Skip to content

Commit 258beea

Browse files
jzheauxjzheaux
committed
Add setFavorRelativeUris
This places the new functionality behind a setting so that we can remain passive until we can change the setting in the next major release. Issue spring-projectsgh-7273
1 parent a411735 commit 258beea

25 files changed

+288
-98
lines changed

‎config/src/test/java/org/springframework/security/config/annotation/web/builders/NamespaceHttpTests.java

+3-3
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2024 the original author or authors.
2+
* Copyright 2002-2022 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -77,7 +77,7 @@
7777
import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get;
7878
import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.forwardedUrl;
7979
import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.header;
80-
import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.redirectedUrl;
80+
import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.redirectedUrlPattern;
8181
import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;
8282

8383
/**
@@ -167,7 +167,7 @@ public void configureWhenAuthenticationEntryPointSetAndRequestUnauthorizedThenRe
167167
// @formatter:off
168168
this.mockMvc.perform(get("/"))
169169
.andExpect(status().is3xxRedirection())
170-
.andExpect(redirectedUrl("/entry-point"));
170+
.andExpect(redirectedUrlPattern("**/entry-point"));
171171
// @formatter:on
172172
}
173173

‎config/src/test/java/org/springframework/security/config/annotation/web/configurers/DefaultLoginPageConfigurerTests.java

+2-2
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2024 the original author or authors.
2+
* Copyright 2002-2023 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -82,7 +82,7 @@ public class DefaultLoginPageConfigurerTests {
8282
@Test
8383
public void getWhenFormLoginEnabledThenRedirectsToLoginPage() throws Exception {
8484
this.spring.register(DefaultLoginPageConfig.class).autowire();
85-
this.mvc.perform(get("/")).andExpect(redirectedUrl("/login"));
85+
this.mvc.perform(get("/")).andExpect(redirectedUrl("http://localhost/login"));
8686
}
8787

8888
@Test

‎config/src/test/java/org/springframework/security/config/annotation/web/configurers/ExceptionHandlingConfigurerTests.java

+3-2
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2024 the original author or authors.
2+
* Copyright 2002-2022 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -213,7 +213,8 @@ public void getWhenCustomSecurityContextHolderStrategyThenUsed() throws Exceptio
213213
@Test
214214
public void getWhenUsingDefaultsAndUnauthenticatedThenRedirectsToLogin() throws Exception {
215215
this.spring.register(DefaultHttpConfig.class).autowire();
216-
this.mvc.perform(get("/").header(HttpHeaders.ACCEPT, "bogus/type")).andExpect(redirectedUrl("/login"));
216+
this.mvc.perform(get("/").header(HttpHeaders.ACCEPT, "bogus/type"))
217+
.andExpect(redirectedUrl("http://localhost/login"));
217218
}
218219

219220
@Test

‎config/src/test/java/org/springframework/security/config/annotation/web/configurers/FormLoginConfigurerTests.java

+4-4
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2024 the original author or authors.
2+
* Copyright 2002-2022 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -162,7 +162,7 @@ public void requestProtectedWhenFormLoginConfiguredThenRedirectsToLogin() throws
162162
// @formatter:off
163163
this.mockMvc.perform(get("/private"))
164164
.andExpect(status().isFound())
165-
.andExpect(redirectedUrl("/login"));
165+
.andExpect(redirectedUrl("http://localhost/login"));
166166
// @formatter:on
167167
}
168168

@@ -217,7 +217,7 @@ public void requestProtectedWhenFormLoginDefaultsInLambdaThenRedirectsToLogin()
217217
// @formatter:off
218218
this.mockMvc.perform(get("/private"))
219219
.andExpect(status().isFound())
220-
.andExpect(redirectedUrl("/login"));
220+
.andExpect(redirectedUrl("http://localhost/login"));
221221
// @formatter:on
222222
}
223223

@@ -331,7 +331,7 @@ public void failureUrlWhenPermitAllAndFailureHandlerThenSecured() throws Excepti
331331
// @formatter:off
332332
this.mockMvc.perform(get("/login?error"))
333333
.andExpect(status().isFound())
334-
.andExpect(redirectedUrl("/login"));
334+
.andExpect(redirectedUrl("http://localhost/login"));
335335
// @formatter:on
336336
}
337337

‎config/src/test/java/org/springframework/security/config/annotation/web/configurers/NamespaceHttpFormLoginTests.java

+4-4
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2024 the original author or authors.
2+
* Copyright 2002-2022 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -65,7 +65,7 @@ public class NamespaceHttpFormLoginTests {
6565
@Test
6666
public void formLoginWhenDefaultConfigurationThenMatchesNamespace() throws Exception {
6767
this.spring.register(FormLoginConfig.class, UserDetailsServiceConfig.class).autowire();
68-
this.mvc.perform(get("/")).andExpect(redirectedUrl("/login"));
68+
this.mvc.perform(get("/")).andExpect(redirectedUrl("http://localhost/login"));
6969
this.mvc.perform(post("/login").with(csrf())).andExpect(redirectedUrl("/login?error"));
7070
// @formatter:off
7171
MockHttpServletRequestBuilder loginRequest = post("/login")
@@ -79,7 +79,7 @@ public void formLoginWhenDefaultConfigurationThenMatchesNamespace() throws Excep
7979
@Test
8080
public void formLoginWithCustomEndpointsThenBehaviorMatchesNamespace() throws Exception {
8181
this.spring.register(FormLoginCustomConfig.class, UserDetailsServiceConfig.class).autowire();
82-
this.mvc.perform(get("/")).andExpect(redirectedUrl("/authentication/login"));
82+
this.mvc.perform(get("/")).andExpect(redirectedUrl("http://localhost/authentication/login"));
8383
this.mvc.perform(post("/authentication/login/process").with(csrf()))
8484
.andExpect(redirectedUrl("/authentication/login?failed"));
8585
// @formatter:off
@@ -94,7 +94,7 @@ public void formLoginWithCustomEndpointsThenBehaviorMatchesNamespace() throws Ex
9494
@Test
9595
public void formLoginWithCustomHandlersThenBehaviorMatchesNamespace() throws Exception {
9696
this.spring.register(FormLoginCustomRefsConfig.class, UserDetailsServiceConfig.class).autowire();
97-
this.mvc.perform(get("/")).andExpect(redirectedUrl("/login"));
97+
this.mvc.perform(get("/")).andExpect(redirectedUrl("http://localhost/login"));
9898
this.mvc.perform(post("/login").with(csrf())).andExpect(redirectedUrl("/custom/failure"));
9999
verifyBean(WebAuthenticationDetailsSource.class).buildDetails(any(HttpServletRequest.class));
100100
// @formatter:off

‎config/src/test/java/org/springframework/security/config/annotation/web/configurers/NamespaceRememberMeTests.java

+3-3
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2024 the original author or authors.
2+
* Copyright 2002-2022 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -104,7 +104,7 @@ public void rememberMeLoginWhenUsingDefaultsThenMatchesNamespace() throws Except
104104
.with(csrf())
105105
.cookie(rememberMe);
106106
this.mvc.perform(authenticationClassRequest)
107-
.andExpect(redirectedUrl("/login"))
107+
.andExpect(redirectedUrl("http://localhost/login"))
108108
.andReturn();
109109
// @formatter:on
110110
}
@@ -150,7 +150,7 @@ public void rememberMeLoginWhenKeyDeclaredThenMatchesNamespace() throws Exceptio
150150
// @formatter:off
151151
this.mvc.perform(somewhereRequest)
152152
.andExpect(status().isFound())
153-
.andExpect(redirectedUrl("/login"));
153+
.andExpect(redirectedUrl("http://localhost/login"));
154154
MockHttpServletRequestBuilder loginWithRememberme = post("/login").with(rememberMeLogin());
155155
Cookie withKey = this.mvc.perform(loginWithRememberme)
156156
.andReturn()

‎config/src/test/java/org/springframework/security/config/annotation/web/configurers/RememberMeConfigurerTests.java

+2-2
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2024 the original author or authors.
2+
* Copyright 2002-2023 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -240,7 +240,7 @@ public void getWhenRememberMeCookieAndLoggedOutThenRedirectsToLogin() throws Exc
240240
.with(csrf())
241241
.cookie(expiredRememberMeCookie);
242242
// @formatter:on
243-
this.mvc.perform(expiredRequest).andExpect(redirectedUrl("/login"));
243+
this.mvc.perform(expiredRequest).andExpect(redirectedUrl("http://localhost/login"));
244244
}
245245

246246
@Test

‎config/src/test/java/org/springframework/security/config/annotation/web/configurers/RequestCacheConfigurerTests.java

+10-10
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2024 the original author or authors.
2+
* Copyright 2002-2022 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -90,7 +90,7 @@ public void getWhenBookmarkedUrlIsFaviconIcoThenPostAuthenticationRedirectsToRoo
9090
this.spring.register(RequestCacheDefaultsConfig.class, DefaultSecurityConfig.class).autowire();
9191
// @formatter:off
9292
MockHttpSession session = (MockHttpSession) this.mvc.perform(get("/favicon.ico"))
93-
.andExpect(redirectedUrl("/login"))
93+
.andExpect(redirectedUrl("http://localhost/login"))
9494
.andReturn()
9595
.getRequest()
9696
.getSession();
@@ -104,7 +104,7 @@ public void getWhenBookmarkedUrlIsFaviconPngThenPostAuthenticationRedirectsToRoo
104104
this.spring.register(RequestCacheDefaultsConfig.class, DefaultSecurityConfig.class).autowire();
105105
// @formatter:off
106106
MockHttpSession session = (MockHttpSession) this.mvc.perform(get("/favicon.png"))
107-
.andExpect(redirectedUrl("/login"))
107+
.andExpect(redirectedUrl("http://localhost/login"))
108108
.andReturn()
109109
.getRequest()
110110
.getSession();
@@ -120,7 +120,7 @@ public void getWhenBookmarkedRequestIsApplicationJsonThenPostAuthenticationRedir
120120
MockHttpServletRequestBuilder request = get("/messages").header(HttpHeaders.ACCEPT, MediaType.APPLICATION_JSON);
121121
// @formatter:off
122122
MockHttpSession session = (MockHttpSession) this.mvc.perform(request)
123-
.andExpect(redirectedUrl("/login"))
123+
.andExpect(redirectedUrl("http://localhost/login"))
124124
.andReturn()
125125
.getRequest()
126126
.getSession();
@@ -140,7 +140,7 @@ public void getWhenBookmarkedRequestIsXRequestedWithThenPostAuthenticationRedire
140140
.header("X-Requested-With", "XMLHttpRequest");
141141
MockHttpSession session = (MockHttpSession) this.mvc
142142
.perform(xRequestedWith)
143-
.andExpect(redirectedUrl("/login"))
143+
.andExpect(redirectedUrl("http://localhost/login"))
144144
.andReturn()
145145
.getRequest()
146146
.getSession();
@@ -157,7 +157,7 @@ public void getWhenBookmarkedRequestIsTextEventStreamThenPostAuthenticationRedir
157157
MediaType.TEXT_EVENT_STREAM);
158158
// @formatter:off
159159
MockHttpSession session = (MockHttpSession) this.mvc.perform(request)
160-
.andExpect(redirectedUrl("/login"))
160+
.andExpect(redirectedUrl("http://localhost/login"))
161161
.andReturn()
162162
.getRequest()
163163
.getSession();
@@ -174,7 +174,7 @@ public void getWhenBookmarkedRequestIsAllMediaTypeThenPostAuthenticationRemember
174174
MockHttpServletRequestBuilder request = get("/messages").header(HttpHeaders.ACCEPT, MediaType.ALL);
175175
// @formatter:off
176176
MockHttpSession session = (MockHttpSession) this.mvc.perform(request)
177-
.andExpect(redirectedUrl("/login"))
177+
.andExpect(redirectedUrl("http://localhost/login"))
178178
.andReturn()
179179
.getRequest()
180180
.getSession();
@@ -188,7 +188,7 @@ public void getWhenBookmarkedRequestIsTextHtmlThenPostAuthenticationRemembers()
188188
MockHttpServletRequestBuilder request = get("/messages").header(HttpHeaders.ACCEPT, MediaType.TEXT_HTML);
189189
// @formatter:off
190190
MockHttpSession session = (MockHttpSession) this.mvc.perform(request)
191-
.andExpect(redirectedUrl("/login"))
191+
.andExpect(redirectedUrl("http://localhost/login"))
192192
.andReturn()
193193
.getRequest()
194194
.getSession();
@@ -203,7 +203,7 @@ public void getWhenBookmarkedRequestIsChromeThenPostAuthenticationRemembers() th
203203
MockHttpServletRequestBuilder request = get("/messages")
204204
.header(HttpHeaders.ACCEPT, "text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8");
205205
MockHttpSession session = (MockHttpSession) this.mvc.perform(request)
206-
.andExpect(redirectedUrl("/login"))
206+
.andExpect(redirectedUrl("http://localhost/login"))
207207
.andReturn()
208208
.getRequest()
209209
.getSession();
@@ -218,7 +218,7 @@ public void getWhenBookmarkedRequestIsRequestedWithAndroidThenPostAuthentication
218218
MockHttpServletRequestBuilder request = get("/messages")
219219
.header("X-Requested-With", "com.android");
220220
MockHttpSession session = (MockHttpSession) this.mvc.perform(request)
221-
.andExpect(redirectedUrl("/login"))
221+
.andExpect(redirectedUrl("http://localhost/login"))
222222
.andReturn()
223223
.getRequest()
224224
.getSession();

‎config/src/test/java/org/springframework/security/config/annotation/web/configurers/oauth2/client/OAuth2LoginConfigurerTests.java

+7-7
Original file line numberDiff line numberDiff line change
@@ -437,7 +437,7 @@ public void oauth2LoginWithOneClientConfiguredThenRedirectForAuthorization() thr
437437
this.request = new MockHttpServletRequest("GET", requestUri);
438438
this.request.setServletPath(requestUri);
439439
this.springSecurityFilterChain.doFilter(this.request, this.response, this.filterChain);
440-
assertThat(this.response.getRedirectedUrl()).matches("/oauth2/authorization/google");
440+
assertThat(this.response.getRedirectedUrl()).matches("http://localhost/oauth2/authorization/google");
441441
}
442442

443443
// gh-6802
@@ -448,7 +448,7 @@ public void oauth2LoginWithOneClientConfiguredAndFormLoginThenRedirectDefaultLog
448448
this.request = new MockHttpServletRequest("GET", requestUri);
449449
this.request.setServletPath(requestUri);
450450
this.springSecurityFilterChain.doFilter(this.request, this.response, this.filterChain);
451-
assertThat(this.response.getRedirectedUrl()).matches("/login");
451+
assertThat(this.response.getRedirectedUrl()).matches("http://localhost/login");
452452
}
453453

454454
// gh-5347
@@ -461,7 +461,7 @@ public void oauth2LoginWithOneClientConfiguredAndRequestFaviconNotAuthenticatedT
461461
this.request.setServletPath(requestUri);
462462
this.request.addHeader(HttpHeaders.ACCEPT, new MediaType("image", "*").toString());
463463
this.springSecurityFilterChain.doFilter(this.request, this.response, this.filterChain);
464-
assertThat(this.response.getRedirectedUrl()).matches("/login");
464+
assertThat(this.response.getRedirectedUrl()).matches("http://localhost/login");
465465
}
466466

467467
// gh-5347
@@ -472,7 +472,7 @@ public void oauth2LoginWithMultipleClientsConfiguredThenRedirectDefaultLoginPage
472472
this.request = new MockHttpServletRequest("GET", requestUri);
473473
this.request.setServletPath(requestUri);
474474
this.springSecurityFilterChain.doFilter(this.request, this.response, this.filterChain);
475-
assertThat(this.response.getRedirectedUrl()).matches("/login");
475+
assertThat(this.response.getRedirectedUrl()).matches("http://localhost/login");
476476
}
477477

478478
// gh-6812
@@ -521,7 +521,7 @@ public void oauth2LoginWithOneAuthorizationCodeClientAndOtherClientsConfiguredTh
521521
this.request = new MockHttpServletRequest("GET", requestUri);
522522
this.request.setServletPath(requestUri);
523523
this.springSecurityFilterChain.doFilter(this.request, this.response, this.filterChain);
524-
assertThat(this.response.getRedirectedUrl()).matches("/oauth2/authorization/google");
524+
assertThat(this.response.getRedirectedUrl()).matches("http://localhost/oauth2/authorization/google");
525525
}
526526

527527
@Test
@@ -531,7 +531,7 @@ public void oauth2LoginWithCustomLoginPageThenRedirectCustomLoginPage() throws E
531531
this.request = new MockHttpServletRequest("GET", requestUri);
532532
this.request.setServletPath(requestUri);
533533
this.springSecurityFilterChain.doFilter(this.request, this.response, this.filterChain);
534-
assertThat(this.response.getRedirectedUrl()).matches("/custom-login");
534+
assertThat(this.response.getRedirectedUrl()).matches("http://localhost/custom-login");
535535
}
536536

537537
@Test
@@ -541,7 +541,7 @@ public void requestWhenOauth2LoginWithCustomLoginPageInLambdaThenRedirectCustomL
541541
this.request = new MockHttpServletRequest("GET", requestUri);
542542
this.request.setServletPath(requestUri);
543543
this.springSecurityFilterChain.doFilter(this.request, this.response, this.filterChain);
544-
assertThat(this.response.getRedirectedUrl()).matches("/custom-login");
544+
assertThat(this.response.getRedirectedUrl()).matches("http://localhost/custom-login");
545545
}
546546

547547
@Test

‎config/src/test/java/org/springframework/security/config/annotation/web/configurers/oauth2/server/resource/OAuth2ResourceServerConfigurerTests.java

+2-2
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2024 the original author or authors.
2+
* Copyright 2002-2022 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -1210,7 +1210,7 @@ public void requestWhenFormLoginAndResourceServerEntryPointsThenSessionCreatedBy
12101210
MvcResult result = this.mvc.perform(get("/authenticated")
12111211
.header("Accept", "text/html"))
12121212
.andExpect(status().isFound())
1213-
.andExpect(redirectedUrl("/login"))
1213+
.andExpect(redirectedUrl("http://localhost/login"))
12141214
.andReturn();
12151215
// @formatter:on
12161216
assertThat(result.getRequest().getSession(false)).isNotNull();

‎config/src/test/java/org/springframework/security/config/annotation/web/configurers/saml2/Saml2LoginConfigurerTests.java

+3-4
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2024 the original author or authors.
2+
* Copyright 2002-2022 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -412,11 +412,10 @@ public void getFaviconWhenDefaultConfigurationThenDoesNotSaveAuthnRequest() thro
412412
this.spring.register(Saml2LoginConfig.class).autowire();
413413
this.mvc.perform(get("/favicon.ico").accept(MediaType.TEXT_HTML))
414414
.andExpect(status().isFound())
415-
.andExpect(redirectedUrl("/login"));
415+
.andExpect(redirectedUrl("http://localhost/login"));
416416
this.mvc.perform(get("/").accept(MediaType.TEXT_HTML))
417417
.andExpect(status().isFound())
418-
.andExpect(header().string("Location", startsWith("/saml2/authenticate")));
419-
418+
.andExpect(header().string("Location", startsWith("http://localhost/saml2/authenticate")));
420419
}
421420

422421
@Test

‎config/src/test/java/org/springframework/security/config/http/CsrfConfigTests.java

+5-3
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2024 the original author or authors.
2+
* Copyright 2002-2022 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -342,7 +342,7 @@ public void postWhenHasCsrfTokenButSessionExpiresThenRequestIsCancelledAfterSucc
342342
this.spring.configLocations(this.xml("CsrfEnabled")).autowire();
343343
// simulates a request that has no authentication (e.g. session time-out)
344344
MvcResult result = this.mvc.perform(post("/authenticated").with(csrf()))
345-
.andExpect(redirectedUrl("/login"))
345+
.andExpect(redirectedUrl("http://localhost/login"))
346346
.andReturn();
347347
MockHttpSession session = (MockHttpSession) result.getRequest().getSession();
348348
// if the request cache is consulted, then it will redirect back to /some-url,
@@ -363,7 +363,9 @@ public void getWhenHasCsrfTokenButSessionExpiresThenRequestIsRememeberedAfterSuc
363363
throws Exception {
364364
this.spring.configLocations(this.xml("CsrfEnabled")).autowire();
365365
// simulates a request that has no authentication (e.g. session time-out)
366-
MvcResult result = this.mvc.perform(get("/authenticated")).andExpect(redirectedUrl("/login")).andReturn();
366+
MvcResult result = this.mvc.perform(get("/authenticated"))
367+
.andExpect(redirectedUrl("http://localhost/login"))
368+
.andReturn();
367369
MockHttpSession session = (MockHttpSession) result.getRequest().getSession();
368370
// if the request cache is consulted, then it will redirect back to /some-url,
369371
// which we do want

0 commit comments

Comments
 (0)