Skip to content

Commit 9c7b34a

Browse files
jzheauxjzheaux
committed
Favor Relative Redirects by Default
Closes gh-16300
1 parent d5d7fd4 commit 9c7b34a

File tree

45 files changed

+126
-131
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

45 files changed

+126
-131
lines changed

‎config/src/test/java/org/springframework/security/config/annotation/web/builders/NamespaceHttpTests.java‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -87,7 +87,7 @@
8787
import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get;
8888
import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.forwardedUrl;
8989
import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.header;
90-
import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.redirectedUrlPattern;
90+
import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.redirectedUrl;
9191
import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;
9292

9393
/**
@@ -175,7 +175,7 @@ public void configureWhenAuthenticationEntryPointSetAndRequestUnauthorizedThenRe
175175
// @formatter:off
176176
this.mockMvc.perform(get("/"))
177177
.andExpect(status().is3xxRedirection())
178-
.andExpect(redirectedUrlPattern("**/entry-point"));
178+
.andExpect(redirectedUrl("/entry-point"));
179179
// @formatter:on
180180
}
181181

‎config/src/test/java/org/springframework/security/config/annotation/web/configurers/DefaultLoginPageConfigurerTests.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -78,7 +78,7 @@ public class DefaultLoginPageConfigurerTests {
7878
@Test
7979
public void getWhenFormLoginEnabledThenRedirectsToLoginPage() throws Exception {
8080
this.spring.register(DefaultLoginPageConfig.class).autowire();
81-
this.mvc.perform(get("/")).andExpect(redirectedUrl("http://localhost/login"));
81+
this.mvc.perform(get("/")).andExpect(redirectedUrl("/login"));
8282
}
8383

8484
@Test

‎config/src/test/java/org/springframework/security/config/annotation/web/configurers/ExceptionHandlingConfigurerTests.java‎

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -214,8 +214,7 @@ public void getWhenCustomSecurityContextHolderStrategyThenUsed() throws Exceptio
214214
@Test
215215
public void getWhenUsingDefaultsAndUnauthenticatedThenRedirectsToLogin() throws Exception {
216216
this.spring.register(DefaultHttpConfig.class).autowire();
217-
this.mvc.perform(get("/").header(HttpHeaders.ACCEPT, "bogus/type"))
218-
.andExpect(redirectedUrl("http://localhost/login"));
217+
this.mvc.perform(get("/").header(HttpHeaders.ACCEPT, "bogus/type")).andExpect(redirectedUrl("/login"));
219218
}
220219

221220
@Test

‎config/src/test/java/org/springframework/security/config/annotation/web/configurers/FormLoginConfigurerTests.java‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -181,7 +181,7 @@ public void requestProtectedWhenFormLoginConfiguredThenRedirectsToLogin() throws
181181
// @formatter:off
182182
this.mockMvc.perform(get("/private"))
183183
.andExpect(status().isFound())
184-
.andExpect(redirectedUrl("http://localhost/login"));
184+
.andExpect(redirectedUrl("/login"));
185185
// @formatter:on
186186
}
187187

@@ -236,7 +236,7 @@ public void requestProtectedWhenFormLoginDefaultsInLambdaThenRedirectsToLogin()
236236
// @formatter:off
237237
this.mockMvc.perform(get("/private"))
238238
.andExpect(status().isFound())
239-
.andExpect(redirectedUrl("http://localhost/login"));
239+
.andExpect(redirectedUrl("/login"));
240240
// @formatter:on
241241
}
242242

@@ -350,7 +350,7 @@ public void failureUrlWhenPermitAllAndFailureHandlerThenSecured() throws Excepti
350350
// @formatter:off
351351
this.mockMvc.perform(get("/login?error"))
352352
.andExpect(status().isFound())
353-
.andExpect(redirectedUrl("http://localhost/login"));
353+
.andExpect(redirectedUrl("/login"));
354354
// @formatter:on
355355
}
356356

@@ -404,7 +404,7 @@ void requestWhenUnauthenticatedThenRequiresTwoSteps() throws Exception {
404404
this.mockMvc.perform(get("/profile").with(user(user)))
405405
.andExpect(status().is3xxRedirection())
406406
.andExpect(redirectedUrl(
407-
"http://localhost/login?factor.type=password&factor.type=ott&factor.reason=missing&factor.reason=missing"));
407+
"/login?factor.type=password&factor.type=ott&factor.reason=missing&factor.reason=missing"));
408408
this.mockMvc
409409
.perform(post("/ott/generate").param("username", "rod")
410410
.with(user(user))
@@ -422,13 +422,13 @@ void requestWhenUnauthenticatedThenRequiresTwoSteps() throws Exception {
422422
.build();
423423
this.mockMvc.perform(get("/profile").with(user(user)))
424424
.andExpect(status().is3xxRedirection())
425-
.andExpect(redirectedUrl("http://localhost/login?factor.type=password&factor.reason=missing"));
425+
.andExpect(redirectedUrl("/login?factor.type=password&factor.reason=missing"));
426426
user = PasswordEncodedUser.withUserDetails(user)
427427
.authorities("profile:read", FactorGrantedAuthority.PASSWORD_AUTHORITY)
428428
.build();
429429
this.mockMvc.perform(get("/profile").with(user(user)))
430430
.andExpect(status().is3xxRedirection())
431-
.andExpect(redirectedUrl("http://localhost/login?factor.type=ott&factor.reason=missing"));
431+
.andExpect(redirectedUrl("/login?factor.type=ott&factor.reason=missing"));
432432
user = PasswordEncodedUser.withUserDetails(user)
433433
.authorities("profile:read", FactorGrantedAuthority.PASSWORD_AUTHORITY,
434434
FactorGrantedAuthority.OTT_AUTHORITY)
@@ -445,7 +445,7 @@ void requestWhenUnauthenticatedX509ThenRequiresTwoSteps() throws Exception {
445445
this.mockMvc.perform(get("/login")).andExpect(status().isOk());
446446
this.mockMvc.perform(get("/profile").with(SecurityMockMvcRequestPostProcessors.x509("rod.cer")))
447447
.andExpect(status().is3xxRedirection())
448-
.andExpect(redirectedUrl("http://localhost/login?factor.type=password&factor.reason=missing"));
448+
.andExpect(redirectedUrl("/login?factor.type=password&factor.reason=missing"));
449449
this.mockMvc
450450
.perform(post("/login").param("username", "rod")
451451
.param("password", "password")

‎config/src/test/java/org/springframework/security/config/annotation/web/configurers/NamespaceHttpFormLoginTests.java‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -66,7 +66,7 @@ public class NamespaceHttpFormLoginTests {
6666
@Test
6767
public void formLoginWhenDefaultConfigurationThenMatchesNamespace() throws Exception {
6868
this.spring.register(FormLoginConfig.class, UserDetailsServiceConfig.class).autowire();
69-
this.mvc.perform(get("/")).andExpect(redirectedUrl("http://localhost/login"));
69+
this.mvc.perform(get("/")).andExpect(redirectedUrl("/login"));
7070
this.mvc.perform(post("/login").with(csrf())).andExpect(redirectedUrl("/login?error"));
7171
// @formatter:off
7272
MockHttpServletRequestBuilder loginRequest = post("/login")
@@ -80,7 +80,7 @@ public void formLoginWhenDefaultConfigurationThenMatchesNamespace() throws Excep
8080
@Test
8181
public void formLoginWithCustomEndpointsThenBehaviorMatchesNamespace() throws Exception {
8282
this.spring.register(FormLoginCustomConfig.class, UserDetailsServiceConfig.class).autowire();
83-
this.mvc.perform(get("/")).andExpect(redirectedUrl("http://localhost/authentication/login"));
83+
this.mvc.perform(get("/")).andExpect(redirectedUrl("/authentication/login"));
8484
this.mvc.perform(post("/authentication/login/process").with(csrf()))
8585
.andExpect(redirectedUrl("/authentication/login?failed"));
8686
// @formatter:off
@@ -95,7 +95,7 @@ public void formLoginWithCustomEndpointsThenBehaviorMatchesNamespace() throws Ex
9595
@Test
9696
public void formLoginWithCustomHandlersThenBehaviorMatchesNamespace() throws Exception {
9797
this.spring.register(FormLoginCustomRefsConfig.class, UserDetailsServiceConfig.class).autowire();
98-
this.mvc.perform(get("/")).andExpect(redirectedUrl("http://localhost/login"));
98+
this.mvc.perform(get("/")).andExpect(redirectedUrl("/login"));
9999
this.mvc.perform(post("/login").with(csrf())).andExpect(redirectedUrl("/custom/failure"));
100100
verifyBean(WebAuthenticationDetailsSource.class).buildDetails(any(HttpServletRequest.class));
101101
// @formatter:off

‎config/src/test/java/org/springframework/security/config/annotation/web/configurers/NamespaceRememberMeTests.java‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -104,7 +104,7 @@ public void rememberMeLoginWhenUsingDefaultsThenMatchesNamespace() throws Except
104104
.with(csrf())
105105
.cookie(rememberMe);
106106
this.mvc.perform(authenticationClassRequest)
107-
.andExpect(redirectedUrl("http://localhost/login"))
107+
.andExpect(redirectedUrl("/login"))
108108
.andReturn();
109109
// @formatter:on
110110
}
@@ -150,7 +150,7 @@ public void rememberMeLoginWhenKeyDeclaredThenMatchesNamespace() throws Exceptio
150150
// @formatter:off
151151
this.mvc.perform(somewhereRequest)
152152
.andExpect(status().isFound())
153-
.andExpect(redirectedUrl("http://localhost/login"));
153+
.andExpect(redirectedUrl("/login"));
154154
MockHttpServletRequestBuilder loginWithRememberme = post("/login").with(rememberMeLogin());
155155
Cookie withKey = this.mvc.perform(loginWithRememberme)
156156
.andReturn()

‎config/src/test/java/org/springframework/security/config/annotation/web/configurers/RememberMeConfigurerTests.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -240,7 +240,7 @@ public void getWhenRememberMeCookieAndLoggedOutThenRedirectsToLogin() throws Exc
240240
.with(csrf())
241241
.cookie(expiredRememberMeCookie);
242242
// @formatter:on
243-
this.mvc.perform(expiredRequest).andExpect(redirectedUrl("http://localhost/login"));
243+
this.mvc.perform(expiredRequest).andExpect(redirectedUrl("/login"));
244244
}
245245

246246
@Test

‎config/src/test/java/org/springframework/security/config/annotation/web/configurers/RequestCacheConfigurerTests.java‎

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -90,7 +90,7 @@ public void getWhenBookmarkedUrlIsFaviconIcoThenPostAuthenticationRedirectsToRoo
9090
this.spring.register(RequestCacheDefaultsConfig.class, DefaultSecurityConfig.class).autowire();
9191
// @formatter:off
9292
MockHttpSession session = (MockHttpSession) this.mvc.perform(get("/favicon.ico"))
93-
.andExpect(redirectedUrl("http://localhost/login"))
93+
.andExpect(redirectedUrl("/login"))
9494
.andReturn()
9595
.getRequest()
9696
.getSession();
@@ -104,7 +104,7 @@ public void getWhenBookmarkedUrlIsFaviconPngThenPostAuthenticationRedirectsToRoo
104104
this.spring.register(RequestCacheDefaultsConfig.class, DefaultSecurityConfig.class).autowire();
105105
// @formatter:off
106106
MockHttpSession session = (MockHttpSession) this.mvc.perform(get("/favicon.png"))
107-
.andExpect(redirectedUrl("http://localhost/login"))
107+
.andExpect(redirectedUrl("/login"))
108108
.andReturn()
109109
.getRequest()
110110
.getSession();
@@ -120,7 +120,7 @@ public void getWhenBookmarkedRequestIsApplicationJsonThenPostAuthenticationRedir
120120
MockHttpServletRequestBuilder request = get("/messages").header(HttpHeaders.ACCEPT, MediaType.APPLICATION_JSON);
121121
// @formatter:off
122122
MockHttpSession session = (MockHttpSession) this.mvc.perform(request)
123-
.andExpect(redirectedUrl("http://localhost/login"))
123+
.andExpect(redirectedUrl("/login"))
124124
.andReturn()
125125
.getRequest()
126126
.getSession();
@@ -140,7 +140,7 @@ public void getWhenBookmarkedRequestIsXRequestedWithThenPostAuthenticationRedire
140140
.header("X-Requested-With", "XMLHttpRequest");
141141
MockHttpSession session = (MockHttpSession) this.mvc
142142
.perform(xRequestedWith)
143-
.andExpect(redirectedUrl("http://localhost/login"))
143+
.andExpect(redirectedUrl("/login"))
144144
.andReturn()
145145
.getRequest()
146146
.getSession();
@@ -157,7 +157,7 @@ public void getWhenBookmarkedRequestIsTextEventStreamThenPostAuthenticationRedir
157157
MediaType.TEXT_EVENT_STREAM);
158158
// @formatter:off
159159
MockHttpSession session = (MockHttpSession) this.mvc.perform(request)
160-
.andExpect(redirectedUrl("http://localhost/login"))
160+
.andExpect(redirectedUrl("/login"))
161161
.andReturn()
162162
.getRequest()
163163
.getSession();
@@ -174,7 +174,7 @@ public void getWhenBookmarkedRequestIsWebSocketThenPostAuthenticationRedirectsTo
174174
MockHttpServletRequestBuilder request = get("/messages").header("Upgrade", "websocket");
175175
// @formatter:off
176176
MockHttpSession session = (MockHttpSession) this.mvc.perform(request)
177-
.andExpect(redirectedUrl("http://localhost/login"))
177+
.andExpect(redirectedUrl("/login"))
178178
.andReturn()
179179
.getRequest()
180180
.getSession();
@@ -191,7 +191,7 @@ public void getWhenBookmarkedRequestIsAllMediaTypeThenPostAuthenticationRemember
191191
MockHttpServletRequestBuilder request = get("/messages").header(HttpHeaders.ACCEPT, MediaType.ALL);
192192
// @formatter:off
193193
MockHttpSession session = (MockHttpSession) this.mvc.perform(request)
194-
.andExpect(redirectedUrl("http://localhost/login"))
194+
.andExpect(redirectedUrl("/login"))
195195
.andReturn()
196196
.getRequest()
197197
.getSession();
@@ -205,7 +205,7 @@ public void getWhenBookmarkedRequestIsTextHtmlThenPostAuthenticationRemembers()
205205
MockHttpServletRequestBuilder request = get("/messages").header(HttpHeaders.ACCEPT, MediaType.TEXT_HTML);
206206
// @formatter:off
207207
MockHttpSession session = (MockHttpSession) this.mvc.perform(request)
208-
.andExpect(redirectedUrl("http://localhost/login"))
208+
.andExpect(redirectedUrl("/login"))
209209
.andReturn()
210210
.getRequest()
211211
.getSession();
@@ -220,7 +220,7 @@ public void getWhenBookmarkedRequestIsChromeThenPostAuthenticationRemembers() th
220220
MockHttpServletRequestBuilder request = get("/messages")
221221
.header(HttpHeaders.ACCEPT, "text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8");
222222
MockHttpSession session = (MockHttpSession) this.mvc.perform(request)
223-
.andExpect(redirectedUrl("http://localhost/login"))
223+
.andExpect(redirectedUrl("/login"))
224224
.andReturn()
225225
.getRequest()
226226
.getSession();
@@ -235,7 +235,7 @@ public void getWhenBookmarkedRequestIsRequestedWithAndroidThenPostAuthentication
235235
MockHttpServletRequestBuilder request = get("/messages")
236236
.header("X-Requested-With", "com.android");
237237
MockHttpSession session = (MockHttpSession) this.mvc.perform(request)
238-
.andExpect(redirectedUrl("http://localhost/login"))
238+
.andExpect(redirectedUrl("/login"))
239239
.andReturn()
240240
.getRequest()
241241
.getSession();
@@ -315,7 +315,7 @@ public void getWhenPathPatternFactoryBeanThenFaviconIcoRedirectsToRoot() throws
315315
.autowire();
316316
// @formatter:off
317317
MockHttpSession session = (MockHttpSession) this.mvc.perform(get("/favicon.ico"))
318-
.andExpect(redirectedUrl("http://localhost/login"))
318+
.andExpect(redirectedUrl("/login"))
319319
.andReturn()
320320
.getRequest()
321321
.getSession();

‎config/src/test/java/org/springframework/security/config/annotation/web/configurers/oauth2/client/OAuth2LoginConfigurerTests.java‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -447,7 +447,7 @@ public void oauth2LoginWithOneClientConfiguredThenRedirectForAuthorization() thr
447447
String requestUri = "/";
448448
this.request = get(requestUri).build();
449449
this.springSecurityFilterChain.doFilter(this.request, this.response, this.filterChain);
450-
assertThat(this.response.getRedirectedUrl()).matches("http://localhost/oauth2/authorization/google");
450+
assertThat(this.response.getRedirectedUrl()).matches("/oauth2/authorization/google");
451451
}
452452

453453
// gh-6802
@@ -457,7 +457,7 @@ public void oauth2LoginWithOneClientConfiguredAndFormLoginThenRedirectDefaultLog
457457
String requestUri = "/";
458458
this.request = get(requestUri).build();
459459
this.springSecurityFilterChain.doFilter(this.request, this.response, this.filterChain);
460-
assertThat(this.response.getRedirectedUrl()).matches("http://localhost/login");
460+
assertThat(this.response.getRedirectedUrl()).matches("/login");
461461
}
462462

463463
// gh-5347
@@ -469,7 +469,7 @@ public void oauth2LoginWithOneClientConfiguredAndRequestFaviconNotAuthenticatedT
469469
this.request = get(requestUri).build();
470470
this.request.addHeader(HttpHeaders.ACCEPT, new MediaType("image", "*").toString());
471471
this.springSecurityFilterChain.doFilter(this.request, this.response, this.filterChain);
472-
assertThat(this.response.getRedirectedUrl()).matches("http://localhost/login");
472+
assertThat(this.response.getRedirectedUrl()).matches("/login");
473473
}
474474

475475
// gh-5347
@@ -479,7 +479,7 @@ public void oauth2LoginWithMultipleClientsConfiguredThenRedirectDefaultLoginPage
479479
String requestUri = "/";
480480
this.request = get(requestUri).build();
481481
this.springSecurityFilterChain.doFilter(this.request, this.response, this.filterChain);
482-
assertThat(this.response.getRedirectedUrl()).matches("http://localhost/login");
482+
assertThat(this.response.getRedirectedUrl()).matches("/login");
483483
}
484484

485485
// gh-6812
@@ -524,7 +524,7 @@ public void oauth2LoginWithOneAuthorizationCodeClientAndOtherClientsConfiguredTh
524524
String requestUri = "/";
525525
this.request = get(requestUri).build();
526526
this.springSecurityFilterChain.doFilter(this.request, this.response, this.filterChain);
527-
assertThat(this.response.getRedirectedUrl()).matches("http://localhost/oauth2/authorization/google");
527+
assertThat(this.response.getRedirectedUrl()).matches("/oauth2/authorization/google");
528528
}
529529

530530
@Test
@@ -533,7 +533,7 @@ public void oauth2LoginWithCustomLoginPageThenRedirectCustomLoginPage() throws E
533533
String requestUri = "/";
534534
this.request = get(requestUri).build();
535535
this.springSecurityFilterChain.doFilter(this.request, this.response, this.filterChain);
536-
assertThat(this.response.getRedirectedUrl()).matches("http://localhost/custom-login");
536+
assertThat(this.response.getRedirectedUrl()).matches("/custom-login");
537537
}
538538

539539
@Test
@@ -542,7 +542,7 @@ public void requestWhenOauth2LoginWithCustomLoginPageInLambdaThenRedirectCustomL
542542
String requestUri = "/";
543543
this.request = get(requestUri).build();
544544
this.springSecurityFilterChain.doFilter(this.request, this.response, this.filterChain);
545-
assertThat(this.response.getRedirectedUrl()).matches("http://localhost/custom-login");
545+
assertThat(this.response.getRedirectedUrl()).matches("/custom-login");
546546
}
547547

548548
@Test

‎config/src/test/java/org/springframework/security/config/annotation/web/configurers/oauth2/server/resource/OAuth2ResourceServerConfigurerTests.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1212,7 +1212,7 @@ public void requestWhenFormLoginAndResourceServerEntryPointsThenSessionCreatedBy
12121212
MvcResult result = this.mvc.perform(get("/authenticated")
12131213
.header("Accept", "text/html"))
12141214
.andExpect(status().isFound())
1215-
.andExpect(redirectedUrl("http://localhost/login"))
1215+
.andExpect(redirectedUrl("/login"))
12161216
.andReturn();
12171217
// @formatter:on
12181218
assertThat(result.getRequest().getSession(false)).isNotNull();

0 commit comments

Comments
 (0)