From be4b206478c136d24ea1bf8b6f93da0f3d86a6c3 Mon Sep 17 00:00:00 2001
From: tschiman <tschiman@gmail.com>
Date: Wed, 10 May 2017 16:48:38 -0600
Subject: [PATCH] BAEL-797 Updating tests to work with csrf

---
 .../cloud/bootstrap/gateway/LiveTest.java     | 41 ++++++++++++-------
 1 file changed, 27 insertions(+), 14 deletions(-)

diff --git a/spring-cloud/spring-cloud-bootstrap/gateway/src/test/java/com/baeldung/spring/cloud/bootstrap/gateway/LiveTest.java b/spring-cloud/spring-cloud-bootstrap/gateway/src/test/java/com/baeldung/spring/cloud/bootstrap/gateway/LiveTest.java
index 95c3b89501..4c3263b53b 100644
--- a/spring-cloud/spring-cloud-bootstrap/gateway/src/test/java/com/baeldung/spring/cloud/bootstrap/gateway/LiveTest.java
+++ b/spring-cloud/spring-cloud-bootstrap/gateway/src/test/java/com/baeldung/spring/cloud/bootstrap/gateway/LiveTest.java
@@ -42,9 +42,8 @@ public class LiveTest {
 
     @Test
     public void whenAccessProtectedResourceAfterLogin_thenSuccess() {
-        SessionData sessionData = login();
+        SessionData sessionData = login("user", "password");
         final Response response = RestAssured.given()
-            .auth().preemptive().basic("user", "password")
             .header("X-XSRF-TOKEN", sessionData.getCsrf())
             .filter(sessionFilter)
             .get(ROOT_URI + "/rating-service/ratings?bookId=1");
@@ -54,9 +53,8 @@ public class LiveTest {
 
     @Test
     public void whenAccessAdminProtectedResource_thenForbidden() {
-        SessionData sessionData = login();
+        SessionData sessionData = login("user", "password");
         final Response response = RestAssured.given()
-            .auth().preemptive().basic("user", "password")
             .header("X-XSRF-TOKEN", sessionData.getCsrf())
             .filter(sessionFilter)
             .get(ROOT_URI + "/rating-service/ratings");
@@ -66,9 +64,8 @@ public class LiveTest {
 
     @Test
     public void whenAdminAccessProtectedResource_thenSuccess() {
-        SessionData sessionData = login();
+        SessionData sessionData = login("admin", "admin");
         final Response response = RestAssured.given()
-            .auth().preemptive().basic("admin", "admin")
             .header("X-XSRF-TOKEN", sessionData.getCsrf())
             .filter(sessionFilter)
             .get(ROOT_URI + "/rating-service/ratings");
@@ -78,9 +75,8 @@ public class LiveTest {
 
     @Test
     public void whenAdminAccessDiscoveryResource_thenSuccess() {
-        SessionData sessionData = login();
+        SessionData sessionData = login("admin", "admin");
         final Response response = RestAssured.given()
-            .auth().preemptive().basic("admin", "admin")
             .header("X-XSRF-TOKEN", sessionData.getCsrf())
             .filter(sessionFilter)
             .get(ROOT_URI + "/discovery");
@@ -92,11 +88,10 @@ public class LiveTest {
 
         final Rating rating = new Rating(1L, 4);
 
-        SessionData sessionData = login();
+        SessionData sessionData = login("admin", "admin");
 
         // request the protected resource
         final Response ratingResponse = RestAssured.given()
-            .auth().preemptive().basic("admin", "admin")
             .header("X-XSRF-TOKEN", sessionData.getCsrf())
             .filter(sessionFilter)
             .and()
@@ -113,11 +108,10 @@ public class LiveTest {
     public void whenAddnewBook_thenSuccess() {
         final Book book = new Book("Baeldung", "How to spring cloud");
 
-        SessionData sessionData = login();
+        SessionData sessionData = login("admin", "admin");
 
         // request the protected resource
         final Response bookResponse = RestAssured.given()
-            .auth().preemptive().basic("admin", "admin")
             .header("X-XSRF-TOKEN", sessionData.getCsrf())
             .filter(sessionFilter)
             .and()
@@ -210,16 +204,35 @@ public class LiveTest {
         }
     }
 
-    private SessionData login() {
+    private SessionData login(String username, String password) {
         sessionFilter = new SessionFilter();
         Response getLoginResponse = RestAssured.given()
+            .filter(sessionFilter)
+            .when()
+            .get("/login.html")
+            .then()
+            .extract()
+            .response();
+
+        String csrfToken = getLoginResponse.cookie("XSRF-TOKEN");
+
+        RestAssured.given().log().all().
+            filter(sessionFilter)
+            .header("X-XSRF-TOKEN", csrfToken)
+            .param("username", username)
+            .param("password", password)
+            .when()
+            .post("/login");
+
+        Response afterLoginResponse = RestAssured.given()
             .filter(sessionFilter)
             .when()
             .get("/")
             .then()
             .extract()
             .response();
-        return new SessionData(getLoginResponse.cookie("XSRF-TOKEN"), sessionFilter.getSessionId());
+
+        return new SessionData(afterLoginResponse.cookie("XSRF-TOKEN"), sessionFilter.getSessionId());
     }
 
     private class SessionData {