Skip to content

Commit 0ea9851

Browse files
arun-guptaarun-gupta
committed
Adding a new sample/test for http-omission
1 parent 2a39cb8 commit 0ea9851

File tree

7 files changed

+386
-0
lines changed

7 files changed

+386
-0
lines changed

‎servlet/pom.xml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,5 +30,8 @@
3030
<module>security-form-based</module>
3131
<module>security-programmatic</module>
3232
<module>security-deny-uncovered</module>
33+
<!-- <module>security-annotated</module>
34+
<module>security-digest</module>-->
35+
<module>security-basicauth-omission</module>
3336
</modules>
3437
</project>

‎servlet/security-basicauth-omission/pom.xml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
3+
<modelVersion>4.0.0</modelVersion>
4+
<parent>
5+
<groupId>org.javaee7.servlet</groupId>
6+
<artifactId>servlet-samples</artifactId>
7+
<version>1.0-SNAPSHOT</version>
8+
<relativePath>../pom.xml</relativePath>
9+
</parent>
10+
11+
<artifactId>security-basicauth-omission</artifactId>
12+
<packaging>war</packaging>
13+
</project>

‎servlet/security-basicauth-omission/src/main/java/org/javaee7/servlet/security/basicauth/omission/SecureServlet.java‎

Lines changed: 119 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,119 @@
1+
/*
2+
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS HEADER.
3+
*
4+
* Copyright (c) 2013 Oracle and/or its affiliates. All rights reserved.
5+
*
6+
* The contents of this file are subject to the terms of either the GNU
7+
* General Public License Version 2 only ("GPL") or the Common Development
8+
* and Distribution License("CDDL") (collectively, the "License"). You
9+
* may not use this file except in compliance with the License. You can
10+
* obtain a copy of the License at
11+
* https://glassfish.dev.java.net/public/CDDL+GPL_1_1.html
12+
* or packager/legal/LICENSE.txt. See the License for the specific
13+
* language governing permissions and limitations under the License.
14+
*
15+
* When distributing the software, include this License Header Notice in each
16+
* file and include the License file at packager/legal/LICENSE.txt.
17+
*
18+
* GPL Classpath Exception:
19+
* Oracle designates this particular file as subject to the "Classpath"
20+
* exception as provided by Oracle in the GPL Version 2 section of the License
21+
* file that accompanied this code.
22+
*
23+
* Modifications:
24+
* If applicable, add the following below the License Header, with the fields
25+
* enclosed by brackets [] replaced by your own identifying information:
26+
* "Portions Copyright [year] [name of copyright owner]"
27+
*
28+
* Contributor(s):
29+
* If you wish your version of this file to be governed by only the CDDL or
30+
* only the GPL Version 2, indicate your decision by adding "[Contributor]
31+
* elects to include this software in this distribution under the [CDDL or GPL
32+
* Version 2] license." If you don't indicate a single choice of license, a
33+
* recipient has the option to distribute your version of this file under
34+
* either the CDDL, the GPL Version 2 or to extend the choice of license to
35+
* its licensees as provided above. However, if you add GPL Version 2 code
36+
* and therefore, elected the GPL Version 2 license, then the option applies
37+
* only if the new code is made subject to such option by the copyright
38+
* holder.
39+
*/
40+
package org.javaee7.servlet.security.basicauth.omission;
41+
42+
import java.io.IOException;
43+
import java.io.PrintWriter;
44+
import javax.servlet.ServletException;
45+
import javax.servlet.annotation.WebServlet;
46+
import javax.servlet.http.HttpServlet;
47+
import javax.servlet.http.HttpServletRequest;
48+
import javax.servlet.http.HttpServletResponse;
49+
50+
/**
51+
* @author Arun Gupta
52+
*/
53+
@WebServlet(urlPatterns = {"/SecureServlet"})
54+
public class SecureServlet extends HttpServlet {
55+
56+
/**
57+
* Processes requests for both HTTP <code>GET</code> and <code>POST</code>
58+
* methods.
59+
*
60+
* @param request servlet request
61+
* @param response servlet response
62+
* @throws ServletException if a servlet-specific error occurs
63+
* @throws IOException if an I/O error occurs
64+
*/
65+
protected void processRequest(HttpServletRequest request, HttpServletResponse response, String method)
66+
throws ServletException, IOException {
67+
response.setContentType("text/html;charset=UTF-8");
68+
PrintWriter out = response.getWriter();
69+
out.println("<!DOCTYPE html>");
70+
out.println("<html>");
71+
out.println("<head>");
72+
out.println("<title>Servlet Security - Basic Auth with File-base Realm</title>");
73+
out.println("</head>");
74+
out.println("<body>");
75+
out.println("<h1>Basic Auth with File-base Realm (" + method + ")</h1>");
76+
out.println("<h2>Were you prompted for username/password ?</h2>");
77+
out.println("</body>");
78+
out.println("</html>");
79+
}
80+
81+
// <editor-fold defaultstate="collapsed" desc="HttpServlet methods. Click on the + sign on the left to edit the code.">
82+
/**
83+
* Handles the HTTP <code>GET</code> method.
84+
*
85+
* @param request servlet request
86+
* @param response servlet response
87+
* @throws ServletException if a servlet-specific error occurs
88+
* @throws IOException if an I/O error occurs
89+
*/
90+
@Override
91+
protected void doGet(HttpServletRequest request, HttpServletResponse response)
92+
throws ServletException, IOException {
93+
processRequest(request, response, "GET");
94+
}
95+
96+
/**
97+
* Handles the HTTP <code>POST</code> method.
98+
*
99+
* @param request servlet request
100+
* @param response servlet response
101+
* @throws ServletException if a servlet-specific error occurs
102+
* @throws IOException if an I/O error occurs
103+
*/
104+
@Override
105+
protected void doPost(HttpServletRequest request, HttpServletResponse response)
106+
throws ServletException, IOException {
107+
processRequest(request, response, "POST");
108+
}
109+
110+
/**
111+
* Returns a short description of the servlet.
112+
*
113+
* @return a String containing servlet description
114+
*/
115+
@Override
116+
public String getServletInfo() {
117+
return "Short description";
118+
}// </editor-fold>
119+
}

‎servlet/security-basicauth-omission/src/main/webapp/WEB-INF/glassfish-web.xml‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<!--
3+
/*
4+
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS HEADER.
5+
*
6+
* Copyright (c) 2013 Oracle and/or its affiliates. All rights reserved.
7+
*
8+
* The contents of this file are subject to the terms of either the GNU
9+
* General Public License Version 2 only ("GPL") or the Common Development
10+
* and Distribution License("CDDL") (collectively, the "License"). You
11+
* may not use this file except in compliance with the License. You can
12+
* obtain a copy of the License at
13+
* https://glassfish.dev.java.net/public/CDDL+GPL_1_1.html
14+
* or packager/legal/LICENSE.txt. See the License for the specific
15+
* language governing permissions and limitations under the License.
16+
*
17+
* When distributing the software, include this License Header Notice in each
18+
* file and include the License file at packager/legal/LICENSE.txt.
19+
*
20+
* GPL Classpath Exception:
21+
* Oracle designates this particular file as subject to the "Classpath"
22+
* exception as provided by Oracle in the GPL Version 2 section of the License
23+
* file that accompanied this code.
24+
*
25+
* Modifications:
26+
* If applicable, add the following below the License Header, with the fields
27+
* enclosed by brackets [] replaced by your own identifying information:
28+
* "Portions Copyright [year] [name of copyright owner]"
29+
*
30+
* Contributor(s):
31+
* If you wish your version of this file to be governed by only the CDDL or
32+
* only the GPL Version 2, indicate your decision by adding "[Contributor]
33+
* elects to include this software in this distribution under the [CDDL or GPL
34+
* Version 2] license." If you don't indicate a single choice of license, a
35+
* recipient has the option to distribute your version of this file under
36+
* either the CDDL, the GPL Version 2 or to extend the choice of license to
37+
* its licensees as provided above. However, if you add GPL Version 2 code
38+
* and therefore, elected the GPL Version 2 license, then the option applies
39+
* only if the new code is made subject to such option by the copyright
40+
* holder.
41+
*/
42+
-->
43+
<!DOCTYPE glassfish-web-app PUBLIC "-//GlassFish.org//DTD GlassFish Application Server 3.1 Servlet 3.0//EN" "http://glassfish.org/dtds/glassfish-web-app_3_0-1.dtd">
44+
<glassfish-web-app error-url="">
45+
<security-role-mapping>
46+
<role-name>g1</role-name>
47+
<principal-name>g1</principal-name>
48+
<group-name>g1</group-name>
49+
</security-role-mapping>
50+
</glassfish-web-app>

‎servlet/security-basicauth-omission/src/main/webapp/WEB-INF/web.xml‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<web-app xmlns="http://xmlns.jcp.org/xml/ns/javaee"
3+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
4+
xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee http://xmlns.jcp.org/xml/ns/javaee/web-app_3_1.xsd"
5+
version="3.1">
6+
<!--<deny-uncovered-http-methods/>-->
7+
<security-constraint>
8+
<web-resource-collection>
9+
<web-resource-name>SecureServlet</web-resource-name>
10+
<url-pattern>/SecureServlet</url-pattern>
11+
<!--<http-method>GET</http-method>-->
12+
<http-method-omission>POST</http-method-omission>
13+
</web-resource-collection>
14+
<auth-constraint>
15+
<role-name>g1</role-name>
16+
</auth-constraint>
17+
</security-constraint>
18+
19+
<login-config>
20+
<auth-method>BASIC</auth-method>
21+
<realm-name>file</realm-name>
22+
</login-config>
23+
24+
<security-role>
25+
<role-name>g1</role-name>
26+
</security-role>
27+
</web-app>

‎servlet/security-basicauth-omission/src/main/webapp/index.jsp‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
<!--
2+
/*
3+
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS HEADER.
4+
*
5+
* Copyright (c) 2013 Oracle and/or its affiliates. All rights reserved.
6+
*
7+
* The contents of this file are subject to the terms of either the GNU
8+
* General Public License Version 2 only ("GPL") or the Common Development
9+
* and Distribution License("CDDL") (collectively, the "License"). You
10+
* may not use this file except in compliance with the License. You can
11+
* obtain a copy of the License at
12+
* https://glassfish.dev.java.net/public/CDDL+GPL_1_1.html
13+
* or packager/legal/LICENSE.txt. See the License for the specific
14+
* language governing permissions and limitations under the License.
15+
*
16+
* When distributing the software, include this License Header Notice in each
17+
* file and include the License file at packager/legal/LICENSE.txt.
18+
*
19+
* GPL Classpath Exception:
20+
* Oracle designates this particular file as subject to the "Classpath"
21+
* exception as provided by Oracle in the GPL Version 2 section of the License
22+
* file that accompanied this code.
23+
*
24+
* Modifications:
25+
* If applicable, add the following below the License Header, with the fields
26+
* enclosed by brackets [] replaced by your own identifying information:
27+
* "Portions Copyright [year] [name of copyright owner]"
28+
*
29+
* Contributor(s):
30+
* If you wish your version of this file to be governed by only the CDDL or
31+
* only the GPL Version 2, indicate your decision by adding "[Contributor]
32+
* elects to include this software in this distribution under the [CDDL or GPL
33+
* Version 2] license." If you don't indicate a single choice of license, a
34+
* recipient has the option to distribute your version of this file under
35+
* either the CDDL, the GPL Version 2 or to extend the choice of license to
36+
* its licensees as provided above. However, if you add GPL Version 2 code
37+
* and therefore, elected the GPL Version 2 license, then the option applies
38+
* only if the new code is made subject to such option by the copyright
39+
* holder.
40+
*/
41+
-->
42+
43+
<%@page contentType="text/html" pageEncoding="UTF-8"%>
44+
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
45+
"http://www.w3.org/TR/html4/loose.dtd">
46+
47+
<html>
48+
<head>
49+
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
50+
<title>Servlet : Security</title>
51+
</head>
52+
<body>
53+
<h1>Servlet : Security</h1>
54+
55+
Make sure to create a user:<br><br>
56+
57+
For WildFly: Invoke "./bin/add-user.sh -a -u u1 -p p1 -g g1"<br>
58+
For GlassFish: Invoke "./bin/asadmin create-file-user --groups g1 u1" and use the password "p1" when prompted.<br><br>
59+
Then call the <a href="${pageContext.request.contextPath}/SecureServlet">GET</a> method.<br/>
60+
</body>
61+
</html>

‎servlet/security-basicauth-omission/src/test/java/org/javaee7/servlet/security/basicauth/omission/SecureServletTest.java‎

Lines changed: 113 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,113 @@
1+
package org.javaee7.servlet.security.basicauth.omission;
2+
3+
import com.meterware.httpunit.AuthorizationRequiredException;
4+
import com.meterware.httpunit.GetMethodWebRequest;
5+
import com.meterware.httpunit.PostMethodWebRequest;
6+
import com.meterware.httpunit.WebConversation;
7+
import com.meterware.httpunit.WebResponse;
8+
import java.io.File;
9+
import java.net.URL;
10+
import org.jboss.arquillian.container.test.api.Deployment;
11+
import org.jboss.arquillian.junit.Arquillian;
12+
import org.jboss.arquillian.test.api.ArquillianResource;
13+
import org.jboss.shrinkwrap.api.ShrinkWrap;
14+
import org.jboss.shrinkwrap.api.spec.WebArchive;
15+
import org.junit.Test;
16+
import static org.junit.Assert.*;
17+
import org.junit.runner.RunWith;
18+
19+
/**
20+
* @author Arun Gupta
21+
*/
22+
@RunWith(Arquillian.class)
23+
public class SecureServletTest {
24+
25+
private static final String WEBAPP_SRC = "src/main/webapp";
26+
27+
@ArquillianResource
28+
private URL base;
29+
30+
@Deployment(testable = false)
31+
public static WebArchive createDeployment() {
32+
WebArchive war = ShrinkWrap.create(WebArchive.class).
33+
addClass(SecureServlet.class).
34+
addAsWebInfResource((new File(WEBAPP_SRC + "/WEB-INF", "web.xml")));
35+
return war;
36+
}
37+
38+
@Test
39+
public void testGetWithCorrectCredentials() throws Exception {
40+
WebConversation conv = new WebConversation();
41+
conv.setAuthentication("file", "u1", "p1");
42+
GetMethodWebRequest getRequest = new GetMethodWebRequest(base + "/SecureServlet");
43+
WebResponse response = null;
44+
try {
45+
response = conv.getResponse(getRequest);
46+
} catch (AuthorizationRequiredException e) {
47+
fail(e.getMessage());
48+
}
49+
assertNotNull(response);
50+
assertTrue(response.getText().contains("<title>Servlet Security - Basic Auth with File-base Realm</title>"));
51+
}
52+
53+
@Test
54+
public void testGetWithIncorrectCredentials() throws Exception {
55+
WebConversation conv = new WebConversation();
56+
conv.setAuthentication("file", "u", "p1");
57+
GetMethodWebRequest getRequest = new GetMethodWebRequest(base + "/SecureServlet");
58+
try {
59+
conv.getResponse(getRequest);
60+
} catch (AuthorizationRequiredException e) {
61+
assertNotNull(e);
62+
return;
63+
}
64+
fail("/SecureServlet could be accessed without proper security credentials");
65+
}
66+
67+
@Test
68+
public void testSPostWithNoCredentials() throws Exception {
69+
WebConversation conv = new WebConversation();
70+
// conv.setAuthentication("file", "u1", "p1");
71+
PostMethodWebRequest getRequest = new PostMethodWebRequest(base + "/SecureServlet");
72+
WebResponse response = null;
73+
try {
74+
response = conv.getResponse(getRequest);
75+
} catch (AuthorizationRequiredException e) {
76+
fail(e.getMessage());
77+
}
78+
assertNotNull(response);
79+
assertTrue(response.getText().contains("<title>Servlet Security - Basic Auth with File-base Realm</title>"));
80+
}
81+
82+
@Test
83+
public void testPostWithCorrectCredentials() throws Exception {
84+
WebConversation conv = new WebConversation();
85+
conv.setAuthentication("file", "u1", "p1");
86+
PostMethodWebRequest getRequest = new PostMethodWebRequest(base + "/SecureServlet");
87+
WebResponse response = null;
88+
try {
89+
response = conv.getResponse(getRequest);
90+
} catch (AuthorizationRequiredException e) {
91+
fail(e.getMessage());
92+
}
93+
assertNotNull(response);
94+
assertTrue(response.getText().contains("<title>Servlet Security - Basic Auth with File-base Realm</title>"));
95+
}
96+
97+
98+
@Test
99+
public void testPostWithIncorrectCredentials() throws Exception {
100+
WebConversation conv = new WebConversation();
101+
conv.setAuthentication("file", "random", "random");
102+
PostMethodWebRequest getRequest = new PostMethodWebRequest(base + "/SecureServlet");
103+
WebResponse response = null;
104+
try {
105+
response = conv.getResponse(getRequest);
106+
} catch (AuthorizationRequiredException e) {
107+
fail(e.getMessage());
108+
}
109+
assertNotNull(response);
110+
assertTrue(response.getText().contains("<title>Servlet Security - Basic Auth with File-base Realm</title>"));
111+
}
112+
113+
}

0 commit comments

Comments
 (0)