22
33import static org .junit .jupiter .api .Assertions .assertAll ;
44import static org .junit .jupiter .api .Assertions .assertEquals ;
5- import static org .junit .jupiter .api .Assertions .assertNull ;
5+ import static org .junit .jupiter .api .Assertions .assertTrue ;
66
7- import java .io .IOException ;
8- import java .net .URI ;
7+ import java .net .http .HttpClient ;
8+ import java .net .http .HttpRequest ;
9+ import java .net .http .HttpResponse ;
910import java .nio .charset .StandardCharsets ;
10- import java .time .Duration ;
1111import java .util .List ;
1212import java .util .Set ;
1313import java .util .function .Function ;
1414import java .util .stream .Stream ;
1515
16- import org .apache .hc .client5 .http .classic .methods .HttpDelete ;
17- import org .apache .hc .client5 .http .classic .methods .HttpGet ;
18- import org .apache .hc .client5 .http .classic .methods .HttpHead ;
19- import org .apache .hc .client5 .http .classic .methods .HttpOptions ;
20- import org .apache .hc .client5 .http .classic .methods .HttpPost ;
21- import org .apache .hc .client5 .http .classic .methods .HttpPut ;
22- import org .apache .hc .client5 .http .classic .methods .HttpTrace ;
23- import org .apache .hc .client5 .http .classic .methods .HttpUriRequestBase ;
24- import org .apache .hc .client5 .http .config .ConnectionConfig ;
25- import org .apache .hc .client5 .http .impl .classic .CloseableHttpClient ;
26- import org .apache .hc .client5 .http .impl .classic .HttpClientBuilder ;
27- import org .apache .hc .client5 .http .impl .io .PoolingHttpClientConnectionManagerBuilder ;
28- import org .apache .hc .client5 .http .utils .Base64 ;
29- import org .apache .hc .core5 .http .ClassicHttpResponse ;
30- import org .apache .hc .core5 .http .HttpHeaders ;
31- import org .apache .hc .core5 .http .HttpResponse ;
32- import org .apache .hc .core5 .http .HttpStatus ;
33- import org .apache .hc .core5 .util .Timeout ;
16+ import org .apache .commons .codec .binary .Base64 ;
3417import org .junit .jupiter .api .DisplayName ;
3518import org .junit .jupiter .api .function .Executable ;
3619import org .junit .jupiter .params .ParameterizedTest ;
4326class LoginOtherTest extends InfraPerClassTest
4427{
4528 static final Set <String > NON_CSRF_METHODS = Set .of (
46- HttpGet . METHOD_NAME ,
47- HttpOptions . METHOD_NAME ,
48- HttpHead . METHOD_NAME );
29+ "GET" ,
30+ "OPTIONS" ,
31+ "HEAD" );
4932
5033 @ DisplayName ("No session should be created for public static resource" )
5134 @ ParameterizedTest (name = "{displayName} [method={0}] expect={1}" )
5235 @ MethodSource
53- void checkNoSessionCreatedForPublicStaticResource (final String method , final int expectedCode ) throws IOException
36+ void checkNoSessionCreatedForPublicStaticResource (final String method , final int expectedCode ) throws Exception
5437 {
55- try (final CloseableHttpClient client = createDefaultHttpClient ())
38+ try (final HttpClient client = this . createDefaultHttpClient ())
5639 {
57- final HttpUriRequestBase http = new HttpUriRequestBase (
58- method ,
59- URI .create (this .appInfra ().getExternalHTTPEndpoint () + "/robots.txt" ));
60- try (final ClassicHttpResponse response = client .execute (http , r -> r ))
61- {
62- assertAll (this .assertsNoSessionNoLoginAndCode (expectedCode , response ));
63- }
40+ assertAll (this .assertsNoSessionNoLoginAndCode (
41+ expectedCode ,
42+ client .send (
43+ this .createDefaultHttpRequestBuilder (method , "/robots.txt" ).build (),
44+ HttpResponse .BodyHandlers .discarding ())));
6445 }
6546 }
6647
6748 static Stream <Arguments > checkNoSessionCreatedForPublicStaticResource ()
6849 {
6950 return Stream .concat (
7051 NON_CSRF_METHODS .stream ()
71- .map (m -> Arguments .of (m , HttpStatus . SC_OK )),
52+ .map (m -> Arguments .of (m , 200 )),
7253 ALL_SUPPORTED_HTTP_METHODS .stream ()
7354 .filter (m -> !NON_CSRF_METHODS .contains (m ))
74- .map (m -> Arguments .of (m , HttpStatus . SC_METHOD_NOT_ALLOWED ))
55+ .map (m -> Arguments .of (m , 405 ))
7556 );
7657 }
7758
@@ -83,25 +64,23 @@ void checkNoSessionCreatedForActuator(
8364 final boolean existingPath ,
8465 final String method ,
8566 final int expectedCode )
86- throws IOException
67+ throws Exception
8768 {
88- try (final CloseableHttpClient client = createDefaultHttpClient ())
69+ try (final HttpClient client = this . createDefaultHttpClient ())
8970 {
90- final HttpUriRequestBase http = new HttpUriRequestBase (
91- method ,
92- URI .create (this .appInfra ().getExternalHTTPEndpoint () + "/actuator" + (existingPath ? "" : "/abc" )));
71+ final HttpRequest .Builder requestBuilder =
72+ this .createDefaultHttpRequestBuilder (method , "/actuator" + (existingPath ? "" : "/abc" ));
9373 if (withAuth )
9474 {
9575 final String auth =
9676 this .appInfra ().getActuatorUsername () + ":" + this .appInfra ().getActuatorPassword ();
97- http . setHeader (
98- HttpHeaders . AUTHORIZATION ,
77+ requestBuilder . header (
78+ "Authorization" ,
9979 "Basic " + new String (Base64 .encodeBase64 (auth .getBytes (StandardCharsets .ISO_8859_1 ))));
10080 }
101- try (final ClassicHttpResponse response = client .execute (http , r -> r ))
102- {
103- assertAll (this .assertsNoSessionNoLoginAndCode (expectedCode , response ));
104- }
81+ assertAll (this .assertsNoSessionNoLoginAndCode (
82+ expectedCode ,
83+ client .send (requestBuilder .build (), HttpResponse .BodyHandlers .discarding ())));
10584 }
10685 }
10786
@@ -110,53 +89,39 @@ static Stream<Arguments> checkNoSessionCreatedForActuator()
11089 return Stream .of (
11190 // NO AUTH but ENDPOINT EXISTS
11291 ALL_SUPPORTED_HTTP_METHODS .stream ()
113- .map (method -> Arguments .of (false , true , method , HttpStatus . SC_UNAUTHORIZED )),
92+ .map (method -> Arguments .of (false , true , method , 401 )),
11493 // AUTH and ENDPOINT EXISTS
11594 NON_CSRF_METHODS .stream ()
116- .map (method -> Arguments .of (true , true , method , HttpStatus . SC_OK )),
95+ .map (method -> Arguments .of (true , true , method , 200 )),
11796 ALL_SUPPORTED_HTTP_METHODS .stream ()
11897 .filter (m -> !NON_CSRF_METHODS .contains (m ))
119- .map (method -> Arguments .of (true , true , method , HttpStatus . SC_METHOD_NOT_ALLOWED )),
98+ .map (method -> Arguments .of (true , true , method , 405 )),
12099 // AUTH and INVALID ENDPOINT
121100 ALL_SUPPORTED_HTTP_METHODS .stream ()
122- .map (method -> Arguments .of (true , false , method , HttpStatus . SC_NOT_FOUND )),
101+ .map (method -> Arguments .of (true , false , method , 404 )),
123102 // NO AUTH and INVALID ENDPOINT
124103 ALL_SUPPORTED_HTTP_METHODS .stream ()
125- .map (method -> Arguments .of (false , false , method , HttpStatus . SC_UNAUTHORIZED )),
104+ .map (method -> Arguments .of (false , false , method , 401 )),
126105 // TRACE is not supported by Spring Boot
127106 Stream .of (false , true )
128107 .map (existingPath ->
129- Arguments .of (false , existingPath , HttpTrace . METHOD_NAME , HttpStatus . SC_METHOD_NOT_ALLOWED ))
108+ Arguments .of (false , existingPath , "TRACE" , 405 ))
130109 ).flatMap (Function .identity ());
131110 }
132111
133- protected static CloseableHttpClient createDefaultHttpClient ()
134- {
135- final Duration timeout = Duration .ofSeconds (30 );
136- return HttpClientBuilder .create ()
137- .setConnectionManager (PoolingHttpClientConnectionManagerBuilder .create ()
138- .setDefaultConnectionConfig (ConnectionConfig .custom ()
139- .setConnectTimeout (Timeout .of (timeout ))
140- .setSocketTimeout (Timeout .of (timeout ))
141- .build ())
142- .build ())
143- .disableRedirectHandling ()
144- .build ();
145- }
146-
147- private Stream <Executable > assertsNoSessionNoLoginAndCode (final int expectedCode , final HttpResponse response )
112+ private Stream <Executable > assertsNoSessionNoLoginAndCode (final int expectedCode , final HttpResponse <?> response )
148113 {
149114 return Stream .of (
150- () -> assertEquals (expectedCode , response .getCode ()),
151- () -> assertNull (response .getHeader ( "Set-Cookie" ))
115+ () -> assertEquals (expectedCode , response .statusCode ()),
116+ () -> assertTrue (response .headers (). firstValue ( "Set-Cookie" ). isEmpty ( ))
152117 );
153118 }
154119
155120 static final List <String > ALL_SUPPORTED_HTTP_METHODS = List .of (
156- HttpGet . METHOD_NAME ,
157- HttpPost . METHOD_NAME ,
158- HttpPut . METHOD_NAME ,
159- HttpDelete . METHOD_NAME ,
160- HttpHead . METHOD_NAME ,
161- HttpOptions . METHOD_NAME );
121+ "GET" ,
122+ "POST" ,
123+ "PUT" ,
124+ "DELETE" ,
125+ "HEAD" ,
126+ "OPTIONS" );
162127}
0 commit comments