root
/
spring-boot
mirror of https://github.com/spring-projects/spring-boot.git
1
0
Fork 0
Code Issues Actions 4 Packages Projects Releases Wiki Activity

Add StaticResourceRequest for WebFlux Security 

Closes gh-11040
This commit is contained in:
Madhura Bhave 2018-01-20 09:41:38 +05:30
parent 5e2cc02499
commit d9ff51ccd3
11 changed files with 400 additions and 69 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

64
spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/security/StaticResourceLocation.java Normal file
View File

@ -0,0 +1,64 @@
/*
* Copyright 2012-2017 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.springframework.boot.autoconfigure.security;
import java.util.Arrays;
import java.util.stream.Stream;
/**
* Common locations for static resources.
*
* @author Phillip Webb
*/
public enum StaticResourceLocation {
/**
* Resources under {@code "/css"}.
*/
CSS("/css/**"),
/**
* Resources under {@code "/js"}.
*/
JAVA_SCRIPT("/js/**"),
/**
* Resources under {@code "/images"}.
*/
IMAGES("/images/**"),
/**
* Resources under {@code "/webjars"}.
*/
WEB_JARS("/webjars/**"),
/**
* The {@code "favicon.ico"} resource.
*/
FAVICON("/**/favicon.ico");
private String[] patterns;
StaticResourceLocation(String... patterns) {
this.patterns = patterns;
}
public Stream<String> getPatterns() {
return Arrays.stream(this.patterns);
}
}

139
spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/security/reactive/StaticResourceRequest.java Normal file
View File

@ -0,0 +1,139 @@
/*
* Copyright 2012-2018 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.springframework.boot.autoconfigure.security.reactive;
import java.util.EnumSet;
import java.util.LinkedHashSet;
import java.util.List;
import java.util.Set;
import java.util.stream.Collectors;
import java.util.stream.Stream;
import reactor.core.publisher.Mono;
import org.springframework.boot.autoconfigure.security.StaticResourceLocation;
import org.springframework.security.web.server.util.matcher.OrServerWebExchangeMatcher;
import org.springframework.security.web.server.util.matcher.PathPatternParserServerWebExchangeMatcher;
import org.springframework.security.web.server.util.matcher.ServerWebExchangeMatcher;
import org.springframework.util.Assert;
import org.springframework.web.server.ServerWebExchange;
/**
* Factory that can be used to create a {@link ServerWebExchangeMatcher} for static resources in
* commonly used locations.
*
* @author Madhura Bhave
* @since 2.0.0
*/
public final class StaticResourceRequest {
private StaticResourceRequest() {
}
/**
* Returns a matcher that includes all commonly used {@link StaticResourceLocation Locations}. The
* {@link StaticResourceServerWebExchange#excluding(StaticResourceLocation, StaticResourceLocation...) excluding}
* method can be used to remove specific locations if required. For example:
* <pre class="code">
* StaticResourceRequest.toCommonLocations().excluding(StaticResourceLocation.CSS)
* </pre>
* @return the configured {@link ServerWebExchangeMatcher}
*/
public static StaticResourceServerWebExchange toCommonLocations() {
return to(EnumSet.allOf(StaticResourceLocation.class));
}
/**
* Returns a matcher that includes the specified {@link StaticResourceLocation Locations}. For
* example: <pre class="code">
* to(StaticResourceLocation.CSS, StaticResourceLocation.JAVA_SCRIPT)
* </pre>
* @param first the first location to include
* @param rest additional locations to include
* @return the configured {@link ServerWebExchangeMatcher}
*/
public static StaticResourceServerWebExchange to(StaticResourceLocation first, StaticResourceLocation... rest) {
return to(EnumSet.of(first, rest));
}
/**
* Returns a matcher that includes the specified {@link StaticResourceLocation Locations}. For
* example: <pre class="code">
* to(locations)
* </pre>
* @param locations the locations to include
* @return the configured {@link ServerWebExchangeMatcher}
*/
public static StaticResourceServerWebExchange to(Set<StaticResourceLocation> locations) {
Assert.notNull(locations, "Locations must not be null");
return new StaticResourceServerWebExchange(new LinkedHashSet<>(locations));
}
/**
* The server web exchange matcher used to match against resource {@link StaticResourceLocation Locations}.
*/
public final static class StaticResourceServerWebExchange
implements ServerWebExchangeMatcher {
private final Set<StaticResourceLocation> locations;
private StaticResourceServerWebExchange(Set<StaticResourceLocation> locations) {
this.locations = locations;
}
/**
* Return a new {@link StaticResourceServerWebExchange} based on this one but
* excluding the specified locations.
* @param first the first location to exclude
* @param rest additional locations to exclude
* @return a new {@link StaticResourceServerWebExchange}
*/
public StaticResourceServerWebExchange excluding(StaticResourceLocation first, StaticResourceLocation... rest) {
return excluding(EnumSet.of(first, rest));
}
/**
* Return a new {@link StaticResourceServerWebExchange} based on this one but
* excluding the specified locations.
* @param locations the locations to exclude
* @return a new {@link StaticResourceServerWebExchange}
*/
public StaticResourceServerWebExchange excluding(Set<StaticResourceLocation> locations) {
Assert.notNull(locations, "Locations must not be null");
Set<StaticResourceLocation> subset = new LinkedHashSet<>(this.locations);
subset.removeAll(locations);
return new StaticResourceServerWebExchange(subset);
}
private List<ServerWebExchangeMatcher> getDelegateMatchers() {
return getPatterns().map(PathPatternParserServerWebExchangeMatcher::new)
.collect(Collectors.toList());
}
private Stream<String> getPatterns() {
return this.locations.stream().flatMap(StaticResourceLocation::getPatterns);
}
@Override
public Mono<MatchResult> matches(ServerWebExchange exchange) {
OrServerWebExchangeMatcher matcher = new OrServerWebExchangeMatcher(getDelegateMatchers());
return matcher.matches(exchange);
}
}
}

73
spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/security/servlet/StaticResourceRequest.java
View File

@ -16,7 +16,6 @@
package org.springframework.boot.autoconfigure.security.servlet;
import java.util.Arrays;
import java.util.EnumSet;
import java.util.LinkedHashSet;
import java.util.List;
@ -26,6 +25,7 @@ import java.util.stream.Stream;
import javax.servlet.http.HttpServletRequest;
import org.springframework.boot.autoconfigure.security.StaticResourceLocation;
import org.springframework.boot.autoconfigure.web.ServerProperties;
import org.springframework.boot.security.servlet.ApplicationContextRequestMatcher;
import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
@ -47,94 +47,55 @@ public final class StaticResourceRequest {
}
/**
* Returns a matcher that includes all commonly used {@link Location Locations}. The
* {@link StaticResourceRequestMatcher#excluding(Location, Location...) excluding}
* Returns a matcher that includes all commonly used {@link StaticResourceLocation Locations}. The
* {@link StaticResourceRequestMatcher#excluding(StaticResourceLocation, StaticResourceLocation...) excluding}
* method can be used to remove specific locations if required. For example:
* <pre class="code">
* StaticResourceRequest.toCommonLocations().excluding(Location.CSS)
* StaticResourceRequest.toCommonLocations().excluding(StaticResourceLocation.CSS)
* </pre>
* @return the configured {@link RequestMatcher}
*/
public static StaticResourceRequestMatcher toCommonLocations() {
return to(EnumSet.allOf(Location.class));
return to(EnumSet.allOf(StaticResourceLocation.class));
}
/**
* Returns a matcher that includes the specified {@link Location Locations}. For
* Returns a matcher that includes the specified {@link StaticResourceLocation Locations}. For
* example: <pre class="code">
* StaticResourceRequest.to(Location.CSS, Location.JAVA_SCRIPT)
* StaticResourceRequest.to(StaticResourceLocation.CSS, StaticResourceLocation.JAVA_SCRIPT)
* </pre>
* @param first the first location to include
* @param rest additional locations to include
* @return the configured {@link RequestMatcher}
*/
public static StaticResourceRequestMatcher to(Location first, Location... rest) {
public static StaticResourceRequestMatcher to(StaticResourceLocation first, StaticResourceLocation... rest) {
return to(EnumSet.of(first, rest));
}
/**
* Returns a matcher that includes the specified {@link Location Locations}. For
* Returns a matcher that includes the specified {@link StaticResourceLocation Locations}. For
* example: <pre class="code">
* StaticResourceRequest.to(locations)
* </pre>
* @param locations the locations to include
* @return the configured {@link RequestMatcher}
*/
public static StaticResourceRequestMatcher to(Set<Location> locations) {
public static StaticResourceRequestMatcher to(Set<StaticResourceLocation> locations) {
Assert.notNull(locations, "Locations must not be null");
return new StaticResourceRequestMatcher(new LinkedHashSet<>(locations));
}
public enum Location {
/**
* Resources under {@code "/css"}.
*/
CSS("/css/**"),
/**
* Resources under {@code "/js"}.
*/
JAVA_SCRIPT("/js/**"),
/**
* Resources under {@code "/images"}.
*/
IMAGES("/images/**"),
/**
* Resources under {@code "/webjars"}.
*/
WEB_JARS("/webjars/**"),
/**
* The {@code "favicon.ico"} resource.
*/
FAVICON("/**/favicon.ico");
private String[] patterns;
Location(String... patterns) {
this.patterns = patterns;
}
Stream<String> getPatterns() {
return Arrays.stream(this.patterns);
}
}
/**
* The request matcher used to match against resource {@link Location Locations}.
* The request matcher used to match against resource {@link StaticResourceLocation Locations}.
*/
public static final class StaticResourceRequestMatcher
extends ApplicationContextRequestMatcher<ServerProperties> {
private final Set<Location> locations;
private final Set<StaticResourceLocation> locations;
private RequestMatcher delegate;
private StaticResourceRequestMatcher(Set<Location> locations) {
private StaticResourceRequestMatcher(Set<StaticResourceLocation> locations) {
super(ServerProperties.class);
this.locations = locations;
}
@ -146,7 +107,7 @@ public final class StaticResourceRequest {
* @param rest additional locations to exclude
* @return a new {@link StaticResourceRequestMatcher}
*/
public StaticResourceRequestMatcher excluding(Location first, Location... rest) {
public StaticResourceRequestMatcher excluding(StaticResourceLocation first, StaticResourceLocation... rest) {
return excluding(EnumSet.of(first, rest));
}
@ -156,9 +117,9 @@ public final class StaticResourceRequest {
* @param locations the locations to exclude
* @return a new {@link StaticResourceRequestMatcher}
*/
public StaticResourceRequestMatcher excluding(Set<Location> locations) {
public StaticResourceRequestMatcher excluding(Set<StaticResourceLocation> locations) {
Assert.notNull(locations, "Locations must not be null");
Set<Location> subset = new LinkedHashSet<>(this.locations);
Set<StaticResourceLocation> subset = new LinkedHashSet<>(this.locations);
subset.removeAll(locations);
return new StaticResourceRequestMatcher(subset);
}
@ -175,7 +136,7 @@ public final class StaticResourceRequest {
}
private Stream<String> getPatterns(ServerProperties serverProperties) {
return this.locations.stream().flatMap(Location::getPatterns)
return this.locations.stream().flatMap(StaticResourceLocation::getPatterns)
.map(serverProperties.getServlet()::getPath);
}

152
spring-boot-project/spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/security/reactive/StaticResourceRequestTests.java Normal file
View File

@ -0,0 +1,152 @@
/*
* Copyright 2012-2018 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.springframework.boot.autoconfigure.security.reactive;
import org.assertj.core.api.AssertDelegateTarget;
import org.junit.Rule;
import org.junit.Test;
import org.junit.rules.ExpectedException;
import org.springframework.boot.autoconfigure.security.StaticResourceLocation;
import org.springframework.boot.autoconfigure.web.ServerProperties;
import org.springframework.context.support.StaticApplicationContext;
import org.springframework.http.server.reactive.ServerHttpRequest;
import org.springframework.http.server.reactive.ServerHttpResponse;
import org.springframework.mock.http.server.reactive.MockServerHttpRequest;
import org.springframework.mock.http.server.reactive.MockServerHttpResponse;
import org.springframework.security.web.server.util.matcher.ServerWebExchangeMatcher;
import org.springframework.web.context.support.StaticWebApplicationContext;
import org.springframework.web.server.ServerWebExchange;
import org.springframework.web.server.WebHandler;
import org.springframework.web.server.adapter.HttpWebHandlerAdapter;
import static org.assertj.core.api.Assertions.assertThat;
import static org.mockito.Mockito.mock;
/**
* Tests for {@link StaticResourceRequest}.
*
* @author Madhura Bhave
*/
public class StaticResourceRequestTests {
@Rule
public ExpectedException thrown = ExpectedException.none();
@Test
public void toCommonLocationsShouldMatchCommonLocations() {
ServerWebExchangeMatcher matcher = StaticResourceRequest.toCommonLocations();
assertMatcher(matcher).matches("/css/file.css");
assertMatcher(matcher).matches("/js/file.js");
assertMatcher(matcher).matches("/images/file.css");
assertMatcher(matcher).matches("/webjars/file.css");
assertMatcher(matcher).matches("/foo/favicon.ico");
assertMatcher(matcher).doesNotMatch("/bar");
}
@Test
public void toCommonLocationsWithExcludeShouldNotMatchExcluded() {
ServerWebExchangeMatcher matcher = StaticResourceRequest.toCommonLocations()
.excluding(StaticResourceLocation.CSS);
assertMatcher(matcher).doesNotMatch("/css/file.css");
assertMatcher(matcher).matches("/js/file.js");
}
@Test
public void toLocationShouldMatchLocation() {
ServerWebExchangeMatcher matcher = StaticResourceRequest.to(StaticResourceLocation.CSS);
assertMatcher(matcher).matches("/css/file.css");
assertMatcher(matcher).doesNotMatch("/js/file.js");
}
@Test
public void toLocationsFromSetWhenSetIsNullShouldThrowException() {
this.thrown.expect(IllegalArgumentException.class);
this.thrown.expectMessage("Locations must not be null");
StaticResourceRequest.to(null);
}
@Test
public void excludeFromSetWhenSetIsNullShouldThrowException() {
this.thrown.expect(IllegalArgumentException.class);
this.thrown.expectMessage("Locations must not be null");
StaticResourceRequest.toCommonLocations().excluding(null);
}
private StaticResourceRequestTests.RequestMatcherAssert assertMatcher(ServerWebExchangeMatcher matcher) {
StaticWebApplicationContext context = new StaticWebApplicationContext();
context.registerBean(ServerProperties.class);
return assertThat(new StaticResourceRequestTests.RequestMatcherAssert(context, matcher));
}
private static class RequestMatcherAssert implements AssertDelegateTarget {
private final StaticApplicationContext context;
private final ServerWebExchangeMatcher matcher;
RequestMatcherAssert(StaticApplicationContext context, ServerWebExchangeMatcher matcher) {
this.context = context;
this.matcher = matcher;
}
void matches(String path) {
ServerWebExchange exchange = webHandler().createExchange(MockServerHttpRequest.get(path).build(), new MockServerHttpResponse());
matches(exchange);
}
private void matches(ServerWebExchange exchange) {
assertThat(this.matcher.matches(exchange).block().isMatch())
.as("Matches " + getRequestPath(exchange)).isTrue();
}
void doesNotMatch(String path) {
ServerWebExchange exchange = webHandler().createExchange(MockServerHttpRequest.get(path).build(), new MockServerHttpResponse());
doesNotMatch(exchange);
}
private void doesNotMatch(ServerWebExchange exchange) {
assertThat(this.matcher.matches(exchange).block().isMatch())
.as("Does not match " + getRequestPath(exchange)).isFalse();
}
private TestHttpWebHandlerAdapter webHandler() {
TestHttpWebHandlerAdapter adapter = new TestHttpWebHandlerAdapter(mock(WebHandler.class));
adapter.setApplicationContext(this.context);
return adapter;
}
private String getRequestPath(ServerWebExchange exchange) {
return exchange.getRequest().getPath().toString();
}
}
private static class TestHttpWebHandlerAdapter extends HttpWebHandlerAdapter {
TestHttpWebHandlerAdapter(WebHandler delegate) {
super(delegate);
}
@Override
protected ServerWebExchange createExchange(ServerHttpRequest request, ServerHttpResponse response) {
return super.createExchange(request, response);
}
}
}

1
spring-boot-project/spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/security/servlet/AuthenticationManagerConfigurationTests.java
View File

@ -19,7 +19,6 @@ package org.springframework.boot.autoconfigure.security.servlet;
import org.junit.Test;
import org.springframework.boot.autoconfigure.security.SecurityProperties;
import org.springframework.boot.autoconfigure.security.servlet.AuthenticationManagerConfiguration;
import org.springframework.boot.context.properties.EnableConfigurationProperties;
import org.springframework.boot.test.context.runner.ApplicationContextRunner;
import org.springframework.context.annotation.Bean;

2
spring-boot-project/spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/security/servlet/SecurityAutoConfigurationTests.java
View File

@ -30,8 +30,6 @@ import org.springframework.boot.autoconfigure.context.PropertyPlaceholderAutoCon
import org.springframework.boot.autoconfigure.jdbc.DataSourceAutoConfiguration;
import org.springframework.boot.autoconfigure.orm.jpa.HibernateJpaAutoConfiguration;
import org.springframework.boot.autoconfigure.orm.jpa.test.City;
import org.springframework.boot.autoconfigure.security.servlet.SecurityAutoConfiguration;
import org.springframework.boot.autoconfigure.security.servlet.SecurityFilterAutoConfiguration;
import org.springframework.boot.test.rule.OutputCapture;
import org.springframework.boot.test.util.TestPropertyValues;
import org.springframework.boot.web.servlet.DelegatingFilterProxyRegistrationBean;

2
spring-boot-project/spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/security/servlet/SecurityFilterAutoConfigurationEarlyInitializationTests.java
View File

@ -28,8 +28,6 @@ import org.springframework.boot.autoconfigure.ImportAutoConfiguration;
import org.springframework.boot.autoconfigure.context.PropertyPlaceholderAutoConfiguration;
import org.springframework.boot.autoconfigure.http.HttpMessageConvertersAutoConfiguration;
import org.springframework.boot.autoconfigure.jackson.JacksonAutoConfiguration;
import org.springframework.boot.autoconfigure.security.servlet.SecurityAutoConfiguration;
import org.springframework.boot.autoconfigure.security.servlet.SecurityFilterAutoConfiguration;
import org.springframework.boot.autoconfigure.web.servlet.DispatcherServletAutoConfiguration;
import org.springframework.boot.autoconfigure.web.servlet.WebMvcAutoConfiguration;
import org.springframework.boot.test.rule.OutputCapture;

13
spring-boot-project/spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/security/servlet/StaticResourceRequestTests.java
View File

@ -25,8 +25,7 @@ import org.junit.Rule;
import org.junit.Test;
import org.junit.rules.ExpectedException;
import org.springframework.boot.autoconfigure.security.servlet.StaticResourceRequest;
import org.springframework.boot.autoconfigure.security.servlet.StaticResourceRequest.Location;
import org.springframework.boot.autoconfigure.security.StaticResourceLocation;
import org.springframework.boot.autoconfigure.web.ServerProperties;
import org.springframework.mock.web.MockHttpServletRequest;
import org.springframework.mock.web.MockServletContext;
@ -61,14 +60,14 @@ public class StaticResourceRequestTests {
@Test
public void toCommonLocationsWithExcludeShouldNotMatchExcluded() {
RequestMatcher matcher = StaticResourceRequest.toCommonLocations()
.excluding(Location.CSS);
.excluding(StaticResourceLocation.CSS);
assertMatcher(matcher).doesNotMatch("/css/file.css");
assertMatcher(matcher).matches("/js/file.js");
}
@Test
public void toLocationShouldMatchLocation() {
RequestMatcher matcher = StaticResourceRequest.to(Location.CSS);
RequestMatcher matcher = StaticResourceRequest.to(StaticResourceLocation.CSS);
assertMatcher(matcher).matches("/css/file.css");
assertMatcher(matcher).doesNotMatch("/js/file.js");
}
@ -77,7 +76,7 @@ public class StaticResourceRequestTests {
public void toLocationWhenHasServletPathShouldMatchLocation() {
ServerProperties serverProperties = new ServerProperties();
serverProperties.getServlet().setPath("/foo");
RequestMatcher matcher = StaticResourceRequest.to(Location.CSS);
RequestMatcher matcher = StaticResourceRequest.to(StaticResourceLocation.CSS);
assertMatcher(matcher, serverProperties).matches("/foo", "/css/file.css");
assertMatcher(matcher, serverProperties).doesNotMatch("/foo", "/js/file.js");
}
@ -86,14 +85,14 @@ public class StaticResourceRequestTests {
public void toLocationsFromSetWhenSetIsNullShouldThrowException() {
this.thrown.expect(IllegalArgumentException.class);
this.thrown.expectMessage("Locations must not be null");
StaticResourceRequest.to((Set<Location>) null);
StaticResourceRequest.to((Set<StaticResourceLocation>) null);
}
@Test
public void excludeFromSetWhenSetIsNullShouldThrowException() {
this.thrown.expect(IllegalArgumentException.class);
this.thrown.expectMessage("Locations must not be null");
StaticResourceRequest.toCommonLocations().excluding((Set<Location>) null);
StaticResourceRequest.toCommonLocations().excluding((Set<StaticResourceLocation>) null);
}
private RequestMatcherAssert assertMatcher(RequestMatcher matcher) {

2
spring-boot-project/spring-boot-docs/src/main/asciidoc/spring-boot-features.adoc
View File

@ -2981,6 +2981,8 @@ Boot provides convenience methods that can be used to override access rules for
endpoints and static resources. `EndpointRequest` can be used to create a `ServerWebExchangeMatcher`
that is based on the `management.endpoints.web.base-path` property.
`StaticResourceRequest` can be used to create a `ServerWebExchangeMatcher` for static resources in
commonly used locations.
[[boot-features-security-oauth2]]

11
spring-boot-samples/spring-boot-sample-secure-webflux/src/main/resources/static/css/bootstrap.min.css vendored Normal file
View File

File diff suppressed because one or more lines are too long

10
spring-boot-samples/spring-boot-sample-secure-webflux/src/test/java/sample/secure/webflux/SampleSecureWebFluxCustomSecurityTests.java
View File

@ -23,6 +23,7 @@ import org.junit.runner.RunWith;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.boot.actuate.autoconfigure.security.reactive.EndpointRequest;
import org.springframework.boot.autoconfigure.security.reactive.StaticResourceRequest;
import org.springframework.boot.test.context.SpringBootTest;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
@ -77,6 +78,12 @@ public class SampleSecureWebFluxCustomSecurityTests {
.expectStatus().isOk();
}
@Test
public void staticResourceShouldBeAccessible() {
this.webClient.get().uri("/css/bootstrap.min.css").accept(MediaType.APPLICATION_JSON).exchange()
.expectStatus().isOk();
}
@Configuration
static class SecurityConfiguration {
@ -93,7 +100,8 @@ public class SampleSecureWebFluxCustomSecurityTests {
SecurityWebFilterChain springSecurityFilterChain(ServerHttpSecurity http) {
http.authorizeExchange().matchers(EndpointRequest.to("health", "info"))
.permitAll().matchers(EndpointRequest.toAnyEndpoint())
.hasRole("ACTUATOR").pathMatchers("/login").permitAll().anyExchange()
.hasRole("ACTUATOR").matchers(StaticResourceRequest.toCommonLocations()).permitAll()
.pathMatchers("/login").permitAll().anyExchange()
.authenticated().and().httpBasic();
return http.build();
}