使用Spring Security成功登录后发送请求

Question

Right now, I'm learning about implementing REST API with a Spring Security Framework.

My question is, after success login with spring security, how can i send the request to server and make sure the server know that i am have been authorized (already login with success)?

I have a some experiment code to do testing

@RunWith(SpringJUnit4ClassRunner.class)
@WebAppConfiguration
@ContextConfiguration(classes = { WebAppConfig.class, SecurityConfig.class })
public class TheTest {

    @Autowired
    private WebApplicationContext wac;

    @Autowired
    private FilterChainProxy filterChainProxy;

    protected MockMvc mockMvc;

    @Before
    public void setup() {
        mockMvc = MockMvcBuilders//
                .webAppContextSetup(wac)//
                .addFilter(filterChainProxy)//
                .build()//
        ;
    }

    @Test
    public void testDoingArequest() throws Exception {

        // login here
        HttpSession session = mockMvc.perform(//
                //
                post("/login-process")//
                        .param("username", "theusername")//
                        .param("password", "thepassword")//
                )//
                .andDo(print())//
                .andExpect(status().isFound())//
                .andReturn().getRequest().getSession()//
        ;

        // login is success and now trying to call request
        this.mockMvc.perform(//
                get("/doingRequest")//
                        .session((MockHttpSession) session)// <-- where this part must added to?
                )//
                .andExpect(status().isOk())//
                .andDo(print())//
        ;

    }

}

-

@Override
protected void configure(HttpSecurity http) throws Exception {

    http.authorizeRequests()//
            .antMatchers("/doingRequest").authenticated()//
            .anyRequest().permitAll()//
            .and()//
            .csrf().disable()//
            .formLogin()//
            .loginPage("/")//
            .loginProcessingUrl("/login-process")//
            .defaultSuccessUrl("/");

}

-

@Controller
public class TheController {

    @RequestMapping(value = "doingRequest", method = RequestMethod.GET)
    @ResponseBody
    public String doingSomething() {
        return "Only authorized user can read this";
    }

}

-

Above code is running well but i dont know how to implementing the "session" part in HTTP. I'm expecting something like put a token or something in header or url in real life application/implementation not in the testing environment. How the client get the token? How do we call the request (with token embedd) in client code.?

Answer 1

Are you looking for mocking a session object.If yes then you need to import the mock session object, and in the test class you can create and use the object.

import org.springframework.mock.web.MockHttpSession;

MockHttpSession session = new MockHttpSession();

session.setAttribute("variable", object);

Answer 2

The configuration you have will use the server side session to maintain the security context, and the link with the client is the standard servlet JSESSIONID cookie, so this has nothing to do with Spring Security. Whether you actually want a session or not will depend on the nature of your client. If there is no state maintained between the client and server, then each request from the client must be separately authenticated/authorized. This might be done using Basic authentication for example, or something like an OAuth2 access token depending on your requirements.