Skip to content

Commit 546c82c

Browse files
arun-guptaarun-gupta
committed
Adding a new sample/test for @ServletSecurity - still failing and needs further investigation on how security needs to be specified completely using annotations
1 parent 5c6714e commit 546c82c

File tree

4 files changed

+234
-0
lines changed

4 files changed

+234
-0
lines changed

‎servlet/security-annotated/pom.xml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
3+
<modelVersion>4.0.0</modelVersion>
4+
<parent>
5+
<groupId>org.javaee7.servlet</groupId>
6+
<artifactId>servlet-samples</artifactId>
7+
<version>1.0-SNAPSHOT</version>
8+
<relativePath>../pom.xml</relativePath>
9+
</parent>
10+
11+
<artifactId>security-annotated</artifactId>
12+
<packaging>war</packaging>
13+
</project>

‎servlet/security-annotated/src/main/java/org/javaee7/servlet/security/annotated/SecureServlet.java‎

Lines changed: 79 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
package org.javaee7.servlet.security.annotated;
2+
3+
import java.io.IOException;
4+
import java.io.PrintWriter;
5+
import javax.servlet.ServletException;
6+
import javax.servlet.annotation.HttpConstraint;
7+
import javax.servlet.annotation.HttpMethodConstraint;
8+
import javax.servlet.annotation.ServletSecurity;
9+
import javax.servlet.annotation.WebServlet;
10+
import javax.servlet.http.HttpServlet;
11+
import javax.servlet.http.HttpServletRequest;
12+
import javax.servlet.http.HttpServletResponse;
13+
14+
/**
15+
* @author Arun Gupta
16+
*/
17+
@WebServlet("/SecureServlet")
18+
@ServletSecurity(value = @HttpConstraint(rolesAllowed = {"g1"}),
19+
httpMethodConstraints = {
20+
@HttpMethodConstraint(value = "GET", rolesAllowed = {"g1"}),
21+
@HttpMethodConstraint(value = "POST", rolesAllowed = {"g1"})
22+
})
23+
public class SecureServlet extends HttpServlet {
24+
25+
protected void processRequest(HttpServletRequest request, HttpServletResponse response, String method)
26+
throws ServletException, IOException {
27+
response.setContentType("text/html;charset=UTF-8");
28+
PrintWriter out = response.getWriter();
29+
out.println("<!DOCTYPE html>");
30+
out.println("<html>");
31+
out.println("<head>");
32+
out.println("<title>Servlet Security Annotated - Basic Auth with File-base Realm</title>");
33+
out.println("</head>");
34+
out.println("<body>");
35+
out.println("<h1>Basic Auth with File-base Realm (" + method + ")</h1>");
36+
out.println("<h2>Were you prompted for username/password ?</h2>");
37+
out.println("</body>");
38+
out.println("</html>");
39+
}
40+
41+
// <editor-fold defaultstate="collapsed" desc="HttpServlet methods. Click on the + sign on the left to edit the code.">
42+
/**
43+
* Handles the HTTP <code>GET</code> method.
44+
*
45+
* @param request servlet request
46+
* @param response servlet response
47+
* @throws ServletException if a servlet-specific error occurs
48+
* @throws IOException if an I/O error occurs
49+
*/
50+
@Override
51+
protected void doGet(HttpServletRequest request, HttpServletResponse response)
52+
throws ServletException, IOException {
53+
processRequest(request, response, "GET");
54+
}
55+
56+
/**
57+
* Handles the HTTP <code>POST</code> method.
58+
*
59+
* @param request servlet request
60+
* @param response servlet response
61+
* @throws ServletException if a servlet-specific error occurs
62+
* @throws IOException if an I/O error occurs
63+
*/
64+
@Override
65+
protected void doPost(HttpServletRequest request, HttpServletResponse response)
66+
throws ServletException, IOException {
67+
processRequest(request, response, "POST");
68+
}
69+
70+
/**
71+
* Returns a short description of the servlet.
72+
*
73+
* @return a String containing servlet description
74+
*/
75+
@Override
76+
public String getServletInfo() {
77+
return "Short description";
78+
}// </editor-fold>
79+
}

‎servlet/security-annotated/src/main/webapp/WEB-INF/glassfish-web.xml‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<!--
3+
/*
4+
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS HEADER.
5+
*
6+
* Copyright (c) 2013 Oracle and/or its affiliates. All rights reserved.
7+
*
8+
* The contents of this file are subject to the terms of either the GNU
9+
* General Public License Version 2 only ("GPL") or the Common Development
10+
* and Distribution License("CDDL") (collectively, the "License"). You
11+
* may not use this file except in compliance with the License. You can
12+
* obtain a copy of the License at
13+
* https://glassfish.dev.java.net/public/CDDL+GPL_1_1.html
14+
* or packager/legal/LICENSE.txt. See the License for the specific
15+
* language governing permissions and limitations under the License.
16+
*
17+
* When distributing the software, include this License Header Notice in each
18+
* file and include the License file at packager/legal/LICENSE.txt.
19+
*
20+
* GPL Classpath Exception:
21+
* Oracle designates this particular file as subject to the "Classpath"
22+
* exception as provided by Oracle in the GPL Version 2 section of the License
23+
* file that accompanied this code.
24+
*
25+
* Modifications:
26+
* If applicable, add the following below the License Header, with the fields
27+
* enclosed by brackets [] replaced by your own identifying information:
28+
* "Portions Copyright [year] [name of copyright owner]"
29+
*
30+
* Contributor(s):
31+
* If you wish your version of this file to be governed by only the CDDL or
32+
* only the GPL Version 2, indicate your decision by adding "[Contributor]
33+
* elects to include this software in this distribution under the [CDDL or GPL
34+
* Version 2] license." If you don't indicate a single choice of license, a
35+
* recipient has the option to distribute your version of this file under
36+
* either the CDDL, the GPL Version 2 or to extend the choice of license to
37+
* its licensees as provided above. However, if you add GPL Version 2 code
38+
* and therefore, elected the GPL Version 2 license, then the option applies
39+
* only if the new code is made subject to such option by the copyright
40+
* holder.
41+
*/
42+
-->
43+
<!DOCTYPE glassfish-web-app PUBLIC "-//GlassFish.org//DTD GlassFish Application Server 3.1 Servlet 3.0//EN" "http://glassfish.org/dtds/glassfish-web-app_3_0-1.dtd">
44+
<glassfish-web-app error-url="">
45+
<security-role-mapping>
46+
<role-name>g1</role-name>
47+
<principal-name>g1</principal-name>
48+
<group-name>g1</group-name>
49+
</security-role-mapping>
50+
</glassfish-web-app>

‎servlet/security-annotated/src/test/java/org/javaee7/servlet/security/annotated/SecureServletTest.java‎

Lines changed: 92 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,92 @@
1+
package org.javaee7.servlet.security.annotated;
2+
3+
import com.meterware.httpunit.AuthorizationRequiredException;
4+
import com.meterware.httpunit.GetMethodWebRequest;
5+
import com.meterware.httpunit.PostMethodWebRequest;
6+
import com.meterware.httpunit.WebConversation;
7+
import com.meterware.httpunit.WebResponse;
8+
import java.net.URL;
9+
import org.jboss.arquillian.container.test.api.Deployment;
10+
import org.jboss.arquillian.junit.Arquillian;
11+
import org.jboss.arquillian.test.api.ArquillianResource;
12+
import org.jboss.shrinkwrap.api.ShrinkWrap;
13+
import org.jboss.shrinkwrap.api.spec.WebArchive;
14+
import org.junit.Test;
15+
import static org.junit.Assert.*;
16+
import org.junit.runner.RunWith;
17+
18+
/**
19+
* @author Arun Gupta
20+
*/
21+
@RunWith(Arquillian.class)
22+
public class SecureServletTest {
23+
24+
@ArquillianResource
25+
private URL base;
26+
27+
@Deployment(testable = false)
28+
public static WebArchive createDeployment() {
29+
WebArchive war = ShrinkWrap.create(WebArchive.class).
30+
addClass(SecureServlet.class);
31+
return war;
32+
}
33+
34+
@Test
35+
public void testGetWithCorrectCredentials() throws Exception {
36+
WebConversation conv = new WebConversation();
37+
conv.setAuthentication("file", "u1", "p1");
38+
GetMethodWebRequest getRequest = new GetMethodWebRequest(base + "/SecureServlet");
39+
WebResponse response = null;
40+
try {
41+
response = conv.getResponse(getRequest);
42+
} catch (AuthorizationRequiredException e) {
43+
fail(e.getMessage());
44+
}
45+
assertNotNull(response);
46+
assertTrue(response.getText().contains("<title>Servlet Security Annotated - Basic Auth with File-base Realm</title>"));
47+
}
48+
49+
@Test
50+
public void testGetWithIncorrectCredentials() throws Exception {
51+
WebConversation conv = new WebConversation();
52+
conv.setAuthentication("file", "random", "random");
53+
GetMethodWebRequest getRequest = new GetMethodWebRequest(base + "/SecureServlet");
54+
try {
55+
conv.getResponse(getRequest);
56+
} catch (AuthorizationRequiredException e) {
57+
assertNotNull(e);
58+
return;
59+
}
60+
fail("/SecureServlet could be accessed without proper security credentials");
61+
}
62+
63+
@Test
64+
public void testPostWithCorrectCredentials() throws Exception {
65+
WebConversation conv = new WebConversation();
66+
conv.setAuthentication("file", "u1", "p1");
67+
PostMethodWebRequest getRequest = new PostMethodWebRequest(base + "/SecureServlet");
68+
WebResponse response = null;
69+
try {
70+
response = conv.getResponse(getRequest);
71+
} catch (AuthorizationRequiredException e) {
72+
fail(e.getMessage());
73+
}
74+
assertNotNull(response);
75+
assertTrue(response.getText().contains("<title>Servlet Security Annotated - Basic Auth with File-base Realm</title>"));
76+
}
77+
78+
@Test
79+
public void testPostWithIncorrectCredentials() throws Exception {
80+
WebConversation conv = new WebConversation();
81+
conv.setAuthentication("file", "random", "random");
82+
PostMethodWebRequest getRequest = new PostMethodWebRequest(base + "/SecureServlet");
83+
try {
84+
conv.getResponse(getRequest);
85+
} catch (AuthorizationRequiredException e) {
86+
assertNotNull(e);
87+
return;
88+
}
89+
fail("/SecureServlet could be accessed without proper security credentials");
90+
}
91+
92+
}

0 commit comments

Comments
 (0)