From fed318abc76b1992d11746f7fa1c3459eeb31676 Mon Sep 17 00:00:00 2001 From: Rob Winch Date: Mon, 13 Apr 2020 09:38:42 -0500 Subject: [PATCH] Find by Username Sample switch from DELETE to POST Spring Boot 2.2 no longer adds HiddenHttpMethodFilter by default See https://github.com/spring-projects/spring-boot/wiki/Spring-Boot-2.2-Release-Notes#httphiddenmethodfilter-disabled-by-default This means that trying to map DELETE requests using _method variable does not work. This changes the mapping to use a POST which doesn't require the HiddenHttpMethodFilter which might expose the application to unnecessary security risk by allowing the HTTP method to be overridden. Closes gh-1613 --- .../java/sample/FindByUsernameTests.java | 24 +++++++++++++++++++ .../java/sample/pages/HomePage.java | 15 ++++++++++-- .../main/java/sample/mvc/IndexController.java | 4 ++-- .../src/main/resources/templates/index.html | 2 +- 4 files changed, 40 insertions(+), 5 deletions(-) diff --git a/spring-session-samples/spring-session-sample-boot-findbyusername/src/integration-test/java/sample/FindByUsernameTests.java b/spring-session-samples/spring-session-sample-boot-findbyusername/src/integration-test/java/sample/FindByUsernameTests.java index 5f36941a..9b004ecd 100644 --- a/spring-session-samples/spring-session-sample-boot-findbyusername/src/integration-test/java/sample/FindByUsernameTests.java +++ b/spring-session-samples/spring-session-sample-boot-findbyusername/src/integration-test/java/sample/FindByUsernameTests.java @@ -53,6 +53,8 @@ class FindByUsernameTests { private WebDriver driver; + private WebDriver driver2; + @BeforeEach void setup() { this.driver = MockMvcHtmlUnitDriverBuilder.mockMvcSetup(this.mockMvc).build(); @@ -61,6 +63,9 @@ class FindByUsernameTests { @AfterEach void tearDown() { this.driver.quit(); + if (this.driver2 != null) { + this.driver2.quit(); + } } @Test @@ -79,6 +84,25 @@ class FindByUsernameTests { home.terminateButtonDisabled(); } + @Test + void terminateOtherSession() throws Exception { + HomePage forgotToLogout = home(this.driver); + + this.driver2 = MockMvcHtmlUnitDriverBuilder.mockMvcSetup(this.mockMvc).build(); + HomePage terminateFogotSession = home(this.driver2); + terminateFogotSession.terminateSession(forgotToLogout.getSessionId()).assertAt(); + + LoginPage login = HomePage.go(this.driver); + login.assertAt(); + } + + private static HomePage home(WebDriver driver) { + LoginPage login = HomePage.go(driver); + HomePage home = login.form().login(HomePage.class); + home.assertAt(); + return home; + } + @TestConfiguration static class Config { diff --git a/spring-session-samples/spring-session-sample-boot-findbyusername/src/integration-test/java/sample/pages/HomePage.java b/spring-session-samples/spring-session-sample-boot-findbyusername/src/integration-test/java/sample/pages/HomePage.java index 4dc1f58d..47580bf3 100644 --- a/spring-session-samples/spring-session-sample-boot-findbyusername/src/integration-test/java/sample/pages/HomePage.java +++ b/spring-session-samples/spring-session-sample-boot-findbyusername/src/integration-test/java/sample/pages/HomePage.java @@ -56,6 +56,18 @@ public class HomePage extends BasePage { } public void terminateButtonDisabled() { + String sessionId = getSessionId(); + WebElement element = getDriver().findElement(By.id("terminate-" + sessionId)); + assertThat(element.isEnabled()).isFalse(); + } + + public HomePage terminateSession(String sessionId) { + WebElement terminate = getDriver().findElement(By.id("terminate-" + sessionId)); + terminate.click(); + return new HomePage(getDriver()); + } + + public String getSessionId() { Set cookies = getDriver().manage().getCookies(); String cookieValue = null; for (Cookie cookie : cookies) { @@ -63,8 +75,7 @@ public class HomePage extends BasePage { cookieValue = new String(Base64.getDecoder().decode(cookie.getValue())); } } - WebElement element = getDriver().findElement(By.id("terminate-" + cookieValue)); - assertThat(element.isEnabled()).isFalse(); + return cookieValue; } public HomePage logout() { diff --git a/spring-session-samples/spring-session-sample-boot-findbyusername/src/main/java/sample/mvc/IndexController.java b/spring-session-samples/spring-session-sample-boot-findbyusername/src/main/java/sample/mvc/IndexController.java index 123c4f8e..3af0bf76 100644 --- a/spring-session-samples/spring-session-sample-boot-findbyusername/src/main/java/sample/mvc/IndexController.java +++ b/spring-session-samples/spring-session-sample-boot-findbyusername/src/main/java/sample/mvc/IndexController.java @@ -26,8 +26,8 @@ import org.springframework.session.Session; import org.springframework.stereotype.Controller; import org.springframework.ui.Model; import org.springframework.web.bind.annotation.PathVariable; +import org.springframework.web.bind.annotation.PostMapping; import org.springframework.web.bind.annotation.RequestMapping; -import org.springframework.web.bind.annotation.RequestMethod; /** * Controller for sending the user to the login view. @@ -50,7 +50,7 @@ public class IndexController { } // end::findbyusername[] - @RequestMapping(value = "/sessions/{sessionIdToDelete}", method = RequestMethod.DELETE) + @PostMapping("/sessions/{sessionIdToDelete}") public String removeSession(Principal principal, @PathVariable String sessionIdToDelete) { Set usersSessionIds = this.sessions.findByPrincipalName(principal.getName()).keySet(); if (usersSessionIds.contains(sessionIdToDelete)) { diff --git a/spring-session-samples/spring-session-sample-boot-findbyusername/src/main/resources/templates/index.html b/spring-session-samples/spring-session-sample-boot-findbyusername/src/main/resources/templates/index.html index a9c51521..6d37087d 100644 --- a/spring-session-samples/spring-session-sample-boot-findbyusername/src/main/resources/templates/index.html +++ b/spring-session-samples/spring-session-sample-boot-findbyusername/src/main/resources/templates/index.html @@ -25,7 +25,7 @@ -
+