.annotation.Autowired;
|
||||
import org.springframework.security.config.test.SpringTestContext;
|
||||
import org.springframework.security.config.test.SpringTestContextExtension;
|
||||
import org.springframework.test.web.reactive.server.WebTestClient;
|
||||
|
||||
import static org.assertj.core.api.Assertions.assertThat;
|
||||
|
||||
/**
|
||||
*
|
||||
*/
|
||||
@ExtendWith(SpringTestContextExtension.class)
|
||||
public class ServerHttpSecurityCustomizerBeanTests {
|
||||
public final SpringTestContext spring = new SpringTestContext(this);
|
||||
|
||||
@Autowired
|
||||
private WebTestClient webTest;
|
||||
|
||||
@Test
|
||||
void httpSecurityCustomizer() throws Exception {
|
||||
this.spring.register(
|
||||
ServerHttpSecurityCustomizerBeanConfiguration.class).autowire();
|
||||
// @formatter:off
|
||||
this.webTest
|
||||
.get()
|
||||
.uri("http://localhost/")
|
||||
.exchange()
|
||||
.expectHeader().location("https://localhost/")
|
||||
.expectHeader()
|
||||
.value("Content-Security-Policy", csp ->
|
||||
assertThat(csp).isEqualTo("object-src 'none'")
|
||||
);
|
||||
// @formatter:on
|
||||
}
|
||||
|
||||
}
|
||||
+58
@@ -0,0 +1,58 @@
|
||||
/*
|
||||
* Copyright 2004-present the original author or authors.
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* https://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
|
||||
package org.springframework.security.docs.reactive.configuration.toplevelcustomizerbean;
|
||||
|
||||
import org.springframework.context.annotation.Bean;
|
||||
import org.springframework.context.annotation.Configuration;
|
||||
import org.springframework.security.config.Customizer;
|
||||
import org.springframework.security.config.annotation.web.reactive.EnableWebFluxSecurity;
|
||||
import org.springframework.security.config.web.server.ServerHttpSecurity;
|
||||
import org.springframework.security.web.server.SecurityWebFilterChain;
|
||||
import org.springframework.web.reactive.config.EnableWebFlux;
|
||||
|
||||
/**
|
||||
*
|
||||
*/
|
||||
@EnableWebFluxSecurity
|
||||
@Configuration(proxyBeanMethods = false)
|
||||
public class TopLevelCustomizerBeanConfiguration {
|
||||
|
||||
@Bean
|
||||
SecurityWebFilterChain springSecurity(ServerHttpSecurity http) {
|
||||
// @formatter:off
|
||||
http
|
||||
.authorizeExchange((exchange) -> exchange
|
||||
.anyExchange().authenticated()
|
||||
);
|
||||
return http.build();
|
||||
// @formatter:on
|
||||
}
|
||||
|
||||
// tag::headersCustomizer[]
|
||||
@Bean
|
||||
Customizer<ServerHttpSecurity.HeaderSpec> headersSecurity() {
|
||||
// @formatter:off
|
||||
return (headers) -> headers
|
||||
.contentSecurityPolicy((csp) -> csp
|
||||
// <1>
|
||||
.policyDirectives("object-src 'none'")
|
||||
);
|
||||
// @formatter:on
|
||||
}
|
||||
// end::headersCustomizer[]
|
||||
|
||||
}
|
||||
+61
@@ -0,0 +1,61 @@
|
||||
/*
|
||||
* Copyright 2004-present the original author or authors.
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* https://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
|
||||
package org.springframework.security.docs.reactive.configuration.toplevelcustomizerbean;
|
||||
|
||||
import org.jetbrains.annotations.NotNull;
|
||||
import org.junit.jupiter.api.Test;
|
||||
import org.junit.jupiter.api.extension.ExtendWith;
|
||||
|
||||
import org.springframework.beans.factory.annotation.Autowired;
|
||||
import org.springframework.security.config.test.SpringTestContext;
|
||||
import org.springframework.security.config.test.SpringTestContextExtension;
|
||||
import org.springframework.test.web.reactive.server.WebTestClient;
|
||||
import org.springframework.test.web.servlet.ResultMatcher;
|
||||
|
||||
import static org.assertj.core.api.Assertions.assertThat;
|
||||
import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.header;
|
||||
|
||||
/**
|
||||
*
|
||||
*/
|
||||
@ExtendWith(SpringTestContextExtension.class)
|
||||
public class TopLevelCustomizerBeanTests {
|
||||
public final SpringTestContext spring = new SpringTestContext(this);
|
||||
|
||||
@Autowired
|
||||
private WebTestClient webTest;
|
||||
|
||||
|
||||
@Test
|
||||
void headersCustomizer() throws Exception {
|
||||
this.spring.register(TopLevelCustomizerBeanConfiguration.class).autowire();
|
||||
// @formatter:off
|
||||
this.webTest
|
||||
.get()
|
||||
.uri("http://localhost/")
|
||||
.exchange()
|
||||
.expectHeader()
|
||||
.value("Content-Security-Policy", csp ->
|
||||
assertThat(csp).isEqualTo("object-src 'none'")
|
||||
);
|
||||
// @formatter:on
|
||||
}
|
||||
|
||||
private static @NotNull ResultMatcher cspIsObjectSrcNone() {
|
||||
return header().string("Content-Security-Policy", "object-src 'none'");
|
||||
}
|
||||
}
|
||||
+102
@@ -0,0 +1,102 @@
|
||||
/*
|
||||
* Copyright 2004-present the original author or authors.
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* https://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
|
||||
package org.springframework.security.docs.servlet.configuration.customizerbeanordering;
|
||||
|
||||
import org.springframework.context.annotation.Bean;
|
||||
import org.springframework.context.annotation.Configuration;
|
||||
import org.springframework.core.Ordered;
|
||||
import org.springframework.core.annotation.Order;
|
||||
import org.springframework.security.config.Customizer;
|
||||
import org.springframework.security.config.ThrowingCustomizer;
|
||||
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
|
||||
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
|
||||
import org.springframework.security.config.annotation.web.configurers.HeadersConfigurer;
|
||||
import org.springframework.security.config.annotation.web.configurers.HttpsRedirectConfigurer;
|
||||
import org.springframework.security.web.SecurityFilterChain;
|
||||
import org.springframework.web.servlet.config.annotation.EnableWebMvc;
|
||||
|
||||
/**
|
||||
*
|
||||
*/
|
||||
@EnableWebMvc
|
||||
@EnableWebSecurity
|
||||
@Configuration(proxyBeanMethods = false)
|
||||
class CustomizerBeanOrderingConfiguration {
|
||||
|
||||
// tag::sample[]
|
||||
@Bean // <4>
|
||||
SecurityFilterChain springSecurity(HttpSecurity http) throws Exception {
|
||||
// @formatter:off
|
||||
http
|
||||
.authorizeHttpRequests((requests) -> requests
|
||||
.anyRequest().authenticated()
|
||||
);
|
||||
return http.build();
|
||||
// @formatter:on
|
||||
}
|
||||
|
||||
@Bean
|
||||
@Order(Ordered.LOWEST_PRECEDENCE) // <2>
|
||||
ThrowingCustomizer<HttpSecurity> userAuthorization() {
|
||||
// @formatter:off
|
||||
return (http) -> http
|
||||
.authorizeHttpRequests((requests) -> requests
|
||||
.requestMatchers("/users/**").hasRole("USER")
|
||||
);
|
||||
// @formatter:on
|
||||
}
|
||||
|
||||
@Bean
|
||||
@Order(Ordered.HIGHEST_PRECEDENCE) // <1>
|
||||
ThrowingCustomizer<HttpSecurity> adminAuthorization() {
|
||||
// @formatter:off
|
||||
return (http) -> http
|
||||
.authorizeHttpRequests((requests) -> requests
|
||||
.requestMatchers("/admins/**").hasRole("ADMIN")
|
||||
);
|
||||
// @formatter:on
|
||||
}
|
||||
|
||||
// <3>
|
||||
|
||||
@Bean
|
||||
Customizer<HeadersConfigurer<HttpSecurity>> contentSecurityPolicy() {
|
||||
// @formatter:off
|
||||
return (headers) -> headers
|
||||
.contentSecurityPolicy((csp) -> csp
|
||||
.policyDirectives("object-src 'none'")
|
||||
);
|
||||
// @formatter:on
|
||||
}
|
||||
|
||||
@Bean
|
||||
Customizer<HeadersConfigurer<HttpSecurity>> contentTypeOptions() {
|
||||
// @formatter:off
|
||||
return (headers) -> headers
|
||||
.contentTypeOptions(Customizer.withDefaults());
|
||||
// @formatter:on
|
||||
}
|
||||
|
||||
@Bean
|
||||
Customizer<HttpsRedirectConfigurer<HttpSecurity>> httpsRedirect() {
|
||||
// @formatter:off
|
||||
return Customizer.withDefaults();
|
||||
// @formatter:on
|
||||
}
|
||||
// end::sample[]
|
||||
|
||||
}
|
||||
+64
@@ -0,0 +1,64 @@
|
||||
/*
|
||||
* Copyright 2004-present the original author or authors.
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* https://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
|
||||
package org.springframework.security.docs.servlet.configuration.customizerbeanordering;
|
||||
|
||||
import org.junit.jupiter.api.Test;
|
||||
import org.junit.jupiter.api.extension.ExtendWith;
|
||||
|
||||
import org.springframework.beans.factory.annotation.Autowired;
|
||||
import org.springframework.security.config.test.SpringTestContext;
|
||||
import org.springframework.security.config.test.SpringTestContextExtension;
|
||||
import org.springframework.test.web.servlet.MockMvc;
|
||||
|
||||
import static org.springframework.security.test.web.servlet.request.SecurityMockMvcRequestPostProcessors.user;
|
||||
import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get;
|
||||
import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;
|
||||
|
||||
/**
|
||||
*
|
||||
*/
|
||||
@ExtendWith(SpringTestContextExtension.class)
|
||||
public class CustomizerBeanOrderingTests {
|
||||
public final SpringTestContext spring = new SpringTestContext(this).mockMvcAfterSpringSecurityOk();
|
||||
|
||||
@Autowired
|
||||
private MockMvc mockMvc;
|
||||
|
||||
@Test
|
||||
void authorizationOrdered() throws Exception {
|
||||
this.spring.register(
|
||||
CustomizerBeanOrderingConfiguration.class).autowire();
|
||||
// @formatter:off
|
||||
this.mockMvc
|
||||
.perform(get("https://localhost/admins/1").with(user("admin").roles("ADMIN")))
|
||||
.andExpect(status().isOk());
|
||||
this.mockMvc
|
||||
.perform(get("https://localhost/admins/1").with(user("user").roles("USER")))
|
||||
.andExpect(status().isForbidden());
|
||||
this.mockMvc
|
||||
.perform(get("https://localhost/users/1").with(user("user").roles("USER")))
|
||||
.andExpect(status().isOk());
|
||||
this.mockMvc
|
||||
.perform(get("https://localhost/users/1").with(user("user").roles("OTHER")))
|
||||
.andExpect(status().isForbidden());
|
||||
this.mockMvc
|
||||
.perform(get("https://localhost/other").with(user("authenticated").roles("OTHER")))
|
||||
.andExpect(status().isOk());
|
||||
// @formatter:on
|
||||
}
|
||||
|
||||
}
|
||||
+77
@@ -0,0 +1,77 @@
|
||||
/*
|
||||
* Copyright 2004-present the original author or authors.
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* https://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
|
||||
package org.springframework.security.docs.servlet.configuration.httpsecuritycustomizerbean;
|
||||
|
||||
import org.jetbrains.annotations.NotNull;
|
||||
import org.junit.jupiter.api.Test;
|
||||
import org.junit.jupiter.api.extension.ExtendWith;
|
||||
|
||||
import org.springframework.beans.factory.annotation.Autowired;
|
||||
import org.springframework.context.annotation.Bean;
|
||||
import org.springframework.context.annotation.Configuration;
|
||||
import org.springframework.context.annotation.Import;
|
||||
import org.springframework.security.config.Customizer;
|
||||
import org.springframework.security.config.ThrowingCustomizer;
|
||||
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
|
||||
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
|
||||
import org.springframework.security.config.annotation.web.configurers.HeadersConfigurer;
|
||||
import org.springframework.security.config.test.SpringTestContext;
|
||||
import org.springframework.security.config.test.SpringTestContextExtension;
|
||||
import org.springframework.security.web.SecurityFilterChain;
|
||||
import org.springframework.test.web.servlet.MockMvc;
|
||||
import org.springframework.test.web.servlet.ResultMatcher;
|
||||
|
||||
import static org.assertj.core.api.Assertions.assertThat;
|
||||
import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get;
|
||||
import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.header;
|
||||
|
||||
/**
|
||||
*
|
||||
*/
|
||||
@EnableWebSecurity
|
||||
@Configuration(proxyBeanMethods = false)
|
||||
class HttpSecurityCustomizerBeanConfiguration {
|
||||
|
||||
@Bean
|
||||
SecurityFilterChain springSecurity(HttpSecurity http) throws Exception {
|
||||
// @formatter:off
|
||||
http
|
||||
.authorizeHttpRequests((requests) -> requests
|
||||
.anyRequest().authenticated()
|
||||
);
|
||||
return http.build();
|
||||
// @formatter:on
|
||||
}
|
||||
|
||||
// tag::httpSecurityCustomizer[]
|
||||
@Bean
|
||||
ThrowingCustomizer<HttpSecurity> httpSecurityCustomizer() {
|
||||
// @formatter:off
|
||||
return (http) -> http
|
||||
.headers((headers) -> headers
|
||||
.contentSecurityPolicy((csp) -> csp
|
||||
// <1>
|
||||
.policyDirectives("object-src 'none'")
|
||||
)
|
||||
)
|
||||
// <2>
|
||||
.redirectToHttps(Customizer.withDefaults());
|
||||
// @formatter:on
|
||||
}
|
||||
// end::httpSecurityCustomizer[]
|
||||
|
||||
}
|
||||
+74
@@ -0,0 +1,74 @@
|
||||
/*
|
||||
* Copyright 2004-present the original author or authors.
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* https://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
|
||||
package org.springframework.security.docs.servlet.configuration.httpsecuritycustomizerbean;
|
||||
|
||||
import org.jetbrains.annotations.NotNull;
|
||||
import org.junit.jupiter.api.Test;
|
||||
import org.junit.jupiter.api.extension.ExtendWith;
|
||||
|
||||
import org.springframework.beans.factory.annotation.Autowired;
|
||||
import org.springframework.context.annotation.Bean;
|
||||
import org.springframework.context.annotation.Configuration;
|
||||
import org.springframework.context.annotation.Import;
|
||||
import org.springframework.security.config.Customizer;
|
||||
import org.springframework.security.config.ThrowingCustomizer;
|
||||
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
|
||||
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
|
||||
import org.springframework.security.config.annotation.web.configurers.HeadersConfigurer;
|
||||
import org.springframework.security.config.test.SpringTestContext;
|
||||
import org.springframework.security.config.test.SpringTestContextExtension;
|
||||
import org.springframework.security.web.SecurityFilterChain;
|
||||
import org.springframework.test.web.servlet.MockMvc;
|
||||
import org.springframework.test.web.servlet.ResultMatcher;
|
||||
|
||||
import static org.assertj.core.api.Assertions.assertThat;
|
||||
import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get;
|
||||
import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.header;
|
||||
|
||||
/**
|
||||
*
|
||||
*/
|
||||
@ExtendWith(SpringTestContextExtension.class)
|
||||
public class HttpSecurityCustomizerBeanTests {
|
||||
public final SpringTestContext spring = new SpringTestContext(this);
|
||||
|
||||
@Autowired
|
||||
private MockMvc mockMvc;
|
||||
|
||||
@Test
|
||||
void httpSecurityCustomizer() throws Exception {
|
||||
this.spring.register(HttpSecurityCustomizerBeanConfiguration.class).autowire();
|
||||
// @formatter:off
|
||||
this.mockMvc
|
||||
.perform(get("/"))
|
||||
.andExpect(redirectsToHttps());
|
||||
// headers are not sent back as a part of the redirect to https, so a separate request is necessary
|
||||
this.mockMvc.perform(get("https://localhost/"))
|
||||
.andExpect(cspIsObjectSrcNone());
|
||||
// @formatter:on
|
||||
}
|
||||
|
||||
private static @NotNull ResultMatcher redirectsToHttps() {
|
||||
return mvcResult -> assertThat(
|
||||
mvcResult.getResponse().getRedirectedUrl()).startsWith("https://");
|
||||
}
|
||||
|
||||
private static @NotNull ResultMatcher cspIsObjectSrcNone() {
|
||||
return header().string("Content-Security-Policy", "object-src 'none'");
|
||||
}
|
||||
|
||||
}
|
||||
+71
@@ -0,0 +1,71 @@
|
||||
/*
|
||||
* Copyright 2004-present the original author or authors.
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* https://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
|
||||
package org.springframework.security.docs.servlet.configuration.toplevelcustomizerbean;
|
||||
|
||||
import org.jetbrains.annotations.NotNull;
|
||||
import org.junit.jupiter.api.Test;
|
||||
|
||||
import org.springframework.beans.factory.annotation.Autowired;
|
||||
import org.springframework.context.annotation.Bean;
|
||||
import org.springframework.context.annotation.Configuration;
|
||||
import org.springframework.context.annotation.Import;
|
||||
import org.springframework.security.config.Customizer;
|
||||
import org.springframework.security.config.ThrowingCustomizer;
|
||||
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
|
||||
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
|
||||
import org.springframework.security.config.annotation.web.configurers.HeadersConfigurer;
|
||||
import org.springframework.security.config.test.SpringTestContext;
|
||||
import org.springframework.security.web.SecurityFilterChain;
|
||||
import org.springframework.test.web.servlet.MockMvc;
|
||||
import org.springframework.test.web.servlet.ResultMatcher;
|
||||
|
||||
import static org.assertj.core.api.Assertions.assertThat;
|
||||
import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get;
|
||||
import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.header;
|
||||
|
||||
/**
|
||||
*
|
||||
*/
|
||||
@EnableWebSecurity
|
||||
@Configuration(proxyBeanMethods = false)
|
||||
public class TopLevelCustomizerBeanConfiguration {
|
||||
|
||||
@Bean
|
||||
SecurityFilterChain springSecurity(HttpSecurity http) throws Exception {
|
||||
// @formatter:off
|
||||
http
|
||||
.authorizeHttpRequests((requests) -> requests
|
||||
.anyRequest().authenticated()
|
||||
);
|
||||
return http.build();
|
||||
// @formatter:on
|
||||
}
|
||||
|
||||
// tag::headersCustomizer[]
|
||||
@Bean
|
||||
Customizer<HeadersConfigurer<HttpSecurity>> headersSecurity() {
|
||||
// @formatter:off
|
||||
return (headers) -> headers
|
||||
.contentSecurityPolicy((csp) -> csp
|
||||
// <1>
|
||||
.policyDirectives("object-src 'none'")
|
||||
);
|
||||
// @formatter:on
|
||||
}
|
||||
// end::headersCustomizer[]
|
||||
|
||||
}
|
||||
+66
@@ -0,0 +1,66 @@
|
||||
/*
|
||||
* Copyright 2004-present the original author or authors.
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* https://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
|
||||
package org.springframework.security.docs.servlet.configuration.toplevelcustomizerbean;
|
||||
|
||||
import org.jetbrains.annotations.NotNull;
|
||||
import org.junit.jupiter.api.Test;
|
||||
import org.junit.jupiter.api.extension.ExtendWith;
|
||||
|
||||
import org.springframework.beans.factory.annotation.Autowired;
|
||||
import org.springframework.context.annotation.Bean;
|
||||
import org.springframework.context.annotation.Configuration;
|
||||
import org.springframework.context.annotation.Import;
|
||||
import org.springframework.security.config.Customizer;
|
||||
import org.springframework.security.config.ThrowingCustomizer;
|
||||
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
|
||||
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
|
||||
import org.springframework.security.config.annotation.web.configurers.HeadersConfigurer;
|
||||
import org.springframework.security.config.test.SpringTestContext;
|
||||
import org.springframework.security.config.test.SpringTestContextExtension;
|
||||
import org.springframework.security.web.SecurityFilterChain;
|
||||
import org.springframework.test.web.servlet.MockMvc;
|
||||
import org.springframework.test.web.servlet.ResultMatcher;
|
||||
|
||||
import static org.assertj.core.api.Assertions.assertThat;
|
||||
import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get;
|
||||
import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.header;
|
||||
|
||||
/**
|
||||
*
|
||||
*/
|
||||
@ExtendWith(SpringTestContextExtension.class)
|
||||
public class TopLevelCustomizerBeanTests {
|
||||
public final SpringTestContext spring = new SpringTestContext(this);
|
||||
|
||||
@Autowired
|
||||
private MockMvc mockMvc;
|
||||
|
||||
|
||||
@Test
|
||||
void headersCustomizer() throws Exception {
|
||||
this.spring.register(TopLevelCustomizerBeanConfiguration.class).autowire();
|
||||
// @formatter:off
|
||||
this.mockMvc
|
||||
.perform(get("/"))
|
||||
.andExpect(cspIsObjectSrcNone());
|
||||
// @formatter:on
|
||||
}
|
||||
|
||||
private static @NotNull ResultMatcher cspIsObjectSrcNone() {
|
||||
return header().string("Content-Security-Policy", "object-src 'none'");
|
||||
}
|
||||
}
|
||||
+104
@@ -0,0 +1,104 @@
|
||||
/*
|
||||
* Copyright 2004-present the original author or authors.
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* https://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
|
||||
package org.springframework.security.kt.docs.reactive.configuration.customizerbeanordering
|
||||
|
||||
import org.springframework.context.annotation.Bean
|
||||
import org.springframework.context.annotation.Configuration
|
||||
import org.springframework.core.Ordered
|
||||
import org.springframework.core.annotation.Order
|
||||
import org.springframework.security.config.Customizer
|
||||
import org.springframework.security.config.ThrowingCustomizer
|
||||
import org.springframework.security.config.annotation.web.builders.HttpSecurity
|
||||
import org.springframework.security.config.annotation.web.configurers.HeadersConfigurer
|
||||
import org.springframework.security.config.annotation.web.configurers.HttpsRedirectConfigurer
|
||||
import org.springframework.security.config.annotation.web.reactive.EnableWebFluxSecurity
|
||||
import org.springframework.security.config.web.server.ServerHttpSecurity
|
||||
import org.springframework.security.web.server.SecurityWebFilterChain
|
||||
import org.springframework.security.web.server.util.matcher.ServerWebExchangeMatchers.anyExchange
|
||||
|
||||
/**
|
||||
*
|
||||
*/
|
||||
@EnableWebFluxSecurity
|
||||
@Configuration(proxyBeanMethods = false)
|
||||
internal class CustomizerBeanOrderingConfiguration {
|
||||
// tag::sample[]
|
||||
@Bean // <4>
|
||||
fun springSecurity(http: ServerHttpSecurity): SecurityWebFilterChain {
|
||||
// @formatter:off
|
||||
http
|
||||
.authorizeExchange({ exchanges -> exchanges
|
||||
.anyExchange().authenticated()
|
||||
})
|
||||
return http.build()
|
||||
// @formatter:on
|
||||
}
|
||||
|
||||
@Bean
|
||||
@Order(Ordered.LOWEST_PRECEDENCE) // <2>
|
||||
fun userAuthorization(): Customizer<ServerHttpSecurity> {
|
||||
// @formatter:off
|
||||
return Customizer { http -> http
|
||||
.authorizeExchange { exchanges -> exchanges
|
||||
.pathMatchers("/users/**").hasRole("USER")
|
||||
}
|
||||
}
|
||||
// @formatter:on
|
||||
}
|
||||
|
||||
@Bean
|
||||
@Order(Ordered.HIGHEST_PRECEDENCE) // <1>
|
||||
fun adminAuthorization(): Customizer<ServerHttpSecurity> {
|
||||
// @formatter:off
|
||||
return ThrowingCustomizer { http -> http
|
||||
.authorizeExchange { exchanges -> exchanges
|
||||
.pathMatchers("/admins/**").hasRole("ADMIN")
|
||||
}
|
||||
}
|
||||
// @formatter:on
|
||||
}
|
||||
|
||||
// <3>
|
||||
|
||||
@Bean
|
||||
fun contentSecurityPolicy(): Customizer<ServerHttpSecurity.HeaderSpec> {
|
||||
// @formatter:off
|
||||
return Customizer { headers -> headers
|
||||
.contentSecurityPolicy { csp -> csp
|
||||
.policyDirectives("object-src 'none'")
|
||||
}
|
||||
}
|
||||
// @formatter:on
|
||||
}
|
||||
|
||||
@Bean
|
||||
fun contentTypeOptions(): Customizer<ServerHttpSecurity.HeaderSpec> {
|
||||
// @formatter:off
|
||||
return Customizer { headers -> headers
|
||||
.contentTypeOptions(Customizer.withDefaults())
|
||||
}
|
||||
// @formatter:on
|
||||
}
|
||||
|
||||
@Bean
|
||||
fun httpsRedirect(): Customizer<ServerHttpSecurity.HttpsRedirectSpec> {
|
||||
// @formatter:off
|
||||
return Customizer.withDefaults()
|
||||
// @formatter:on
|
||||
}
|
||||
// end::sample[]
|
||||
}
|
||||
+74
@@ -0,0 +1,74 @@
|
||||
/*
|
||||
* Copyright 2004-present the original author or authors.
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* https://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
package org.springframework.security.kt.docs.reactive.configuration.customizerbeanordering
|
||||
|
||||
import org.junit.jupiter.api.Test
|
||||
import org.junit.jupiter.api.extension.ExtendWith
|
||||
import org.springframework.beans.factory.annotation.Autowired
|
||||
import org.springframework.security.config.test.SpringTestContext
|
||||
import org.springframework.security.config.test.SpringTestContextExtension
|
||||
import org.springframework.security.test.web.reactive.server.SecurityMockServerConfigurers.mockUser
|
||||
import org.springframework.security.test.web.servlet.request.SecurityMockMvcRequestPostProcessors
|
||||
import org.springframework.security.test.web.servlet.request.SecurityMockMvcRequestPostProcessors.user
|
||||
import org.springframework.test.web.reactive.server.WebTestClient
|
||||
import org.springframework.test.web.servlet.MockMvc
|
||||
import org.springframework.test.web.servlet.get
|
||||
import org.springframework.test.web.servlet.request.MockMvcRequestBuilders
|
||||
import org.springframework.test.web.servlet.result.MockMvcResultMatchers
|
||||
|
||||
/**
|
||||
*
|
||||
*/
|
||||
@ExtendWith(SpringTestContextExtension::class)
|
||||
class CustomizerBeanOrderingTests {
|
||||
@JvmField
|
||||
val spring = SpringTestContext(this)
|
||||
|
||||
@Autowired
|
||||
lateinit var webTest: WebTestClient
|
||||
|
||||
@Test
|
||||
fun authorizationOrdered() {
|
||||
this.spring.register(CustomizerBeanOrderingConfiguration::class.java).autowire()
|
||||
// @formatter:off
|
||||
this.webTest.mutateWith(mockUser("admin").roles("ADMIN"))
|
||||
.get()
|
||||
.uri("https://localhost/admins/1")
|
||||
.exchange()
|
||||
.expectStatus().isOk
|
||||
this.webTest.mutateWith(mockUser("user").roles("USER"))
|
||||
.get()
|
||||
.uri("https://localhost/admins/1")
|
||||
.exchange()
|
||||
.expectStatus().isForbidden
|
||||
this.webTest.mutateWith(mockUser("user").roles("USER"))
|
||||
.get()
|
||||
.uri("https://localhost/users/1")
|
||||
.exchange()
|
||||
.expectStatus().isOk
|
||||
this.webTest.mutateWith(mockUser("user").roles("OTHER"))
|
||||
.get()
|
||||
.uri("https://localhost/users/1")
|
||||
.exchange()
|
||||
.expectStatus().isForbidden
|
||||
this.webTest.mutateWith(mockUser("other").roles("OTHER"))
|
||||
.get()
|
||||
.uri("https://localhost/other")
|
||||
.exchange()
|
||||
.expectStatus().isOk
|
||||
// @formatter:on
|
||||
}
|
||||
}
|
||||
+99
@@ -0,0 +1,99 @@
|
||||
/*
|
||||
* Copyright 2004-present the original author or authors.
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* https://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
package org.springframework.security.kt.docs.reactive.configuration.dslbeanordering
|
||||
|
||||
import org.springframework.context.annotation.Bean
|
||||
import org.springframework.context.annotation.Configuration
|
||||
import org.springframework.core.Ordered
|
||||
import org.springframework.core.annotation.Order
|
||||
import org.springframework.security.config.annotation.web.reactive.EnableWebFluxSecurity
|
||||
import org.springframework.security.config.web.server.*
|
||||
import org.springframework.security.web.server.SecurityWebFilterChain
|
||||
|
||||
/**
|
||||
*
|
||||
*/
|
||||
@EnableWebFluxSecurity
|
||||
@Configuration(proxyBeanMethods = false)
|
||||
internal class DslBeanOrderingConfiguration {
|
||||
// tag::sample[]
|
||||
// All of the Java Modular Configuration is applied first <1>
|
||||
|
||||
@Bean // <5>
|
||||
fun springSecurity(http: ServerHttpSecurity): SecurityWebFilterChain {
|
||||
// @formatter:off
|
||||
return http {
|
||||
authorizeExchange {
|
||||
authorize(anyExchange, authenticated)
|
||||
}
|
||||
}
|
||||
// @formatter:on
|
||||
}
|
||||
|
||||
@Bean
|
||||
@Order(Ordered.LOWEST_PRECEDENCE) // <3>
|
||||
fun userAuthorization(): ServerHttpSecurityDsl.() -> Unit {
|
||||
// @formatter:off
|
||||
return {
|
||||
authorizeExchange {
|
||||
authorize("/users/**", hasRole("USER"))
|
||||
}
|
||||
}
|
||||
// @formatter:on
|
||||
}
|
||||
|
||||
@Bean
|
||||
@Order(Ordered.HIGHEST_PRECEDENCE) // <2>
|
||||
fun adminAuthorization(): ServerHttpSecurityDsl.() -> Unit {
|
||||
// @formatter:off
|
||||
return {
|
||||
authorizeExchange {
|
||||
authorize("/admins/**", hasRole("ADMIN"))
|
||||
}
|
||||
}
|
||||
// @formatter:on
|
||||
}
|
||||
|
||||
// <4>
|
||||
|
||||
@Bean
|
||||
fun contentSecurityPolicy(): ServerHeadersDsl.() -> Unit {
|
||||
// @formatter:off
|
||||
return {
|
||||
contentSecurityPolicy {
|
||||
policyDirectives = "object-src 'none'"
|
||||
}
|
||||
}
|
||||
// @formatter:on
|
||||
}
|
||||
|
||||
@Bean
|
||||
fun contentTypeOptions(): ServerHeadersDsl.() -> Unit {
|
||||
// @formatter:off
|
||||
return {
|
||||
contentTypeOptions { }
|
||||
}
|
||||
// @formatter:on
|
||||
}
|
||||
|
||||
@Bean
|
||||
fun httpsRedirect(): ServerHttpsRedirectDsl.() -> Unit {
|
||||
// @formatter:off
|
||||
return { }
|
||||
// @formatter:on
|
||||
}
|
||||
// end::sample[]
|
||||
}
|
||||
+72
@@ -0,0 +1,72 @@
|
||||
/*
|
||||
* Copyright 2004-present the original author or authors.
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* https://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
package org.springframework.security.kt.docs.reactive.configuration.dslbeanordering
|
||||
|
||||
import org.junit.jupiter.api.Test
|
||||
import org.junit.jupiter.api.extension.ExtendWith
|
||||
import org.springframework.beans.factory.annotation.Autowired
|
||||
import org.springframework.security.config.test.SpringTestContext
|
||||
import org.springframework.security.config.test.SpringTestContextExtension
|
||||
import org.springframework.security.kt.docs.servlet.configuration.customizerbeanordering.CustomizerBeanOrderingConfiguration
|
||||
import org.springframework.security.test.web.reactive.server.SecurityMockServerConfigurers.mockUser
|
||||
import org.springframework.security.test.web.servlet.request.SecurityMockMvcRequestPostProcessors.user
|
||||
import org.springframework.test.web.reactive.server.WebTestClient
|
||||
import org.springframework.test.web.servlet.MockMvc
|
||||
import org.springframework.test.web.servlet.get
|
||||
|
||||
/**
|
||||
*
|
||||
*/
|
||||
@ExtendWith(SpringTestContextExtension::class)
|
||||
class DslBeanOrderingTests {
|
||||
@JvmField
|
||||
val spring = SpringTestContext(this).mockMvcAfterSpringSecurityOk()
|
||||
|
||||
@Autowired
|
||||
lateinit var webTest: WebTestClient
|
||||
|
||||
@Test
|
||||
fun dslOrdered() {
|
||||
this.spring.register(org.springframework.security.kt.docs.reactive.configuration.customizerbeanordering.CustomizerBeanOrderingConfiguration::class.java).autowire()
|
||||
// @formatter:off
|
||||
this.webTest.mutateWith(mockUser("admin").roles("ADMIN"))
|
||||
.get()
|
||||
.uri("https://localhost/admins/1")
|
||||
.exchange()
|
||||
.expectStatus().isOk
|
||||
this.webTest.mutateWith(mockUser("user").roles("USER"))
|
||||
.get()
|
||||
.uri("https://localhost/admins/1")
|
||||
.exchange()
|
||||
.expectStatus().isForbidden
|
||||
this.webTest.mutateWith(mockUser("user").roles("USER"))
|
||||
.get()
|
||||
.uri("https://localhost/users/1")
|
||||
.exchange()
|
||||
.expectStatus().isOk
|
||||
this.webTest.mutateWith(mockUser("user").roles("OTHER"))
|
||||
.get()
|
||||
.uri("https://localhost/users/1")
|
||||
.exchange()
|
||||
.expectStatus().isForbidden
|
||||
this.webTest.mutateWith(mockUser("other").roles("OTHER"))
|
||||
.get()
|
||||
.uri("https://localhost/other")
|
||||
.exchange()
|
||||
.expectStatus().isOk
|
||||
// @formatter:on
|
||||
}
|
||||
}
|
||||
+44
@@ -0,0 +1,44 @@
|
||||
package org.springframework.security.kt.docs.reactive.configuration.serverhttpsecuritycustomizerbean
|
||||
|
||||
import org.springframework.context.annotation.Bean
|
||||
import org.springframework.context.annotation.Configuration
|
||||
import org.springframework.security.config.Customizer
|
||||
import org.springframework.security.config.annotation.web.reactive.EnableWebFluxSecurity
|
||||
import org.springframework.security.config.web.server.ServerHttpSecurity
|
||||
import org.springframework.security.web.server.SecurityWebFilterChain
|
||||
|
||||
@EnableWebFluxSecurity
|
||||
@Configuration(proxyBeanMethods = false)
|
||||
class ServerHttpSecurityCustomizerBeanConfiguration {
|
||||
|
||||
@Bean
|
||||
fun springSecurity(http: ServerHttpSecurity): SecurityWebFilterChain {
|
||||
// @formatter:off
|
||||
http
|
||||
.authorizeExchange({ exchanges -> exchanges
|
||||
.anyExchange().authenticated()
|
||||
})
|
||||
return http.build()
|
||||
// @formatter:on
|
||||
}
|
||||
|
||||
|
||||
// tag::httpSecurityCustomizer[]
|
||||
@Bean
|
||||
fun httpSecurityCustomizer(): Customizer<ServerHttpSecurity> {
|
||||
// @formatter:off
|
||||
return Customizer { http -> http
|
||||
.headers { headers -> headers
|
||||
.contentSecurityPolicy { csp -> csp
|
||||
// <1>
|
||||
.policyDirectives("object-src 'none'")
|
||||
}
|
||||
}
|
||||
// <2>
|
||||
.redirectToHttps(Customizer.withDefaults())
|
||||
}
|
||||
// @formatter:on
|
||||
}
|
||||
// end::httpSecurityCustomizer[]
|
||||
|
||||
}
|
||||
+37
@@ -0,0 +1,37 @@
|
||||
package org.springframework.security.kt.docs.reactive.configuration.serverhttpsecuritycustomizerbean
|
||||
|
||||
import org.assertj.core.api.Assertions
|
||||
import org.assertj.core.api.Assertions.assertThat
|
||||
import org.junit.jupiter.api.Test
|
||||
import org.junit.jupiter.api.extension.ExtendWith
|
||||
import org.springframework.beans.factory.annotation.Autowired
|
||||
import org.springframework.security.config.test.SpringTestContext
|
||||
import org.springframework.security.config.test.SpringTestContextExtension
|
||||
import org.springframework.test.web.reactive.server.WebTestClient
|
||||
import java.util.function.Consumer
|
||||
|
||||
@ExtendWith(SpringTestContextExtension::class)
|
||||
class ServerHttpSecurityCustomizerBeanTests {
|
||||
@JvmField
|
||||
val spring = SpringTestContext(this)
|
||||
|
||||
@Autowired
|
||||
lateinit var webTest: WebTestClient
|
||||
|
||||
@Test
|
||||
fun `serverhttpsecurity customizer config`() {
|
||||
this.spring.register(ServerHttpSecurityCustomizerBeanConfiguration::class.java).autowire()
|
||||
// @formatter:off
|
||||
this.webTest
|
||||
.get()
|
||||
.uri("http://localhost/")
|
||||
.exchange()
|
||||
.expectHeader().location("https://localhost/")
|
||||
.expectHeader()
|
||||
.value("Content-Security-Policy", Consumer { csp ->
|
||||
assertThat(csp).isEqualTo("object-src 'none'")
|
||||
})
|
||||
// @formatter:on
|
||||
}
|
||||
|
||||
}
|
||||
+42
@@ -0,0 +1,42 @@
|
||||
package org.springframework.security.kt.docs.reactive.configuration.serverhttpsecuritydslbean
|
||||
|
||||
import org.springframework.context.annotation.Bean
|
||||
import org.springframework.context.annotation.Configuration
|
||||
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity
|
||||
import org.springframework.security.config.annotation.web.reactive.EnableWebFluxSecurity
|
||||
import org.springframework.security.config.web.server.ServerHttpSecurity
|
||||
import org.springframework.security.config.web.server.ServerHttpSecurityDsl
|
||||
import org.springframework.security.config.web.server.invoke
|
||||
import org.springframework.security.web.server.SecurityWebFilterChain
|
||||
import org.springframework.web.servlet.config.annotation.EnableWebMvc
|
||||
|
||||
@EnableWebFluxSecurity
|
||||
@Configuration(proxyBeanMethods = false)
|
||||
class ServerHttpSecurityDslBeanConfiguration {
|
||||
|
||||
@Bean
|
||||
fun springSecurity(http: ServerHttpSecurity): SecurityWebFilterChain {
|
||||
return http {
|
||||
authorizeExchange {
|
||||
authorize(anyExchange, authenticated)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// tag::httpSecurityDslBean[]
|
||||
@Bean
|
||||
fun httpSecurityDslBean(): ServerHttpSecurityDsl.() -> Unit {
|
||||
return {
|
||||
headers {
|
||||
contentSecurityPolicy {
|
||||
// <1>
|
||||
policyDirectives = "object-src 'none'"
|
||||
}
|
||||
}
|
||||
// <2>
|
||||
redirectToHttps { }
|
||||
}
|
||||
}
|
||||
// end::httpSecurityDslBean[]
|
||||
|
||||
}
|
||||
+38
@@ -0,0 +1,38 @@
|
||||
package org.springframework.security.kt.docs.reactive.configuration.serverhttpsecuritydslbean
|
||||
|
||||
import org.assertj.core.api.Assertions.assertThat
|
||||
import org.junit.jupiter.api.Test
|
||||
import org.junit.jupiter.api.extension.ExtendWith
|
||||
import org.springframework.beans.factory.annotation.Autowired
|
||||
import org.springframework.security.config.test.SpringTestContext
|
||||
import org.springframework.security.config.test.SpringTestContextExtension
|
||||
import org.springframework.test.web.reactive.server.WebTestClient
|
||||
import org.springframework.test.web.servlet.MockMvc
|
||||
import org.springframework.test.web.servlet.get
|
||||
import java.util.function.Consumer
|
||||
|
||||
|
||||
@ExtendWith(SpringTestContextExtension::class)
|
||||
class ServerHttpSecurityDslBeanTests {
|
||||
@JvmField
|
||||
val spring = SpringTestContext(this)
|
||||
|
||||
@Autowired
|
||||
lateinit var webTest: WebTestClient
|
||||
|
||||
@Test
|
||||
fun `ServerHttpSecurityDslBean`() {
|
||||
this.spring.register(ServerHttpSecurityDslBeanConfiguration::class.java).autowire()
|
||||
|
||||
// @formatter:off
|
||||
this.webTest
|
||||
.get()
|
||||
.uri("http://localhost/")
|
||||
.exchange()
|
||||
.expectHeader().location("https://localhost/")
|
||||
.expectHeader().value("Content-Security-Policy", Consumer { csp ->
|
||||
assertThat(csp).isEqualTo("object-src 'none'")
|
||||
})
|
||||
// @formatter:on
|
||||
}
|
||||
}
|
||||
+43
@@ -0,0 +1,43 @@
|
||||
package org.springframework.security.kt.docs.reactive.configuration.toplevelcustomizerbean
|
||||
|
||||
import org.springframework.context.annotation.Bean
|
||||
import org.springframework.context.annotation.Configuration
|
||||
import org.springframework.security.config.Customizer
|
||||
import org.springframework.security.config.annotation.web.builders.HttpSecurity
|
||||
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity
|
||||
import org.springframework.security.config.annotation.web.configurers.HeadersConfigurer
|
||||
import org.springframework.security.config.annotation.web.reactive.EnableWebFluxSecurity
|
||||
import org.springframework.security.config.web.server.ServerHttpSecurity
|
||||
import org.springframework.security.web.SecurityFilterChain
|
||||
import org.springframework.security.web.server.SecurityWebFilterChain
|
||||
|
||||
@EnableWebFluxSecurity
|
||||
@Configuration(proxyBeanMethods = false)
|
||||
class TopLevelCustomizerBeanConfiguration {
|
||||
|
||||
@Bean
|
||||
fun springSecurity(http: ServerHttpSecurity): SecurityWebFilterChain {
|
||||
// @formatter:off
|
||||
http
|
||||
.authorizeExchange({ exchanges -> exchanges
|
||||
.anyExchange().authenticated()
|
||||
})
|
||||
return http.build()
|
||||
// @formatter:on
|
||||
}
|
||||
|
||||
// tag::headersCustomizer[]
|
||||
@Bean
|
||||
fun headersSecurity(): Customizer<ServerHttpSecurity.HeaderSpec> {
|
||||
// @formatter:off
|
||||
return Customizer { headers -> headers
|
||||
.contentSecurityPolicy { csp -> csp
|
||||
// <1>
|
||||
.policyDirectives("object-src 'none'")
|
||||
}
|
||||
}
|
||||
// @formatter:on
|
||||
}
|
||||
// end::headersCustomizer[]
|
||||
|
||||
}
|
||||
+35
@@ -0,0 +1,35 @@
|
||||
package org.springframework.security.kt.docs.reactive.configuration.toplevelcustomizerbean
|
||||
|
||||
import org.assertj.core.api.Assertions.assertThat
|
||||
import org.junit.jupiter.api.Test
|
||||
import org.junit.jupiter.api.extension.ExtendWith
|
||||
import org.springframework.beans.factory.annotation.Autowired
|
||||
import org.springframework.security.config.test.SpringTestContext
|
||||
import org.springframework.security.config.test.SpringTestContextExtension
|
||||
import org.springframework.test.web.reactive.server.WebTestClient
|
||||
import java.util.function.Consumer
|
||||
|
||||
@ExtendWith(SpringTestContextExtension::class)
|
||||
class TopLevelCustomizerBeanTests {
|
||||
@JvmField
|
||||
val spring = SpringTestContext(this)
|
||||
|
||||
@Autowired
|
||||
lateinit var webTest: WebTestClient
|
||||
|
||||
@Test
|
||||
fun `top level dsl bean`() {
|
||||
this.spring.register(TopLevelCustomizerBeanConfiguration::class.java).autowire()
|
||||
|
||||
// @formatter:off
|
||||
this.webTest
|
||||
.get()
|
||||
.uri("http://localhost/")
|
||||
.exchange()
|
||||
.expectHeader().value("Content-Security-Policy", Consumer { csp ->
|
||||
assertThat(csp).isEqualTo("object-src 'none'")
|
||||
})
|
||||
// @formatter:on
|
||||
}
|
||||
|
||||
}
|
||||
+36
@@ -0,0 +1,36 @@
|
||||
package org.springframework.security.kt.docs.reactive.configuration.topleveldslbean
|
||||
|
||||
import org.springframework.context.annotation.Bean
|
||||
import org.springframework.context.annotation.Configuration
|
||||
import org.springframework.security.config.annotation.web.reactive.EnableWebFluxSecurity
|
||||
import org.springframework.security.config.web.server.ServerHeadersDsl
|
||||
import org.springframework.security.config.web.server.ServerHttpSecurity
|
||||
import org.springframework.security.config.web.server.invoke
|
||||
import org.springframework.security.web.server.SecurityWebFilterChain
|
||||
|
||||
|
||||
@EnableWebFluxSecurity
|
||||
@Configuration(proxyBeanMethods = false)
|
||||
class TopLevelDslBeanConfiguration {
|
||||
|
||||
@Bean
|
||||
fun springSecurity(http: ServerHttpSecurity): SecurityWebFilterChain {
|
||||
return http {
|
||||
authorizeExchange {
|
||||
authorize(anyExchange, authenticated)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// tag::headersSecurity[]
|
||||
@Bean
|
||||
fun headersSecurity(): ServerHeadersDsl.() -> Unit {
|
||||
return {
|
||||
contentSecurityPolicy {
|
||||
// <1>
|
||||
policyDirectives = "object-src 'none'"
|
||||
}
|
||||
}
|
||||
}
|
||||
// end::headersSecurity[]
|
||||
}
|
||||
+37
@@ -0,0 +1,37 @@
|
||||
package org.springframework.security.kt.docs.reactive.configuration.topleveldslbean
|
||||
|
||||
import org.assertj.core.api.Assertions.assertThat
|
||||
import org.junit.jupiter.api.Test
|
||||
import org.junit.jupiter.api.extension.ExtendWith
|
||||
import org.springframework.beans.factory.annotation.Autowired
|
||||
import org.springframework.security.config.test.SpringTestContext
|
||||
import org.springframework.security.config.test.SpringTestContextExtension
|
||||
import org.springframework.test.web.reactive.server.WebTestClient
|
||||
import org.springframework.test.web.servlet.MockMvc
|
||||
import org.springframework.test.web.servlet.get
|
||||
import java.util.function.Consumer
|
||||
|
||||
|
||||
@ExtendWith(SpringTestContextExtension::class)
|
||||
class TopLevelDslBeanTests {
|
||||
@JvmField
|
||||
val spring = SpringTestContext(this)
|
||||
|
||||
@Autowired
|
||||
lateinit var webTest: WebTestClient
|
||||
|
||||
@Test
|
||||
fun `HttpSecurityDslBean`() {
|
||||
this.spring.register(TopLevelDslBeanConfiguration::class.java).autowire()
|
||||
|
||||
// @formatter:off
|
||||
this.webTest
|
||||
.get()
|
||||
.uri("http://localhost/")
|
||||
.exchange()
|
||||
.expectHeader().value("Content-Security-Policy", Consumer { csp ->
|
||||
assertThat(csp).isEqualTo("object-src 'none'")
|
||||
})
|
||||
// @formatter:on
|
||||
}
|
||||
}
|
||||
+104
@@ -0,0 +1,104 @@
|
||||
/*
|
||||
* Copyright 2004-present the original author or authors.
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* https://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
package org.springframework.security.kt.docs.servlet.configuration.customizerbeanordering
|
||||
|
||||
import org.springframework.context.annotation.Bean
|
||||
import org.springframework.context.annotation.Configuration
|
||||
import org.springframework.core.Ordered
|
||||
import org.springframework.core.annotation.Order
|
||||
import org.springframework.security.config.Customizer
|
||||
import org.springframework.security.config.ThrowingCustomizer
|
||||
import org.springframework.security.config.annotation.web.builders.HttpSecurity
|
||||
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity
|
||||
import org.springframework.security.config.annotation.web.configurers.AuthorizeHttpRequestsConfigurer.AuthorizationManagerRequestMatcherRegistry
|
||||
import org.springframework.security.config.annotation.web.configurers.HeadersConfigurer
|
||||
import org.springframework.security.config.annotation.web.configurers.HttpsRedirectConfigurer
|
||||
import org.springframework.security.web.SecurityFilterChain
|
||||
import org.springframework.web.servlet.config.annotation.EnableWebMvc
|
||||
|
||||
/**
|
||||
*
|
||||
*/
|
||||
@EnableWebMvc
|
||||
@EnableWebSecurity
|
||||
@Configuration(proxyBeanMethods = false)
|
||||
internal class CustomizerBeanOrderingConfiguration {
|
||||
// tag::sample[]
|
||||
@Bean // <4>
|
||||
fun springSecurity(http: HttpSecurity): SecurityFilterChain {
|
||||
// @formatter:off
|
||||
http
|
||||
.authorizeHttpRequests({ requests -> requests
|
||||
.anyRequest().authenticated()
|
||||
})
|
||||
return http.build()
|
||||
// @formatter:on
|
||||
}
|
||||
|
||||
@Bean
|
||||
@Order(Ordered.LOWEST_PRECEDENCE) // <2>
|
||||
fun userAuthorization(): ThrowingCustomizer<HttpSecurity> {
|
||||
// @formatter:off
|
||||
return ThrowingCustomizer { http -> http
|
||||
.authorizeHttpRequests { requests -> requests
|
||||
.requestMatchers("/users/**").hasRole("USER")
|
||||
}
|
||||
}
|
||||
// @formatter:on
|
||||
}
|
||||
|
||||
@Bean
|
||||
@Order(Ordered.HIGHEST_PRECEDENCE) // <1>
|
||||
fun adminAuthorization(): ThrowingCustomizer<HttpSecurity> {
|
||||
// @formatter:off
|
||||
return ThrowingCustomizer { http -> http
|
||||
.authorizeHttpRequests { requests -> requests
|
||||
.requestMatchers("/admins/**").hasRole("ADMIN")
|
||||
}
|
||||
}
|
||||
// @formatter:on
|
||||
}
|
||||
|
||||
// <3>
|
||||
|
||||
@Bean
|
||||
fun contentSecurityPolicy(): Customizer<HeadersConfigurer<HttpSecurity>> {
|
||||
// @formatter:off
|
||||
return Customizer { headers -> headers
|
||||
.contentSecurityPolicy { csp -> csp
|
||||
.policyDirectives("object-src 'none'")
|
||||
}
|
||||
}
|
||||
// @formatter:on
|
||||
}
|
||||
|
||||
@Bean
|
||||
fun contentTypeOptions(): Customizer<HeadersConfigurer<HttpSecurity>> {
|
||||
// @formatter:off
|
||||
return Customizer { headers -> headers
|
||||
.contentTypeOptions(Customizer.withDefaults())
|
||||
}
|
||||
// @formatter:on
|
||||
}
|
||||
|
||||
@Bean
|
||||
fun httpsRedirect(): Customizer<HttpsRedirectConfigurer<HttpSecurity>> {
|
||||
// @formatter:off
|
||||
return Customizer.withDefaults<HttpsRedirectConfigurer<HttpSecurity>>()
|
||||
// @formatter:on
|
||||
}
|
||||
// end::sample[]
|
||||
}
|
||||
+72
@@ -0,0 +1,72 @@
|
||||
/*
|
||||
* Copyright 2004-present the original author or authors.
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* https://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
package org.springframework.security.kt.docs.servlet.configuration.customizerbeanordering
|
||||
|
||||
import org.junit.jupiter.api.Test
|
||||
import org.junit.jupiter.api.extension.ExtendWith
|
||||
import org.springframework.beans.factory.annotation.Autowired
|
||||
import org.springframework.security.config.test.SpringTestContext
|
||||
import org.springframework.security.config.test.SpringTestContextExtension
|
||||
import org.springframework.security.test.web.servlet.request.SecurityMockMvcRequestPostProcessors
|
||||
import org.springframework.security.test.web.servlet.request.SecurityMockMvcRequestPostProcessors.user
|
||||
import org.springframework.test.web.servlet.MockMvc
|
||||
import org.springframework.test.web.servlet.get
|
||||
import org.springframework.test.web.servlet.request.MockMvcRequestBuilders
|
||||
import org.springframework.test.web.servlet.result.MockMvcResultMatchers
|
||||
|
||||
/**
|
||||
*
|
||||
*/
|
||||
@ExtendWith(SpringTestContextExtension::class)
|
||||
class CustomizerBeanOrderingTests {
|
||||
@JvmField
|
||||
val spring = SpringTestContext(this).mockMvcAfterSpringSecurityOk()
|
||||
|
||||
@Autowired
|
||||
lateinit var mockMvc: MockMvc
|
||||
|
||||
@Test
|
||||
fun authorizationOrdered() {
|
||||
this.spring.register(CustomizerBeanOrderingConfiguration::class.java).autowire()
|
||||
// @formatter:off
|
||||
this.mockMvc.get("https://localhost/admins/1") {
|
||||
with(user("admin").roles("ADMIN"))
|
||||
}.andExpect {
|
||||
status { isOk() }
|
||||
}
|
||||
this.mockMvc.get("https://localhost/admins/1") {
|
||||
with(user("user").roles("USER"))
|
||||
}.andExpect {
|
||||
status { isForbidden() }
|
||||
}
|
||||
this.mockMvc.get("https://localhost/users/1") {
|
||||
with(user("user").roles("USER"))
|
||||
}.andExpect {
|
||||
status { isOk() }
|
||||
}
|
||||
this.mockMvc.get("https://localhost/users/1") {
|
||||
with(user("noUserRole").roles("OTHER"))
|
||||
}.andExpect {
|
||||
status { isForbidden() }
|
||||
}
|
||||
this.mockMvc.get("https://localhost/other") {
|
||||
with(user("authenticated").roles("OTHER"))
|
||||
}.andExpect {
|
||||
status { isOk() }
|
||||
}
|
||||
// @formatter:on
|
||||
}
|
||||
}
|
||||
+110
@@ -0,0 +1,110 @@
|
||||
/*
|
||||
* Copyright 2004-present the original author or authors.
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* https://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
package org.springframework.security.kt.docs.servlet.configuration.dslbeanordering
|
||||
|
||||
import org.springframework.context.annotation.Bean
|
||||
import org.springframework.context.annotation.Configuration
|
||||
import org.springframework.core.Ordered
|
||||
import org.springframework.core.annotation.Order
|
||||
import org.springframework.security.config.Customizer
|
||||
import org.springframework.security.config.ThrowingCustomizer
|
||||
import org.springframework.security.config.annotation.web.HeadersDsl
|
||||
import org.springframework.security.config.annotation.web.HttpSecurityDsl
|
||||
import org.springframework.security.config.annotation.web.HttpsRedirectDsl
|
||||
import org.springframework.security.config.annotation.web.builders.HttpSecurity
|
||||
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity
|
||||
import org.springframework.security.config.annotation.web.configurers.HeadersConfigurer
|
||||
import org.springframework.security.config.annotation.web.configurers.HttpsRedirectConfigurer
|
||||
import org.springframework.security.config.annotation.web.invoke
|
||||
import org.springframework.security.web.SecurityFilterChain
|
||||
import org.springframework.web.servlet.config.annotation.EnableWebMvc
|
||||
|
||||
/**
|
||||
*
|
||||
*/
|
||||
@EnableWebMvc
|
||||
@EnableWebSecurity
|
||||
@Configuration(proxyBeanMethods = false)
|
||||
internal class DslBeanOrderingConfiguration {
|
||||
// tag::sample[]
|
||||
// All of the Java Modular Configuration is applied first <1>
|
||||
|
||||
@Bean // <5>
|
||||
fun springSecurity(http: HttpSecurity): SecurityFilterChain {
|
||||
// @formatter:off
|
||||
http {
|
||||
authorizeHttpRequests {
|
||||
authorize(anyRequest, authenticated)
|
||||
}
|
||||
}
|
||||
return http.build()
|
||||
// @formatter:on
|
||||
}
|
||||
|
||||
@Bean
|
||||
@Order(Ordered.LOWEST_PRECEDENCE) // <3>
|
||||
fun userAuthorization(): HttpSecurityDsl.() -> Unit {
|
||||
// @formatter:off
|
||||
return {
|
||||
authorizeHttpRequests {
|
||||
authorize("/users/**", hasRole("USER"))
|
||||
}
|
||||
}
|
||||
// @formatter:on
|
||||
}
|
||||
|
||||
@Bean
|
||||
@Order(Ordered.HIGHEST_PRECEDENCE) // <2>
|
||||
fun adminAuthorization(): HttpSecurityDsl.() -> Unit {
|
||||
// @formatter:off
|
||||
return {
|
||||
authorizeHttpRequests {
|
||||
authorize("/admins/**", hasRole("ADMIN"))
|
||||
}
|
||||
}
|
||||
// @formatter:on
|
||||
}
|
||||
|
||||
// <4>
|
||||
|
||||
@Bean
|
||||
fun contentSecurityPolicy(): HeadersDsl.() -> Unit {
|
||||
// @formatter:off
|
||||
return {
|
||||
contentSecurityPolicy {
|
||||
policyDirectives = "object-src 'none'"
|
||||
}
|
||||
}
|
||||
// @formatter:on
|
||||
}
|
||||
|
||||
@Bean
|
||||
fun contentTypeOptions(): HeadersDsl.() -> Unit {
|
||||
// @formatter:off
|
||||
return {
|
||||
contentTypeOptions { }
|
||||
}
|
||||
// @formatter:on
|
||||
}
|
||||
|
||||
@Bean
|
||||
fun httpsRedirect(): HttpsRedirectDsl.() -> Unit {
|
||||
// @formatter:off
|
||||
return { }
|
||||
// @formatter:on
|
||||
}
|
||||
// end::sample[]
|
||||
}
|
||||
+70
@@ -0,0 +1,70 @@
|
||||
/*
|
||||
* Copyright 2004-present the original author or authors.
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* https://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*/
|
||||
package org.springframework.security.kt.docs.servlet.configuration.dslbeanordering
|
||||
|
||||
import org.junit.jupiter.api.Test
|
||||
import org.junit.jupiter.api.extension.ExtendWith
|
||||
import org.springframework.beans.factory.annotation.Autowired
|
||||
import org.springframework.security.config.test.SpringTestContext
|
||||
import org.springframework.security.config.test.SpringTestContextExtension
|
||||
import org.springframework.security.kt.docs.servlet.configuration.customizerbeanordering.CustomizerBeanOrderingConfiguration
|
||||
import org.springframework.security.test.web.servlet.request.SecurityMockMvcRequestPostProcessors.user
|
||||
import org.springframework.test.web.servlet.MockMvc
|
||||
import org.springframework.test.web.servlet.get
|
||||
|
||||
/**
|
||||
*
|
||||
*/
|
||||
@ExtendWith(SpringTestContextExtension::class)
|
||||
class DslBeanOrderingTests {
|
||||
@JvmField
|
||||
val spring = SpringTestContext(this).mockMvcAfterSpringSecurityOk()
|
||||
|
||||
@Autowired
|
||||
lateinit var mockMvc: MockMvc
|
||||
|
||||
@Test
|
||||
fun dslOrdered() {
|
||||
this.spring.register(DslBeanOrderingConfiguration::class.java).autowire()
|
||||
// @formatter:off
|
||||
this.mockMvc.get("https://localhost/admins/1") {
|
||||
with(user("admin").roles("ADMIN"))
|
||||
}.andExpect {
|
||||
status { isOk() }
|
||||
}
|
||||
this.mockMvc.get("https://localhost/admins/1") {
|
||||
with(user("user").roles("USER"))
|
||||
}.andExpect {
|
||||
status { isForbidden() }
|
||||
}
|
||||
this.mockMvc.get("https://localhost/users/1") {
|
||||
with(user("user").roles("USER"))
|
||||
}.andExpect {
|
||||
status { isOk() }
|
||||
}
|
||||
this.mockMvc.get("https://localhost/users/1") {
|
||||
with(user("noUserRole").roles("OTHER"))
|
||||
}.andExpect {
|
||||
status { isForbidden() }
|
||||
}
|
||||
this.mockMvc.get("https://localhost/other") {
|
||||
with(user("authenticated").roles("OTHER"))
|
||||
}.andExpect {
|
||||
status { isOk() }
|
||||
}
|
||||
// @formatter:on
|
||||
}
|
||||
}
|
||||
+46
@@ -0,0 +1,46 @@
|
||||
package org.springframework.security.kt.docs.servlet.configuration.httpsecuritycustomizerbean
|
||||
|
||||
import org.springframework.context.annotation.Bean
|
||||
import org.springframework.context.annotation.Configuration
|
||||
import org.springframework.security.config.Customizer
|
||||
import org.springframework.security.config.ThrowingCustomizer
|
||||
import org.springframework.security.config.annotation.web.builders.HttpSecurity
|
||||
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity
|
||||
import org.springframework.security.config.annotation.web.configurers.HeadersConfigurer
|
||||
import org.springframework.security.config.annotation.web.invoke
|
||||
import org.springframework.security.web.SecurityFilterChain
|
||||
|
||||
@EnableWebSecurity
|
||||
@Configuration(proxyBeanMethods = false)
|
||||
class HttpSecurityCustomizerBeanConfiguration {
|
||||
|
||||
@Bean
|
||||
fun springSecurity(http: HttpSecurity): SecurityFilterChain {
|
||||
http {
|
||||
authorizeHttpRequests {
|
||||
authorize(anyRequest, authenticated)
|
||||
}
|
||||
}
|
||||
return http.build()
|
||||
}
|
||||
|
||||
|
||||
// tag::httpSecurityCustomizer[]
|
||||
@Bean
|
||||
fun httpSecurityCustomizer(): ThrowingCustomizer<HttpSecurity> {
|
||||
// @formatter:off
|
||||
return ThrowingCustomizer { http -> http
|
||||
.headers { headers -> headers
|
||||
.contentSecurityPolicy { csp -> csp
|
||||
// <1>
|
||||
.policyDirectives("object-src 'none'")
|
||||
}
|
||||
}
|
||||
// <2>
|
||||
.redirectToHttps(Customizer.withDefaults())
|
||||
}
|
||||
// @formatter:on
|
||||
}
|
||||
// end::httpSecurityCustomizer[]
|
||||
|
||||
}
|
||||
+35
@@ -0,0 +1,35 @@
|
||||
package org.springframework.security.kt.docs.servlet.configuration.httpsecuritycustomizerbean
|
||||
|
||||
import org.junit.jupiter.api.Test
|
||||
import org.junit.jupiter.api.extension.ExtendWith
|
||||
import org.springframework.beans.factory.annotation.Autowired
|
||||
import org.springframework.security.config.test.SpringTestContext
|
||||
import org.springframework.security.config.test.SpringTestContextExtension
|
||||
import org.springframework.test.web.servlet.MockMvc
|
||||
import org.springframework.test.web.servlet.get
|
||||
|
||||
@ExtendWith(SpringTestContextExtension::class)
|
||||
class HttpSecurityCustomizerBeanTests {
|
||||
@JvmField
|
||||
val spring = SpringTestContext(this)
|
||||
|
||||
@Autowired
|
||||
lateinit var mockMvc: MockMvc
|
||||
|
||||
@Test
|
||||
fun `httpsecurity customizer config`() {
|
||||
this.spring.register(HttpSecurityCustomizerBeanConfiguration::class.java).autowire()
|
||||
|
||||
this.mockMvc.get("/")
|
||||
.andExpect {
|
||||
redirectedUrl("https://localhost/")
|
||||
}
|
||||
this.mockMvc.get("https://localhost/")
|
||||
.andExpect {
|
||||
header {
|
||||
string("Content-Security-Policy", "object-src 'none'")
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
}
|
||||
+52
@@ -0,0 +1,52 @@
|
||||
package org.springframework.security.kt.docs.servlet.configuration.httpsecuritydslbean
|
||||
|
||||
import org.junit.jupiter.api.Test
|
||||
import org.junit.jupiter.api.extension.ExtendWith
|
||||
import org.springframework.beans.factory.annotation.Autowired
|
||||
import org.springframework.context.annotation.Bean
|
||||
import org.springframework.context.annotation.Configuration
|
||||
import org.springframework.security.config.annotation.web.HeadersDsl
|
||||
import org.springframework.security.config.annotation.web.HttpSecurityDsl
|
||||
import org.springframework.security.config.annotation.web.builders.HttpSecurity
|
||||
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity
|
||||
import org.springframework.security.config.annotation.web.invoke
|
||||
import org.springframework.security.config.test.SpringTestContext
|
||||
import org.springframework.security.config.test.SpringTestContextExtension
|
||||
import org.springframework.security.web.SecurityFilterChain
|
||||
import org.springframework.test.web.servlet.MockMvc
|
||||
import org.springframework.test.web.servlet.get
|
||||
import org.springframework.web.servlet.config.annotation.EnableWebMvc
|
||||
|
||||
|
||||
@EnableWebMvc
|
||||
@EnableWebSecurity
|
||||
@Configuration(proxyBeanMethods = false)
|
||||
class HttpSecurityDslBeanConfiguration {
|
||||
|
||||
@Bean
|
||||
fun springSecurity(http: HttpSecurity): SecurityFilterChain {
|
||||
http {
|
||||
authorizeHttpRequests {
|
||||
authorize(anyRequest, authenticated)
|
||||
}
|
||||
}
|
||||
return http.build()
|
||||
}
|
||||
|
||||
// tag::httpSecurityDslBean[]
|
||||
@Bean
|
||||
fun httpSecurityDslBean(): HttpSecurityDsl.() -> Unit {
|
||||
return {
|
||||
headers {
|
||||
contentSecurityPolicy {
|
||||
// <1>
|
||||
policyDirectives = "object-src 'none'"
|
||||
}
|
||||
}
|
||||
// <2>
|
||||
redirectToHttps { }
|
||||
}
|
||||
}
|
||||
// end::httpSecurityDslBean[]
|
||||
|
||||
}
|
||||
+36
@@ -0,0 +1,36 @@
|
||||
package org.springframework.security.kt.docs.servlet.configuration.httpsecuritydslbean
|
||||
|
||||
import org.junit.jupiter.api.Test
|
||||
import org.junit.jupiter.api.extension.ExtendWith
|
||||
import org.springframework.beans.factory.annotation.Autowired
|
||||
import org.springframework.security.config.test.SpringTestContext
|
||||
import org.springframework.security.config.test.SpringTestContextExtension
|
||||
import org.springframework.test.web.servlet.MockMvc
|
||||
import org.springframework.test.web.servlet.get
|
||||
|
||||
|
||||
@ExtendWith(SpringTestContextExtension::class)
|
||||
class HttpSecurityDslBeanTests {
|
||||
@JvmField
|
||||
val spring = SpringTestContext(this)
|
||||
|
||||
@Autowired
|
||||
lateinit var mockMvc: MockMvc
|
||||
|
||||
@Test
|
||||
fun `HttpSecurityDslBean`() {
|
||||
this.spring.register(HttpSecurityDslBeanConfiguration::class.java).autowire()
|
||||
|
||||
this.mockMvc.get("/")
|
||||
.andExpect {
|
||||
redirectedUrl("https://localhost/")
|
||||
}
|
||||
|
||||
this.mockMvc.get("https://localhost/")
|
||||
.andExpect {
|
||||
header {
|
||||
string("Content-Security-Policy", "object-src 'none'")
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
+42
@@ -0,0 +1,42 @@
|
||||
package org.springframework.security.kt.docs.servlet.configuration.toplevelcustomizerbean
|
||||
|
||||
import org.springframework.context.annotation.Bean
|
||||
import org.springframework.context.annotation.Configuration
|
||||
import org.springframework.security.config.Customizer
|
||||
import org.springframework.security.config.annotation.web.builders.HttpSecurity
|
||||
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity
|
||||
import org.springframework.security.config.annotation.web.configurers.HeadersConfigurer
|
||||
import org.springframework.security.config.annotation.web.invoke
|
||||
import org.springframework.security.web.SecurityFilterChain
|
||||
|
||||
@EnableWebSecurity
|
||||
@Configuration(proxyBeanMethods = false)
|
||||
class TopLevelCustomizerBeanConfiguration {
|
||||
|
||||
@Bean
|
||||
fun springSecurity(http: HttpSecurity): SecurityFilterChain {
|
||||
// @formatter:off
|
||||
http {
|
||||
authorizeHttpRequests {
|
||||
authorize(anyRequest, authenticated)
|
||||
}
|
||||
}
|
||||
return http.build()
|
||||
// @formatter:on
|
||||
}
|
||||
|
||||
// tag::headersCustomizer[]
|
||||
@Bean
|
||||
fun headersSecurity(): Customizer<HeadersConfigurer<HttpSecurity>> {
|
||||
// @formatter:off
|
||||
return Customizer { headers -> headers
|
||||
.contentSecurityPolicy { csp -> csp
|
||||
// <1>
|
||||
.policyDirectives("object-src 'none'")
|
||||
}
|
||||
}
|
||||
// @formatter:on
|
||||
}
|
||||
// end::headersCustomizer[]
|
||||
|
||||
}
|
||||
+31
@@ -0,0 +1,31 @@
|
||||
package org.springframework.security.kt.docs.servlet.configuration.toplevelcustomizerbean
|
||||
|
||||
import org.junit.jupiter.api.Test
|
||||
import org.junit.jupiter.api.extension.ExtendWith
|
||||
import org.springframework.beans.factory.annotation.Autowired
|
||||
import org.springframework.security.config.test.SpringTestContext
|
||||
import org.springframework.security.config.test.SpringTestContextExtension
|
||||
import org.springframework.test.web.servlet.MockMvc
|
||||
import org.springframework.test.web.servlet.get
|
||||
|
||||
@ExtendWith(SpringTestContextExtension::class)
|
||||
class TopLevelCustomizerBeanTests {
|
||||
@JvmField
|
||||
val spring = SpringTestContext(this)
|
||||
|
||||
@Autowired
|
||||
lateinit var mockMvc: MockMvc
|
||||
|
||||
@Test
|
||||
fun `top level dsl bean`() {
|
||||
this.spring.register(TopLevelCustomizerBeanConfiguration::class.java).autowire()
|
||||
|
||||
this.mockMvc.get("/")
|
||||
.andExpect {
|
||||
header {
|
||||
string("Content-Security-Policy", "object-src 'none'")
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
}
|
||||
+40
@@ -0,0 +1,40 @@
|
||||
package org.springframework.security.kt.docs.servlet.configuration.topleveldslbean
|
||||
|
||||
import org.springframework.context.annotation.Bean
|
||||
import org.springframework.context.annotation.Configuration
|
||||
import org.springframework.security.config.annotation.web.HeadersDsl
|
||||
import org.springframework.security.config.annotation.web.HttpSecurityDsl
|
||||
import org.springframework.security.config.annotation.web.builders.HttpSecurity
|
||||
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity
|
||||
import org.springframework.security.config.annotation.web.invoke
|
||||
import org.springframework.security.web.SecurityFilterChain
|
||||
import org.springframework.web.servlet.config.annotation.EnableWebMvc
|
||||
|
||||
|
||||
@EnableWebMvc
|
||||
@EnableWebSecurity
|
||||
@Configuration(proxyBeanMethods = false)
|
||||
class TopLevelDslBeanConfiguration {
|
||||
|
||||
@Bean
|
||||
fun springSecurity(http: HttpSecurity): SecurityFilterChain {
|
||||
http {
|
||||
authorizeHttpRequests {
|
||||
authorize(anyRequest, authenticated)
|
||||
}
|
||||
}
|
||||
return http.build()
|
||||
}
|
||||
|
||||
// tag::headersSecurity[]
|
||||
@Bean
|
||||
fun headersSecurity(): HeadersDsl.() -> Unit {
|
||||
return {
|
||||
contentSecurityPolicy {
|
||||
// <1>
|
||||
policyDirectives = "object-src 'none'"
|
||||
}
|
||||
}
|
||||
}
|
||||
// end::headersSecurity[]
|
||||
}
|
||||
+31
@@ -0,0 +1,31 @@
|
||||
package org.springframework.security.kt.docs.servlet.configuration.topleveldslbean
|
||||
|
||||
import org.junit.jupiter.api.Test
|
||||
import org.junit.jupiter.api.extension.ExtendWith
|
||||
import org.springframework.beans.factory.annotation.Autowired
|
||||
import org.springframework.security.config.test.SpringTestContext
|
||||
import org.springframework.security.config.test.SpringTestContextExtension
|
||||
import org.springframework.test.web.servlet.MockMvc
|
||||
import org.springframework.test.web.servlet.get
|
||||
|
||||
|
||||
@ExtendWith(SpringTestContextExtension::class)
|
||||
class TopLevelDslBeanTests {
|
||||
@JvmField
|
||||
val spring = SpringTestContext(this)
|
||||
|
||||
@Autowired
|
||||
lateinit var mockMvc: MockMvc
|
||||
|
||||
@Test
|
||||
fun `HttpSecurityDslBean`() {
|
||||
this.spring.register(TopLevelDslBeanConfiguration::class.java).autowire()
|
||||
|
||||
this.mockMvc.get("/")
|
||||
.andExpect {
|
||||
header {
|
||||
string("Content-Security-Policy", "object-src 'none'")
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user