ALOM - TP 7 - Security

<form action="https://bank.example.com/transfer" method="post">
<input type="hidden"
    name="amount"
    value="100.00"/>
<input type="hidden"
    name="account"
    value="evilsAccountNumber"/>
<input type="submit"
    value="Win Money!"/>
</form>

POST /transfer HTTP/1.1
Host: bank.example.com
Content-Type: application/x-www-form-urlencoded

amount=100.00&account=9876

POST /transfer HTTP/1.1
Host: bank.example.com
Content-Type: application/x-www-form-urlencoded

amount=100.00&account=9876&_csrf=<secure-random>

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
@Configuration (1)
public class SecurityConfig {

    @Bean
    SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http.csrf(csrf -> csrf.disable()); (2)
        http.authorizeHttpRequests(authorize -> {
            authorize.anyRequest().authenticated(); (3)
          }
        );
        http.httpBasic(Customizer.withDefaults()); (4)
        return http.build();
    }
}

trainer.service.url=http://localhost:8081
trainer.service.username=user
trainer.service.password=<votre password>

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
package fr.univ_lille.alom.game_ui.config;

import fr.univ_lille.alom.game_ui.trainers.Trainer;
import fr.univ_lille.alom.game_ui.trainers.TrainerService;
import org.junit.jupiter.api.Test;
import org.springframework.security.authentication.BadCredentialsException;
import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.authority.SimpleGrantedAuthority;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;

import static org.junit.jupiter.api.Assertions.*;
import static org.mockito.Mockito.*;

@ExtendWith(MockitoExtension.class)
class SecurityConfigTest {

    @InjectMocks
    private SecurityConfig securityConfig;

    @Mock
    private TrainerService trainerService;

    @Test
    void passwordEncoder_shouldBeBCryptPasswordEncoder() {
        var passwordEncoder = securityConfig.passwordEncoder();
        assertNotNull(passwordEncoder);
        assertEquals(BCryptPasswordEncoder.class, passwordEncoder.getClass());
    }

    @Test
    void userDetailsService_shouldUseTrainerService() {
        var trainer = new Trainer();
        trainer.setName("Garry");
        trainer.setPassword("secret");
        when(trainerService.getTrainer("Garry")).thenReturn(trainer);

        securityConfig.setTrainerService(trainerService);

        var userDetailsService = securityConfig.userDetailsService();

        var garry = userDetailsService.loadUserByUsername("Garry");

        // mock should be called
        verify(trainerService).getTrainer("Garry");

        assertNotNull(garry);
        assertEquals("Garry", garry.getUsername());
        assertEquals("secret", garry.getPassword());
        assertTrue(garry.getAuthorities().contains(new SimpleGrantedAuthority("ROLE_USER")));
    }

    @Test
    void userDetailsService_shouldThrowABadCredentialsException_whenUserDoesntExists() {
        // the mock returns null

        var userDetailsService = securityConfig.userDetailsService();

        var exception = assertThrows(BadCredentialsException.class, () -> userDetailsService.loadUserByUsername("Garry"));
        assertEquals("No such user", exception.getMessage());

        // mock should be called
        verify(trainerService).getTrainer("Garry");
    }

}

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
package com.miage.alom.tp.game_ui.config;

(1)
public class SecurityConfig {

    (2)

     (3) (5)
    PasswordEncoder passwordEncoder(){
    }

     (4) (5)
    public UserDetailsService userDetailsService() {
    }
}

spring.mustache.servlet.expose-request-attributes=true

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
<nav class="navbar navbar-expand-lg navbar-light bg-light">

    <ul class="navbar-nav mr-auto">
        <li class="nav-item">
            <a class="nav-link" href="pokedex">
                <img src="/icons/pokedex.png" width="30" height="30" class="d-inline-block align-top" alt="">
                Pokedex
            </a>
        </li>
        <li class="nav-item">
            <a class="nav-link" href="trainers">
                <img src="/icons/player.png" width="30" height="30" class="d-inline-block align-top" alt="">
                Trainers
            </a>
        </li>
    </ul>

    {{#connectedTrainer}}
    <span class="navbar-text mr-md-3">Welcome {{name}}</span>
    <ul class="navbar-nav">
        <li class="nav-item">
            <a class="nav-link" href="profile">
                <img src="/icons/player.png" width="30" height="30" class="d-inline-block align-top" alt="">
                My Profile
            </a>
        </li>
    </ul>
    <form class="form-inline" action="/logout" method="post">
        <input type="submit" class="btn btn-outline-warning my-2 my-sm-0" value="Sign Out"/>
        <input type="hidden" name="{{_csrf.parameterName}}" value="{{_csrf.token}}"/>
    </form>
    {{/connectedTrainer}}
</nav>