getColour() {
71 | return Optional.ofNullable(colour);
72 | }
73 |
74 | public void setColour(String colour) {
75 | if (colour == null || colour.isBlank())
76 | this.colour = null;
77 | else
78 | this.colour = colour;
79 | }
80 | }
81 |
--------------------------------------------------------------------------------
/src/main/java/com/innoq/cookiebasedsessionapp/WebSecurityConfig.java:
--------------------------------------------------------------------------------
1 | package com.innoq.cookiebasedsessionapp;
2 |
3 | import org.springframework.context.annotation.Configuration;
4 | import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
5 | import org.springframework.security.config.annotation.web.builders.HttpSecurity;
6 | import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
7 | import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
8 | import org.springframework.security.config.http.SessionCreationPolicy;
9 |
10 | @Configuration
11 | @EnableWebSecurity
12 | public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
13 |
14 | static final String LOGIN_FORM_URL = "/login";
15 | static final String TARGET_AFTER_SUCCESSFUL_LOGIN_PARAM = "target";
16 | static final String COLOUR_PARAM = "colour";
17 |
18 | private final CookieSecurityContextRepository cookieSecurityContextRepository;
19 | private final LoginWithTargetUrlAuthenticationEntryPoint loginWithTargetUrlAuthenticationEntryPoint;
20 | private final RedirectToOriginalUrlAuthenticationSuccessHandler redirectToOriginalUrlAuthenticationSuccessHandler;
21 | private final InMemoryAuthenticationProvider inMemoryAuthenticationProvider;
22 |
23 | protected WebSecurityConfig(CookieSecurityContextRepository cookieSecurityContextRepository,
24 | LoginWithTargetUrlAuthenticationEntryPoint loginWithTargetUrlAuthenticationEntryPoint,
25 | RedirectToOriginalUrlAuthenticationSuccessHandler redirectToOriginalUrlAuthenticationSuccessHandler,
26 | InMemoryAuthenticationProvider inMemoryAuthenticationProvider) {
27 | super();
28 | this.cookieSecurityContextRepository = cookieSecurityContextRepository;
29 | this.loginWithTargetUrlAuthenticationEntryPoint = loginWithTargetUrlAuthenticationEntryPoint;
30 | this.redirectToOriginalUrlAuthenticationSuccessHandler = redirectToOriginalUrlAuthenticationSuccessHandler;
31 | this.inMemoryAuthenticationProvider = inMemoryAuthenticationProvider;
32 | }
33 |
34 | @Override
35 | protected void configure(HttpSecurity http) throws Exception {
36 | http
37 | // deactivate session creation
38 | .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS)
39 | .and().csrf().disable()
40 |
41 | // store SecurityContext in Cookie / delete Cookie on logout
42 | .securityContext().securityContextRepository(cookieSecurityContextRepository)
43 | .and().logout().permitAll().deleteCookies(SignedUserInfoCookie.NAME)
44 |
45 | // deactivate RequestCache and append originally requested URL as query parameter to login form request
46 | .and().requestCache().disable()
47 | .exceptionHandling().authenticationEntryPoint(loginWithTargetUrlAuthenticationEntryPoint)
48 |
49 | // configure form-based login
50 | .and().formLogin()
51 | .loginPage(LOGIN_FORM_URL)
52 | // after successful login forward user to originally requested URL
53 | .successHandler(redirectToOriginalUrlAuthenticationSuccessHandler)
54 |
55 | .and().authorizeRequests()
56 | .antMatchers(LOGIN_FORM_URL).permitAll()
57 | .antMatchers("/**").authenticated();
58 | }
59 |
60 | @Override
61 | protected void configure(AuthenticationManagerBuilder auth) throws Exception {
62 | auth.authenticationProvider(inMemoryAuthenticationProvider);
63 | }
64 |
65 | }
66 |
--------------------------------------------------------------------------------
/src/main/resources/application.yml:
--------------------------------------------------------------------------------
1 | auth.cookie.hmac-key: "y.E@EA!FbtCwXYB-2v_n.!*xgzRqgtbq2d2_A_U!W2hubL@URHRzNP96WNPxEcXK"
2 |
--------------------------------------------------------------------------------
/src/main/resources/templates/index.html:
--------------------------------------------------------------------------------
1 |
2 |
5 |
6 |
7 | Home
8 |
9 |
10 | Hello [[${#httpServletRequest.remoteUser}]]
11 |
12 |
15 |
16 | Other
17 |
18 |
19 |
--------------------------------------------------------------------------------
/src/main/resources/templates/login.html:
--------------------------------------------------------------------------------
1 |
2 |
5 |
6 |
7 | Login
8 |
9 |
10 | Login
11 |
12 |
13 | Invalid username and password.
14 |
15 |
16 | You have been logged out.
17 |
18 |
28 |
29 | Home
30 | Other
31 |
32 |
33 |
--------------------------------------------------------------------------------
/src/main/resources/templates/other.html:
--------------------------------------------------------------------------------
1 |
2 |
5 |
6 |
7 | Other
8 |
9 |
10 | Other
11 |
12 |
15 |
16 | Home
17 |
18 |
19 |
--------------------------------------------------------------------------------
/src/test/java/com/innoq/cookiebasedsessionapp/CookieSecurityContextRepositoryTest.java:
--------------------------------------------------------------------------------
1 | package com.innoq.cookiebasedsessionapp;
2 |
3 | import org.junit.jupiter.api.BeforeEach;
4 | import org.junit.jupiter.api.Test;
5 | import org.junit.jupiter.api.extension.ExtendWith;
6 | import org.mockito.ArgumentCaptor;
7 | import org.mockito.Captor;
8 | import org.mockito.Mock;
9 | import org.mockito.junit.jupiter.MockitoExtension;
10 | import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
11 | import org.springframework.security.core.authority.SimpleGrantedAuthority;
12 | import org.springframework.security.core.context.SecurityContext;
13 | import org.springframework.security.web.context.HttpRequestResponseHolder;
14 |
15 | import javax.servlet.http.Cookie;
16 | import javax.servlet.http.HttpServletRequest;
17 | import javax.servlet.http.HttpServletResponse;
18 | import java.util.List;
19 | import java.util.Optional;
20 |
21 | import static org.assertj.core.api.Assertions.assertThat;
22 | import static org.assertj.core.api.Assertions.assertThatThrownBy;
23 | import static org.mockito.Mockito.*;
24 |
25 | @ExtendWith(MockitoExtension.class)
26 | public class CookieSecurityContextRepositoryTest {
27 |
28 | private static final String COOKIE_VALUE = "uid=ab1234&roles=USER|TESTER&colour=YELLOW&hmac=0k9BetqMZOijyq5gaM+2+sqCgDJOpSwHEgkyYwpfIyb5Zcnrsk/BqCWciGBEaYeGWTkMB1CEFJU0So0u8OTUUw==";
29 | private static final String COOKIE_VALUE_WITHOUT_HMAC = "uid=ab1234&roles=USER|TESTER&colour=YELLOW";
30 | private static final String COOKIE_VALUE_WITH_INVALID_HMAC = "uid=ab1234&roles=USER|TESTER&colour=YELLOW&hmac=invalid";
31 |
32 | private static final String USERNAME = "ab1234";
33 | private static final SimpleGrantedAuthority ROLE1 = new SimpleGrantedAuthority("USER");
34 | private static final SimpleGrantedAuthority ROLE2 = new SimpleGrantedAuthority("TESTER");
35 | private static final String COLOUR = "YELLOW";
36 |
37 | private static final String COOKIE_HMAC_KEY = "y.E@EA!FbtCwXYB-2v_n.!*xgzRqgtbq2d2_A_U!W2hubL@URHRzNP96WNPxEcXK";
38 |
39 |
40 | @Mock
41 | private HttpServletRequest request;
42 | @Mock
43 | private HttpServletResponse response;
44 | @Mock
45 | private Cookie userInfoCookie;
46 |
47 | @Mock
48 | private SecurityContext securityContext;
49 | @Mock
50 | private UsernamePasswordAuthenticationToken usernamePasswordAuthentication;
51 | @Mock
52 | private UserInfo userInfo;
53 |
54 | @Captor
55 | private ArgumentCaptor cookieCaptor;
56 |
57 | private HttpRequestResponseHolder requestResponseHolder;
58 |
59 | private final CookieSecurityContextRepository securityContextRepository = new CookieSecurityContextRepository(COOKIE_HMAC_KEY);
60 |
61 | @BeforeEach
62 | public void setupRequestResponseHolder() {
63 | requestResponseHolder = new HttpRequestResponseHolder(request, response);
64 | }
65 |
66 | @BeforeEach
67 | public void setupUserInfoCookie() {
68 | lenient().when(userInfoCookie.getName()).thenReturn(SignedUserInfoCookie.NAME);
69 | lenient().when(userInfoCookie.getValue()).thenReturn(COOKIE_VALUE);
70 | }
71 |
72 | @BeforeEach
73 | public void setupSecurityContext() {
74 | lenient().when(securityContext.getAuthentication()).thenReturn(usernamePasswordAuthentication);
75 | lenient().when(usernamePasswordAuthentication.getPrincipal()).thenReturn(userInfo);
76 | lenient().when(userInfo.getUsername()).thenReturn(USERNAME);
77 | lenient().when(userInfo.getAuthorities()).thenReturn(List.of(ROLE1, ROLE2));
78 | lenient().when(userInfo.getColour()).thenReturn(Optional.of(COLOUR));
79 | }
80 |
81 | @Test
82 | public void loadContext_noCookieInRequest() {
83 | SecurityContext securityContext = securityContextRepository.loadContext(requestResponseHolder);
84 |
85 | assertThat(securityContext).isNotNull();
86 | assertThat(securityContext.getAuthentication()).isNull();
87 | }
88 |
89 | @Test
90 | public void loadContext_cookieCompletelyFilled() {
91 | when(request.getCookies()).thenReturn(new Cookie[]{userInfoCookie});
92 | SecurityContext securityContext = securityContextRepository.loadContext(requestResponseHolder);
93 |
94 | assertThat(securityContext).isNotNull();
95 | assertThat(securityContext.getAuthentication()).isNotNull();
96 | assertThat(securityContext.getAuthentication()).isInstanceOf(UsernamePasswordAuthenticationToken.class);
97 |
98 | UsernamePasswordAuthenticationToken usernamePasswordToken = (UsernamePasswordAuthenticationToken) securityContext.getAuthentication();
99 | assertThat(usernamePasswordToken.isAuthenticated()).isTrue();
100 | assertThat(usernamePasswordToken.getPrincipal()).isInstanceOf(UserInfo.class);
101 |
102 | UserInfo userInfo = (UserInfo) usernamePasswordToken.getPrincipal();
103 | assertThat(userInfo.getUsername()).isEqualTo(USERNAME);
104 | }
105 |
106 | @Test
107 | public void loadContext_cookieWithoutHmac() {
108 | when(userInfoCookie.getValue()).thenReturn(COOKIE_VALUE_WITHOUT_HMAC);
109 | when(request.getCookies()).thenReturn(new Cookie[]{userInfoCookie});
110 |
111 | assertThatThrownBy(() -> securityContextRepository.loadContext(requestResponseHolder))
112 | .isInstanceOf(CookieVerificationFailedException.class);
113 | }
114 |
115 | @Test
116 | public void loadContext_cookieWithInvalidHmac() {
117 | when(userInfoCookie.getValue()).thenReturn(COOKIE_VALUE_WITH_INVALID_HMAC);
118 | when(request.getCookies()).thenReturn(new Cookie[]{userInfoCookie});
119 |
120 | assertThatThrownBy(() -> securityContextRepository.loadContext(requestResponseHolder))
121 | .isInstanceOf(CookieVerificationFailedException.class);
122 | }
123 |
124 | @Test
125 | public void containsContext_noCookieInRequest_returnsFalse() {
126 | assertThat(securityContextRepository.containsContext(request)).isFalse();
127 | }
128 |
129 | @Test
130 | public void containsContext_cookieInRequest_returnsTrue() {
131 | when(request.getCookies()).thenReturn(new Cookie[]{userInfoCookie});
132 | assertThat(securityContextRepository.containsContext(request)).isTrue();
133 | }
134 |
135 | @Test
136 | public void saveContext_completelyFilledUserInfo() {
137 | // loadContext is called first to replace (plain) response with internal wrapper
138 | securityContextRepository.loadContext(requestResponseHolder);
139 |
140 | securityContextRepository.saveContext(securityContext, requestResponseHolder.getRequest(), requestResponseHolder.getResponse());
141 |
142 | verify(response).addCookie(cookieCaptor.capture());
143 | Cookie cookie = cookieCaptor.getValue();
144 | assertThat(cookie.getName()).isEqualTo(SignedUserInfoCookie.NAME);
145 | assertThat(cookie.getValue()).isEqualTo(COOKIE_VALUE);
146 | }
147 |
148 | }
149 |
--------------------------------------------------------------------------------
/src/test/java/com/innoq/cookiebasedsessionapp/LoginWithTargetUrlAuthenticationEntryPointTest.java:
--------------------------------------------------------------------------------
1 | package com.innoq.cookiebasedsessionapp;
2 |
3 | import org.junit.jupiter.api.Test;
4 | import org.junit.jupiter.api.extension.ExtendWith;
5 | import org.mockito.Mock;
6 | import org.mockito.junit.jupiter.MockitoExtension;
7 |
8 | import javax.servlet.http.HttpServletRequest;
9 | import javax.servlet.http.HttpServletResponse;
10 |
11 | import static org.assertj.core.api.Assertions.assertThat;
12 | import static org.mockito.Mockito.when;
13 |
14 | @ExtendWith(MockitoExtension.class)
15 | public class LoginWithTargetUrlAuthenticationEntryPointTest {
16 |
17 | @Mock
18 | private HttpServletRequest request;
19 | @Mock
20 | private HttpServletResponse response;
21 |
22 | private LoginWithTargetUrlAuthenticationEntryPoint entryPoint = new LoginWithTargetUrlAuthenticationEntryPoint();
23 |
24 | @Test
25 | public void appends_targetURL() {
26 | when(request.getRequestURI()).thenReturn("/original/url");
27 |
28 | String url = entryPoint.determineUrlToUseForThisRequest(request, response, null);
29 |
30 | assertThat(url).isEqualTo("/login?target=/original/url");
31 | }
32 |
33 | }
34 |
--------------------------------------------------------------------------------
/src/test/java/com/innoq/cookiebasedsessionapp/RedirectToOriginalUrlAuthenticationSuccessHandlerTest.java:
--------------------------------------------------------------------------------
1 | package com.innoq.cookiebasedsessionapp;
2 |
3 | import org.junit.jupiter.api.Test;
4 | import org.junit.jupiter.api.extension.ExtendWith;
5 | import org.mockito.InjectMocks;
6 | import org.mockito.Mock;
7 | import org.mockito.junit.jupiter.MockitoExtension;
8 | import org.springframework.security.core.Authentication;
9 |
10 | import javax.servlet.ServletException;
11 | import javax.servlet.http.HttpServletRequest;
12 | import javax.servlet.http.HttpServletResponse;
13 | import java.io.IOException;
14 |
15 | import static org.assertj.core.api.Assertions.assertThat;
16 | import static org.mockito.Mockito.verify;
17 | import static org.mockito.Mockito.when;
18 |
19 | @ExtendWith(MockitoExtension.class)
20 | public class RedirectToOriginalUrlAuthenticationSuccessHandlerTest {
21 |
22 | @Mock
23 | private HttpServletRequest request;
24 | @Mock
25 | private HttpServletResponse response;
26 | @Mock
27 | private Authentication authentication;
28 | @Mock
29 | private UserInfo userInfo;
30 |
31 | @InjectMocks
32 | private RedirectToOriginalUrlAuthenticationSuccessHandler handler;
33 |
34 | @Test
35 | public void onAuthenticationSuccess_addsColourToUserInfo() throws IOException, ServletException {
36 | when(authentication.getPrincipal()).thenReturn(userInfo);
37 | when(request.getParameter("colour")).thenReturn("YELLOW");
38 |
39 | handler.onAuthenticationSuccess(request, response, authentication);
40 |
41 | verify(userInfo).setColour("YELLOW");
42 | }
43 |
44 | @Test
45 | public void determineTargetUrl_returnsTargetUrlFromRequest() {
46 | when(request.getParameter(WebSecurityConfig.TARGET_AFTER_SUCCESSFUL_LOGIN_PARAM)).thenReturn("/target");
47 |
48 | var targetUrl = handler.determineTargetUrl(request, response, authentication);
49 |
50 | assertThat(targetUrl).isEqualTo("/target");
51 | }
52 |
53 | @Test
54 | public void determineTargetUrl_suppressAbsolutUrls() {
55 | when(request.getParameter(WebSecurityConfig.TARGET_AFTER_SUCCESSFUL_LOGIN_PARAM)).thenReturn("http://www.google.de");
56 |
57 | var targetUrl = handler.determineTargetUrl(request, response, authentication);
58 |
59 | assertThat(targetUrl).isEqualTo("/");
60 | }
61 |
62 | }
63 |
--------------------------------------------------------------------------------
/src/test/java/com/innoq/cookiebasedsessionapp/SignedUserInfoCookieTest.java:
--------------------------------------------------------------------------------
1 | package com.innoq.cookiebasedsessionapp;
2 |
3 | import org.junit.jupiter.api.BeforeEach;
4 | import org.junit.jupiter.api.Test;
5 | import org.junit.jupiter.api.extension.ExtendWith;
6 | import org.mockito.Mock;
7 | import org.mockito.junit.jupiter.MockitoExtension;
8 | import org.springframework.security.core.authority.SimpleGrantedAuthority;
9 |
10 | import javax.servlet.http.Cookie;
11 | import java.util.List;
12 | import java.util.Optional;
13 |
14 | import static org.assertj.core.api.Assertions.assertThat;
15 | import static org.assertj.core.api.Assertions.assertThatThrownBy;
16 | import static org.mockito.Mockito.lenient;
17 | import static org.mockito.Mockito.when;
18 |
19 | @ExtendWith(MockitoExtension.class)
20 | public class SignedUserInfoCookieTest {
21 |
22 | private static final String COOKIE_VALUE_WITH_HMAC = "uid=ab1234&roles=USER|TESTER&colour=YELLOW&hmac=0k9BetqMZOijyq5gaM+2+sqCgDJOpSwHEgkyYwpfIyb5Zcnrsk/BqCWciGBEaYeGWTkMB1CEFJU0So0u8OTUUw==";
23 | public static final String COOKIE_VALUE_WITHOUT_ROLES = "uid=ab1234&roles=&colour=YELLOW&hmac=w51eeYpz+/lbAOA7KUZC43UeF0nUZZxcKpJFRrh7CyhsR+EE77AaRSJKsq0HxNgbxmuLxsstkV/JiFawwnv47g==";
24 | public static final String COOKIE_VALUE_WITHOUT_COLOUR = "uid=ab1234&roles=USER|TESTER&hmac=wRYQmJZQ3JLnOiuYLV6ETG0kmz0H+7leJvvl1m14Pb5LP/FupJHdrIhzKc1gApenSNSCSvE20y9+oxwRfvYy8g==";
25 | private static final String COOKIE_VALUE_WITHOUT_ROLES_AND_COLOUR = "uid=ab1234&roles=&hmac=Tpe2mlTIn0ZzHWnXVtrmDrcEdoLHzOwoeTRyMCpmJkDsawRjfyWgMR6Xc0Qwv79XNoN3o3/QWPcDQwZiK6KY9w==";
26 | private static final String COOKIE_VALUE_WITHOUT_HMAC = "uid=ab1234&roles=USER|TESTER&colour=YELLOW";
27 | private static final String COOKIE_VALUE_WITH_INVALID_HMAC = "uid=ab1234&roles=USER|TESTER&colour=YELLOW&hmac=invalid";
28 |
29 | private static final String USERNAME = "ab1234";
30 | private static final SimpleGrantedAuthority ROLE1 = new SimpleGrantedAuthority("USER");
31 | private static final SimpleGrantedAuthority ROLE2 = new SimpleGrantedAuthority("TESTER");
32 | private static final String COLOUR = "YELLOW";
33 |
34 | private static final String SECRET_KEY = "y.E@EA!FbtCwXYB-2v_n.!*xgzRqgtbq2d2_A_U!W2hubL@URHRzNP96WNPxEcXK";
35 | private static final String HMAC = "0k9BetqMZOijyq5gaM+2+sqCgDJOpSwHEgkyYwpfIyb5Zcnrsk/BqCWciGBEaYeGWTkMB1CEFJU0So0u8OTUUw==";
36 |
37 | @Mock
38 | private UserInfo userInfo;
39 | @Mock
40 | private Cookie cookie;
41 |
42 | @BeforeEach
43 | public void setupUserInfo() {
44 | lenient().when(userInfo.getUsername()).thenReturn(USERNAME);
45 | lenient().when(userInfo.getAuthorities()).thenReturn(List.of(ROLE1, ROLE2));
46 | lenient().when(userInfo.getColour()).thenReturn(Optional.of(COLOUR));
47 | }
48 |
49 | @BeforeEach
50 | public void setupCookie() {
51 | lenient().when(cookie.getName()).thenReturn(SignedUserInfoCookie.NAME);
52 | lenient().when(cookie.getValue()).thenReturn(COOKIE_VALUE_WITH_HMAC);
53 | }
54 |
55 | @Test
56 | public void create_fromUserInfo() {
57 | SignedUserInfoCookie signedUserInfoCookie = new SignedUserInfoCookie(userInfo, SECRET_KEY);
58 |
59 | assertThat(signedUserInfoCookie.getValue()).isEqualTo(COOKIE_VALUE_WITH_HMAC);
60 | }
61 |
62 | @Test
63 | public void create_fromUserInfo_withoutRoles() {
64 | when(userInfo.getAuthorities()).thenReturn(List.of());
65 |
66 | SignedUserInfoCookie signedUserInfoCookie = new SignedUserInfoCookie(userInfo, SECRET_KEY);
67 |
68 | assertThat(signedUserInfoCookie.getValue()).isEqualTo(COOKIE_VALUE_WITHOUT_ROLES);
69 | }
70 |
71 | @Test
72 | public void create_fromUserInfo_withoutColour() {
73 | when(userInfo.getColour()).thenReturn(Optional.empty());
74 |
75 | SignedUserInfoCookie signedUserInfoCookie = new SignedUserInfoCookie(userInfo, SECRET_KEY);
76 |
77 | assertThat(signedUserInfoCookie.getValue()).isEqualTo(COOKIE_VALUE_WITHOUT_COLOUR);
78 | }
79 |
80 | @Test
81 | public void create_fromBenutzer_ohneRollenLandUndMarke() {
82 | when(userInfo.getAuthorities()).thenReturn(List.of());
83 | when(userInfo.getColour()).thenReturn(Optional.empty());
84 |
85 | SignedUserInfoCookie signedUserInfoCookie = new SignedUserInfoCookie(userInfo, SECRET_KEY);
86 |
87 | assertThat(signedUserInfoCookie.getValue()).isEqualTo(COOKIE_VALUE_WITHOUT_ROLES_AND_COLOUR);
88 | }
89 |
90 | @Test
91 | public void create_fromCookie() {
92 | SignedUserInfoCookie signedUserInfoCookie = new SignedUserInfoCookie(cookie, SECRET_KEY);
93 |
94 | assertThat(signedUserInfoCookie.getUsername()).isEqualTo(USERNAME);
95 | assertThat(signedUserInfoCookie.getRoles()).containsExactlyInAnyOrder(ROLE1.getAuthority(), ROLE2.getAuthority());
96 | assertThat(signedUserInfoCookie.getColour()).isEqualTo(COLOUR);
97 | assertThat(signedUserInfoCookie.getHmac()).isEqualTo(HMAC);
98 | }
99 |
100 | @Test
101 | public void getUserInfo_fromCookie() {
102 | UserInfo userInfo = new SignedUserInfoCookie(cookie, SECRET_KEY).getUserInfo();
103 |
104 | assertThat(userInfo.getUsername()).isEqualTo(USERNAME);
105 | assertThat(userInfo.getAuthorities()).describedAs("roles").containsExactlyInAnyOrder(ROLE1, ROLE2);
106 | assertThat(userInfo.getColour()).isPresent().hasValue(COLOUR);
107 | }
108 |
109 | @Test
110 | public void getUserInfo_fromCookie_withoutRoles() {
111 | when(cookie.getValue()).thenReturn(COOKIE_VALUE_WITHOUT_ROLES);
112 |
113 | UserInfo userInfo = new SignedUserInfoCookie(cookie, SECRET_KEY).getUserInfo();
114 |
115 | assertThat(userInfo.getAuthorities()).isEmpty();
116 | }
117 |
118 | @Test
119 | public void getUserInfo_fromCookie_withoutColour() {
120 | when(cookie.getValue()).thenReturn(COOKIE_VALUE_WITHOUT_COLOUR);
121 |
122 | UserInfo userInfo = new SignedUserInfoCookie(cookie, SECRET_KEY).getUserInfo();
123 |
124 | assertThat(userInfo.getColour()).isEmpty();
125 | }
126 |
127 | @Test
128 | public void getUserInfo_fromCookie_withoutRolesAndColour() {
129 | when(cookie.getValue()).thenReturn(COOKIE_VALUE_WITHOUT_ROLES_AND_COLOUR);
130 |
131 | UserInfo userInfo = new SignedUserInfoCookie(cookie, SECRET_KEY).getUserInfo();
132 |
133 | assertThat(userInfo.getAuthorities()).isEmpty();
134 | assertThat(userInfo.getColour()).isEmpty();
135 | }
136 |
137 | @Test
138 | public void getUserInfo_fromCookie_missingSignature() {
139 | when(cookie.getValue()).thenReturn(COOKIE_VALUE_WITHOUT_HMAC);
140 |
141 | assertThatThrownBy(() -> new SignedUserInfoCookie(cookie, SECRET_KEY))
142 | .isInstanceOf(CookieVerificationFailedException.class);
143 | }
144 |
145 | @Test
146 | public void getUserInfo_fromCookie_invalidSignature() {
147 | when(cookie.getValue()).thenReturn(COOKIE_VALUE_WITH_INVALID_HMAC);
148 |
149 | assertThatThrownBy(() -> new SignedUserInfoCookie(cookie, SECRET_KEY))
150 | .isInstanceOf(CookieVerificationFailedException.class);
151 | }
152 |
153 | }
154 |
--------------------------------------------------------------------------------