43

I have a spring mvc (3.2.5) application with spring security (3.2).

I configured my SecurityConfig.class with this method :

@Override
protected void configure(HttpSecurity http) throws Exception {

    http.authorizeRequests().antMatchers("/*").permitAll().and()
            .formLogin().successHandler(successHandler)
            .defaultSuccessUrl("/")
            .failureHandler(failureHandler).failureUrl("/login?error=true")
            .permitAll().and().logout()
            .permitAll();

    http.authorizeRequests().antMatchers("/resources/**").permitAll();

    http.authorizeRequests().antMatchers("/welcome").permitAll();

    http.authorizeRequests().antMatchers("/secure/*").authenticated();
    http.authorizeRequests().antMatchers("/admin/**").hasRole("ADMIN").anyRequest().authenticated();
} 

With Spring security (3.2) I have CSRF enabled. I think it is a good idea to let it enabled.

My controller SignInController contains 2 methods with params :

EDIT : adding action= in params

@RequestMapping(value = "/signup")
    public ModelAndView signup() {

        boolean auth = SecurityContextHolder.getContext().getAuthentication() == null ? false
                : SecurityContextHolder.getContext().getAuthentication()
                        .isAuthenticated()
                        && (SecurityContextHolder.getContext()
                                .getAuthentication().getPrincipal() instanceof User);

        ModelAndView result = null;

        if (auth) {
            result = new ModelAndView("redirect:" + "/");
        } else {
            UserForm user = new UserForm();
            result = new ModelAndView("registration", "userForm", user);
        }
        return result;
    }

    @RequestMapping(value = "/register", params = "action=signup")
    public ModelAndView registration(
            @ModelAttribute(value = "userForm") @Valid UserForm userForm,
            BindingResult result, HttpServletRequest request) {

        if (result.hasErrors()) {
            return new ModelAndView("registration");
        }

        Member member = profileFacade.registerNewUser(userForm);

        return new ModelAndView("registration", "member", member);
    }

    @RequestMapping(value = "/register", params = "action=cancel")
    public ModelAndView cancelRegistration() {
        return new ModelAndView("redirect:" + "/");
    }

and finally, I have JUnit test :

@RunWith(SpringJUnit4ClassRunner.class)
    @WebAppConfiguration
    @ContextConfiguration(classes = { WebConfiguration.class,
        JpaConfiguration.class, LoggingConfiguration.class,
        SecurityConfig.class, DataSourceEmbeddedConfiguration.class,
        DataSourceMySqlConfig.class, BaseValidatorConfiguration.class })
    @TransactionConfiguration(transactionManager = "transactionManager", defaultRollback = true)
    @ActiveProfiles("dev")
    public class SignInControllerTest {

        @Autowired
        private WebApplicationContext webApplicationContext;
        @Autowired
        private MockHttpSession session;
        @Autowired
        private MockHttpServletRequest request;
        @Autowired
        private FilterChainProxy springSecurityFilterChain;

        private MockMvc mockMvc;

        @Before
        public void setUp() throws ServletException {

            SecurityContextHolderAwareRequestFilter scharf = new SecurityContextHolderAwareRequestFilter();
            scharf.afterPropertiesSet();

            this.mockMvc = MockMvcBuilders
                    .webAppContextSetup(this.webApplicationContext)
                    .addFilters(springSecurityFilterChain).dispatchOptions(true).build();

            SecurityContextHolder.getContext().setAuthentication(null);
        }
        @Test
        public void signup() throws Exception {
            mockMvc.perform(get("/signup")).andExpect(status().isOk())
                    .andExpect(model().attributeExists("userForm"));
        }

        @Test
        @Transactional
        @Rollback(true)
        public void register() throws Exception {

            UserForm form = new UserForm();
            form.setEmail("[email protected]");
            form.setUsername("aokije");
            form.setPassword("klo,ksff");
            form.setConfirmedPassword("klo,ksff");

            mockMvc.perform(post("/register").param("action", "signup")).andExpect(status().isOk());
        }

    }

EDIT : update mockMvc.perform because it is working fine with http.csrf().disable() in SecurityConfig.class

Test signup run perfectly but register return an error 403. I tried a lot of things but I received always this error.

When I try http://localhost:8080/register?signup in a browser, it is working fine.

_EDIT_

Logs :

2014-02-13 22:00:14,695 [ExpressionBasedFilterInvocationSecurityMetadataSource] processMap Adding web access control expression 'permitAll', for org.springframework.security.config.annotation.web.configurers.PermitAllSupport$ExactUrlRequestMatcher@52ee705c 
2014-02-13 22:00:14,696 [ExpressionBasedFilterInvocationSecurityMetadataSource] processMap Adding web access control expression 'permitAll', for org.springframework.security.config.annotation.web.configurers.PermitAllSupport$ExactUrlRequestMatcher@2412d28d 
2014-02-13 22:00:14,697 [ExpressionBasedFilterInvocationSecurityMetadataSource] processMap Adding web access control expression 'permitAll', for org.springframework.security.config.annotation.web.configurers.PermitAllSupport$ExactUrlRequestMatcher@4fbd397b 
2014-02-13 22:00:14,697 [ExpressionBasedFilterInvocationSecurityMetadataSource] processMap Adding web access control expression 'permitAll', for Ant [pattern='/logout'] 
2014-02-13 22:00:14,698 [ExpressionBasedFilterInvocationSecurityMetadataSource] processMap Adding web access control expression 'permitAll', for org.springframework.security.config.annotation.web.configurers.PermitAllSupport$ExactUrlRequestMatcher@1008e323 
2014-02-13 22:00:14,699 [ExpressionBasedFilterInvocationSecurityMetadataSource] processMap Adding web access control expression 'permitAll', for Ant [pattern='/*'] 
2014-02-13 22:00:14,700 [ExpressionBasedFilterInvocationSecurityMetadataSource] processMap Adding web access control expression 'permitAll', for Ant [pattern='/resources/**'] 
2014-02-13 22:00:14,700 [ExpressionBasedFilterInvocationSecurityMetadataSource] processMap Adding web access control expression 'permitAll', for Ant [pattern='/welcome'] 
2014-02-13 22:00:14,700 [ExpressionBasedFilterInvocationSecurityMetadataSource] processMap Adding web access control expression 'authenticated', for Ant [pattern='/secure/*'] 
2014-02-13 22:00:14,701 [ExpressionBasedFilterInvocationSecurityMetadataSource] processMap Adding web access control expression 'hasRole('ROLE_ADMIN')', for Ant [pattern='/admin/**'] 
2014-02-13 22:00:14,701 [ExpressionBasedFilterInvocationSecurityMetadataSource] processMap Adding web access control expression 'authenticated', for org.springframework.security.web.util.matcher.AnyRequestMatcher@1 
2014-02-13 22:00:14,703 [FilterSecurityInterceptor] afterPropertiesSet Validated configuration attributes 
2014-02-13 22:00:14,704 [FilterSecurityInterceptor] afterPropertiesSet Validated configuration attributes 
2014-02-13 22:00:14,734 [DefaultSecurityFilterChain] <init> Creating filter chain: org.springframework.security.web.util.matcher.AnyRequestMatcher@1, [org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter@10174779, org.springframework.security.web.context.SecurityContextPersistenceFilter@68736a7e, org.springframework.security.web.header.HeaderWriterFilter@728e5d0d, org.springframework.security.web.csrf.CsrfFilter@6e7a918b, org.springframework.security.web.authentication.logout.LogoutFilter@430e85e7, org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter@55eda087, org.springframework.security.web.authentication.ui.DefaultLoginPageGeneratingFilter@290c7ca, org.springframework.security.web.savedrequest.RequestCacheAwareFilter@6dd90afc, org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter@12eb6a0f, org.springframework.security.web.authentication.AnonymousAuthenticationFilter@6855612f, org.springframework.security.web.session.SessionManagementFilter@410a11a2, org.springframework.security.web.access.ExceptionTranslationFilter@59e15580, org.springframework.security.web.access.intercept.FilterSecurityInterceptor@2257a0] 
2014-02-13 22:00:14,859 [FilterChainProxy] doFilter /register at position 1 of 13 in additional filter chain; firing Filter: 'WebAsyncManagerIntegrationFilter' 
2014-02-13 22:00:14,863 [FilterChainProxy] doFilter /register at position 2 of 13 in additional filter chain; firing Filter: 'SecurityContextPersistenceFilter' 
2014-02-13 22:00:14,863 [HttpSessionSecurityContextRepository] readSecurityContextFromSession HttpSession returned null object for SPRING_SECURITY_CONTEXT 
2014-02-13 22:00:14,863 [HttpSessionSecurityContextRepository] loadContext No SecurityContext was available from the HttpSession: org.springframework.mock.web.MockHttpSession@4c4b529f. A new one will be created. 
2014-02-13 22:00:14,864 [FilterChainProxy] doFilter /register at position 3 of 13 in additional filter chain; firing Filter: 'HeaderWriterFilter' 
2014-02-13 22:00:14,865 [HstsHeaderWriter] writeHeaders Not injecting HSTS header since it did not match the requestMatcher org.springframework.security.web.header.writers.HstsHeaderWriter$SecureRequestMatcher@5ab39e58 
2014-02-13 22:00:14,865 [FilterChainProxy] doFilter /register at position 4 of 13 in additional filter chain; firing Filter: 'CsrfFilter' 
2014-02-13 22:00:14,866 [CsrfFilter] doFilterInternal Invalid CSRF token found for http://localhost/register 
2014-02-13 22:00:14,866 [HttpSessionSecurityContextRepository] saveContext SecurityContext is empty or contents are anonymous - context will not be stored in HttpSession. 
2014-02-13 22:00:14,866 [SecurityContextPersistenceFilter] doFilter SecurityContextHolder now cleared, as request processing completed 

Could you help me ?

Thanks a lot

EDIT

Finally, I had a bug in another class (annotation). I fix with this :

HttpSessionCsrfTokenRepository httpSessionCsrfTokenRepository = new HttpSessionCsrfTokenRepository();
        CsrfToken csrfToken = httpSessionCsrfTokenRepository
                .generateToken(request);

        Map map = new HashMap();
        map.put("userForm", form);
        map.put("org.springframework.security.web.csrf.HttpSessionCsrfTokenRepository.CSRF_TOKEN",
                csrfToken);
        this.mockMvc
                .perform(
                        post("/register")
                                .param("signup", "")
                                .param("_csrf", csrfToken.getToken())
                                .sessionAttrs(map)).andExpect(status().isOk());

Params csrf and sessionAttrs are mandatory.

4 Answers 4

92

I know this question is quite old, but this is one of the first results on Google for some queries and I believe this approach is much better and it is described on spring.io blog

1) You can create your mockMvc with Spring Security support easier, so your setUp() gets much shorter:

@Before
public void setUp() throws Exception {
    mockMvc = MockMvcBuilders
            .webAppContextSetup(webApplicationContext)
            .apply(springSecurity())
            .build();
}

2) You can use org.springframework.security.test.web.servlet.request.SecurityMockMvcRequestPostProcessors.csrf() to populate your test request with correct CSRF token like this:

mockMvc.perform(post("/register")
              .with(csrf())
              .param("action", "signup"))
     .andExpect(status().isOk());
7
  • 6
    Awesome, just saved me. It is required when you have http.csrf().disable() in security config. Commented Dec 15, 2017 at 4:13
  • 1
    @AnilBhaskar Why do you have to use it when you specify csrf is disabled?
    – apines
    Commented Feb 17, 2019 at 5:40
  • If you are looking for an answer in spring-boot2, you can check my answer which solve both issues regarding with http 403 and http 401 problems. stackoverflow.com/a/54839518/1577363
    – erhun
    Commented Feb 23, 2019 at 8:12
  • This answer worked for me and is way simpler than the accepted answer.
    – user327961
    Commented May 28, 2019 at 19:26
  • 1
    9 years later and this reply is still saving lives and returning top on search engines. It was as simple as adding .with(csrf()) for me as well.
    – Favna
    Commented Jun 6 at 16:37
30

Try with @AutoConfigureMockMvc(addFilters = false)

4
  • Don't know why it works, but it works and fixes my unit tests. Thanks...
    – Meilan
    Commented Nov 18, 2022 at 17:28
  • worked for me too! Can you explain why?
    – Laess3r
    Commented Dec 28, 2022 at 9:24
  • 1
    Usually, you have a SecurityFilterChain that configures the HttpSecurity with parameters like http.csrft()....addFilter(...) etc.. This code disables the security filter for unit test.
    – Edu Costa
    Commented Jan 4, 2023 at 17:29
  • This will work, but it disables all security filters. Make sure that's what you really want, depending on your test scenario. Better use .with(csrf()) to actually pass a CSRF token, if it's required. Commented May 29 at 15:44
19

Post requests need the CSRF token to be added to the form. So you have to pass it while testing:

var TOKEN_ATTR_NAME = "org.springframework.security.web.csrf.HttpSessionCsrfTokenRepository.CSRF_TOKEN";
var httpSessionCsrfTokenRepository = new HttpSessionCsrfTokenRepository();
var csrfToken = httpSessionCsrfTokenRepository.generateToken(new MockHttpServletRequest());

mockMvc.perform(
  post("/your/path/here")
    .sessionAttr(TOKEN_ATTR_NAME, csrfToken)
    .param(csrfToken.getParameterName(), csrfToken.getToken())
    ...
);

Second thing, are you sure that the registration method handles your post request? Isn't RequestMapping configured for "GET" by default?

7
  • Thanks but it is not working. I tried this : It is not working. I tried this : mockMvc.perform(post("/register").param("action", "signup").session(session).sessionAttr("_csrf", csrfToken)).andExpect( status().isOk()); I received same error. If I disable csrf with http.csrf().disable() in my SecurityConfig, it is working fine (without .sessionAttr()) Commented Feb 13, 2014 at 11:04
  • try to use "org.springframework.security.web.csrf.HttpSessionCsrfTokenRepository.CSRF_TOKEN"; instead "_csrf", forgot to post that ; ) Commented Feb 13, 2014 at 11:17
  • 1
    I don't have access to constant CSRF_TOKEN. It doesn't exist in the class. All other constants are private. Commented Feb 13, 2014 at 11:33
  • its only string, key for attribute in session. Just pass it as first parameter: .sessionAttr("org.springframework.security.web.csrf.HttpSessionCsrfTokenRepository.CSRF_TOKEN‌​", csrfToken) Commented Feb 13, 2014 at 11:36
  • The problem persist. I had test with HttpSessionCsrfTokenRepository.class.getName().concat(".CSRF_TOKEN") but it failed too. If I check csrfToken, paramvalue is "_csrf". Commented Feb 13, 2014 at 11:47
1

For reactive apps using org.springframework.test.web.reactive.server.WebTestClient, try .mutateWith(csrf()), as in

import org.springframework.security.test.web.reactive.server.SecurityMockServerConfigurers.csrf

@Autowired private lateinit var webTestClient: WebTestClient

@Test fun `the endpoint works`() {
  webTestClient.mutateWith(csrf()).get().uri("/ui/home")...
}

Source: Spring docs

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.