Skip to content

Commit 7c2b68f

Browse files
php-coderphp-coder
committed
Activate CSRF protection.
Now POST method is used for logging out from site. @see http://docs.spring.io/spring-security/site/docs/3.2.x/reference/htmlsingle/#csrf Fix #25
1 parent 5fa474d commit 7c2b68f

File tree

21 files changed

+79
-74
lines changed

21 files changed

+79
-74
lines changed

‎src/main/config/checkstyle-suppressions.xml

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,11 +5,12 @@
55

66
<suppressions>
77

8+
<suppress checks="LineLength" files="AbstractPage.java" lines="44,45" />
89
<suppress checks="LineLength" files="AbstractPageWithForm.java" lines="27,28,33" />
910
<suppress checks="LineLength" files="Form.java" lines="31,32,37" />
1011
<suppress checks="LineLength" files="Url.java" lines="73" />
1112
<suppress checks="LineLength" files="ErrorController.java" lines="73" />
12-
<suppress checks="LineLength" files="SecurityConfig.java" lines="35,36,40" />
13+
<suppress checks="LineLength" files="SecurityConfig.java" lines="35,36,39,40" />
1314

1415
<!-- false positives due to Lombok usage -->
1516
<suppress checks="HideUtilityClassConstructor" files="ru.mystamps.web.model" />

‎src/main/java/ru/mystamps/web/support/spring/security/SecurityConfig.java

Lines changed: 2 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -36,15 +36,15 @@
3636
import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
3737
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
3838
import org.springframework.security.config.annotation.web.builders.WebSecurity;
39-
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
4039
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
40+
import org.springframework.security.config.annotation.web.servlet.configuration.EnableWebMvcSecurity;
4141
import org.springframework.security.core.userdetails.UserDetailsService;
4242

4343
import ru.mystamps.web.config.ServicesConfig;
4444
import ru.mystamps.web.Url;
4545

4646
@Configuration
47-
@EnableWebSecurity
47+
@EnableWebMvcSecurity
4848
@EnableGlobalMethodSecurity(prePostEnabled = true)
4949
public class SecurityConfig extends WebSecurityConfigurerAdapter {
5050

@@ -95,9 +95,6 @@ protected void configure(HttpSecurity http) throws Exception {
9595
.rememberMe()
9696
// TODO: GH #27
9797
.disable()
98-
.csrf()
99-
// TODO: GH #25
100-
.disable()
10198
.headers()
10299
// TODO
103100
.disable();

‎src/main/webapp/WEB-INF/static/styles/main.css

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -58,3 +58,12 @@ label {
5858
.top-indent {
5959
padding-top: 20px;
6060
}
61+
62+
.no-margin {
63+
margin: 0px;
64+
}
65+
66+
.no-padding {
67+
padding: 0px;
68+
}
69+

‎src/main/webapp/WEB-INF/views/account/activate.html

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -37,8 +37,9 @@
3737
</li>
3838
<!--/*/
3939
<li sec:authorize="isAuthenticated()">
40-
<i class="icon-share"></i>
41-
<a href="../site/index.html" th:href="@{${LOGOUT_PAGE}}" th:text="#{t_logout}">Sign out</a>
40+
<form id="LogoutForm" method="get" action="../site/index.html" class="no-margin" th:method="post" th:action="@{${LOGOUT_PAGE}}">
41+
<i class="icon-share"></i>&nbsp;<input type="submit" value="Sign out" class="btn btn-link no-padding" th:value="#{t_logout}" />
42+
</form>
4243
</li>
4344
/*/-->
4445
<li sec:authorize="isAnonymous()">

‎src/main/webapp/WEB-INF/views/account/auth.html

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -37,8 +37,9 @@
3737
</li>
3838
<!--/*/
3939
<li sec:authorize="isAuthenticated()">
40-
<i class="icon-share"></i>
41-
<a href="../site/index.html" th:href="@{${LOGOUT_PAGE}}" th:text="#{t_logout}">Sign out</a>
40+
<form id="LogoutForm" method="get" action="../site/index.html" class="no-margin" th:method="post" th:action="@{${LOGOUT_PAGE}}">
41+
<i class="icon-share"></i>&nbsp;<input type="submit" value="Sign out" class="btn btn-link no-padding" th:value="#{t_logout}" />
42+
</form>
4243
</li>
4344
/*/-->
4445
<li sec:authorize="isAnonymous()">

‎src/main/webapp/WEB-INF/views/account/register.html

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -37,8 +37,9 @@
3737
</li>
3838
<!--/*/
3939
<li sec:authorize="isAuthenticated()">
40-
<i class="icon-share"></i>
41-
<a href="../site/index.html" th:href="@{${LOGOUT_PAGE}}" th:text="#{t_logout}">Sign out</a>
40+
<form id="LogoutForm" method="get" action="../site/index.html" class="no-margin" th:method="post" th:action="@{${LOGOUT_PAGE}}">
41+
<i class="icon-share"></i>&nbsp;<input type="submit" value="Sign out" class="btn btn-link no-padding" th:value="#{t_logout}" />
42+
</form>
4243
</li>
4344
/*/-->
4445
<li sec:authorize="isAnonymous()">

‎src/main/webapp/WEB-INF/views/category/add.html

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -36,8 +36,9 @@
3636
</li>
3737
/*/-->
3838
<li sec:authorize="isAuthenticated()">
39-
<i class="icon-share"></i>
40-
<a href="../site/index.html" th:href="@{${LOGOUT_PAGE}}" th:text="#{t_logout}">Sign out</a>
39+
<form id="LogoutForm" method="get" action="../site/index.html" class="no-margin" th:method="post" th:action="@{${LOGOUT_PAGE}}">
40+
<i class="icon-share"></i>&nbsp;<input type="submit" value="Sign out" class="btn btn-link no-padding" th:value="#{t_logout}" />
41+
</form>
4142
</li>
4243
<!--/*/
4344
<li sec:authorize="isAnonymous()">

‎src/main/webapp/WEB-INF/views/category/info.html

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -37,8 +37,9 @@
3737
</li>
3838
<!--/*/
3939
<li sec:authorize="isAuthenticated()">
40-
<i class="icon-share"></i>
41-
<a href="../site/index.html" th:href="@{${LOGOUT_PAGE}}" th:text="#{t_logout}">Sign out</a>
40+
<form id="LogoutForm" method="get" action="../site/index.html" class="no-margin" th:method="post" th:action="@{${LOGOUT_PAGE}}">
41+
<i class="icon-share"></i>&nbsp;<input type="submit" value="Sign out" class="btn btn-link no-padding" th:value="#{t_logout}" />
42+
</form>
4243
</li>
4344
/*/-->
4445
<li sec:authorize="isAnonymous()">

‎src/main/webapp/WEB-INF/views/collection/info.html

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -36,8 +36,9 @@
3636
</li>
3737
<!--/*/
3838
<li sec:authorize="isAuthenticated()">
39-
<i class="icon-share"></i>
40-
<a href="../site/index.html" th:href="@{${LOGOUT_PAGE}}" th:text="#{t_logout}">Sign out</a>
39+
<form id="LogoutForm" method="get" action="../site/index.html" class="no-margin" th:method="post" th:action="@{${LOGOUT_PAGE}}">
40+
<i class="icon-share"></i>&nbsp;<input type="submit" value="Sign out" class="btn btn-link no-padding" th:value="#{t_logout}" />
41+
</form>
4142
</li>
4243
/*/-->
4344
<li sec:authorize="isAnonymous()">

‎src/main/webapp/WEB-INF/views/country/add.html

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -36,8 +36,9 @@
3636
</li>
3737
/*/-->
3838
<li sec:authorize="isAuthenticated()">
39-
<i class="icon-share"></i>
40-
<a href="../site/index.html" th:href="@{${LOGOUT_PAGE}}" th:text="#{t_logout}">Sign out</a>
39+
<form id="LogoutForm" method="get" action="../site/index.html" class="no-margin" th:method="post" th:action="@{${LOGOUT_PAGE}}">
40+
<i class="icon-share"></i>&nbsp;<input type="submit" value="Sign out" class="btn btn-link no-padding" th:value="#{t_logout}" />
41+
</form>
4142
</li>
4243
<!--/*/
4344
<li sec:authorize="isAnonymous()">

‎src/main/webapp/WEB-INF/views/country/info.html

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -37,8 +37,9 @@
3737
</li>
3838
<!--/*/
3939
<li sec:authorize="isAuthenticated()">
40-
<i class="icon-share"></i>
41-
<a href="../site/index.html" th:href="@{${LOGOUT_PAGE}}" th:text="#{t_logout}">Sign out</a>
40+
<form id="LogoutForm" method="get" action="../site/index.html" class="no-margin" th:method="post" th:action="@{${LOGOUT_PAGE}}">
41+
<i class="icon-share"></i>&nbsp;<input type="submit" value="Sign out" class="btn btn-link no-padding" th:value="#{t_logout}" />
42+
</form>
4243
</li>
4344
/*/-->
4445
<li sec:authorize="isAnonymous()">

‎src/main/webapp/WEB-INF/views/error/401.html

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -37,8 +37,9 @@
3737
</li>
3838
<!--/*/
3939
<li sec:authorize="isAuthenticated()">
40-
<i class="icon-share"></i>
41-
<a href="../site/index.html" th:href="@{${LOGOUT_PAGE}}" th:text="#{t_logout}">Sign out</a>
40+
<form id="LogoutForm" method="get" action="../site/index.html" class="no-margin" th:method="post" th:action="@{${LOGOUT_PAGE}}">
41+
<i class="icon-share"></i>&nbsp;<input type="submit" value="Sign out" class="btn btn-link no-padding" th:value="#{t_logout}" />
42+
</form>
4243
</li>
4344
/*/-->
4445
<li sec:authorize="isAnonymous()">

‎src/main/webapp/WEB-INF/views/error/404.html

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -37,8 +37,9 @@
3737
</li>
3838
<!--/*/
3939
<li sec:authorize="isAuthenticated()">
40-
<i class="icon-share"></i>
41-
<a href="../site/index.html" th:href="@{${LOGOUT_PAGE}}" th:text="#{t_logout}">Sign out</a>
40+
<form id="LogoutForm" method="get" action="../site/index.html" class="no-margin" th:method="post" th:action="@{${LOGOUT_PAGE}}">
41+
<i class="icon-share"></i>&nbsp;<input type="submit" value="Sign out" class="btn btn-link no-padding" th:value="#{t_logout}" />
42+
</form>
4243
</li>
4344
/*/-->
4445
<li sec:authorize="isAnonymous()">

‎src/main/webapp/WEB-INF/views/error/500.html

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -37,8 +37,9 @@
3737
</li>
3838
<!--/*/
3939
<li sec:authorize="isAuthenticated()">
40-
<i class="icon-share"></i>
41-
<a href="../site/index.html" th:href="@{${LOGOUT_PAGE}}" th:text="#{t_logout}">Sign out</a>
40+
<form id="LogoutForm" method="get" action="../site/index.html" class="no-margin" th:method="post" th:action="@{${LOGOUT_PAGE}}">
41+
<i class="icon-share"></i>&nbsp;<input type="submit" value="Sign out" class="btn btn-link no-padding" th:value="#{t_logout}" />
42+
</form>
4243
</li>
4344
/*/-->
4445
<li sec:authorize="isAnonymous()">

‎src/main/webapp/WEB-INF/views/series/add.html

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -36,8 +36,9 @@
3636
</li>
3737
/*/-->
3838
<li sec:authorize="isAuthenticated()">
39-
<i class="icon-share"></i>
40-
<a href="../site/index.html" th:href="@{${LOGOUT_PAGE}}" th:text="#{t_logout}">Sign out</a>
39+
<form id="LogoutForm" method="get" action="../site/index.html" class="no-margin" th:method="post" th:action="@{${LOGOUT_PAGE}}">
40+
<i class="icon-share"></i>&nbsp;<input type="submit" value="Sign out" class="btn btn-link no-padding" th:value="#{t_logout}" />
41+
</form>
4142
</li>
4243
<!--/*/
4344
<li sec:authorize="isAnonymous()">
@@ -62,7 +63,7 @@ <h3 th:text="#{t_add_series_ucfirst}">
6263
</div>
6364

6465
<div class="span6 offset3">
65-
<form method="post" enctype="multipart/form-data" class="form-horizontal" action="info.html" th:action="@{${ADD_SERIES_PAGE}}" th:object="${addSeriesForm}">
66+
<form method="post" enctype="multipart/form-data" class="form-horizontal" action="info.html" th:action="@{${ADD_SERIES_PAGE}} + '?' + ${_csrf.parameterName} + '=' + ${_csrf.token}" th:object="${addSeriesForm}">
6667

6768
<div class="control-group" th:classappend="${#fields.hasErrors('category') ? 'error' : ''}">
6869
<label for="category" class="control-label">

‎src/main/webapp/WEB-INF/views/series/info.html

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -35,8 +35,9 @@
3535
</li>
3636
/*/-->
3737
<li sec:authorize="isAuthenticated()">
38-
<i class="icon-share"></i>
39-
<a href="../site/index.html" th:href="@{${LOGOUT_PAGE}}" th:text="#{t_logout}">Sign out</a>
38+
<form id="LogoutForm" method="get" action="../site/index.html" class="no-margin" th:method="post" th:action="@{${LOGOUT_PAGE}}">
39+
<i class="icon-share"></i>&nbsp;<input type="submit" value="Sign out" class="btn btn-link no-padding" th:value="#{t_logout}" />
40+
</form>
4041
</li>
4142
<!--/*/
4243
<li sec:authorize="isAnonymous()">

‎src/main/webapp/WEB-INF/views/site/index.html

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -36,8 +36,9 @@
3636
</li>
3737
<!--/*/
3838
<li sec:authorize="isAuthenticated()">
39-
<i class="icon-share"></i>
40-
<a href="../site/index.html" th:href="@{${LOGOUT_PAGE}}" th:text="#{t_logout}">Sign out</a>
39+
<form id="LogoutForm" method="get" action="../site/index.html" class="no-margin" th:method="post" th:action="@{${LOGOUT_PAGE}}">
40+
<i class="icon-share"></i>&nbsp;<input type="submit" value="Sign out" class="btn btn-link no-padding" th:value="#{t_logout}" />
41+
</form>
4142
</li>
4243
/*/-->
4344
<li sec:authorize="isAnonymous()">

‎src/test/java/ru/mystamps/web/tests/WebElementUtils.java

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,15 @@ public static List<String> convertToListWithText(List<WebElement> elements) {
3535

3636
List<String> result = new ArrayList<>(elements.size());
3737
for (WebElement el : elements) {
38-
result.add(el.getText());
38+
String text = null;
39+
if ("input".equals(el.getTagName())) {
40+
text = el.getAttribute("value");
41+
} else {
42+
text = el.getText();
43+
}
44+
if (text != null) {
45+
result.add(text);
46+
}
3947
}
4048

4149
return result;

‎src/test/java/ru/mystamps/web/tests/cases/WhenUserLogsOut.java

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -23,11 +23,11 @@
2323
import static org.fest.assertions.api.Assertions.assertThat;
2424

2525
import ru.mystamps.web.Url;
26-
import ru.mystamps.web.tests.page.LogoutAccountPage;
26+
import ru.mystamps.web.tests.page.IndexSitePage;
2727

2828
import static ru.mystamps.web.tests.TranslationUtils.tr;
2929

30-
public class WhenUserLogsOut extends WhenAnyUserAtAnyPage<LogoutAccountPage> {
30+
public class WhenUserLogsOut extends WhenAnyUserAtAnyPage<IndexSitePage> {
3131

3232
@Value("${valid_user_login}")
3333
private String validUserLogin;
@@ -36,13 +36,13 @@ public class WhenUserLogsOut extends WhenAnyUserAtAnyPage<LogoutAccountPage> {
3636
private String validUserPassword;
3737

3838
public WhenUserLogsOut() {
39-
super(LogoutAccountPage.class);
39+
super(IndexSitePage.class);
4040
}
4141

4242
@Test(groups = "logic")
4343
public void shouldRedirectAndClearSession() {
4444
page.login(validUserLogin, validUserPassword);
45-
page.open();
45+
page.logout();
4646

4747
assertThat(page.getCurrentUrl())
4848
.overridingErrorMessage("after logout we should be redirected to main page")

‎src/test/java/ru/mystamps/web/tests/page/AbstractPage.java

Lines changed: 10 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -41,6 +41,8 @@
4141
public abstract class AbstractPage {
4242

4343
private static final String A_HREF_LOCATOR = "//a[@href=\"%s\"]";
44+
private static final String LOGOUT_BUTTON_LOCATOR = "//form[@id=\"LogoutForm\"]/input[@type=\"submit\"]";
45+
private static final String USER_BAR_ENTRIES_LOCATOR = "//*[@id=\"user_bar\"]//li/a | //*[@id=\"user_bar\"]//li//input[not(@type=\"hidden\")]";
4446

4547
protected final WebDriver driver;
4648
private final String pageUrl;
@@ -118,8 +120,7 @@ public boolean userBarExists() {
118120
}
119121

120122
public List<String> getUserBarEntries() {
121-
WebElement userBar = getElementById("user_bar");
122-
List<WebElement> entries = userBar.findElements(By.tagName("li"));
123+
List<WebElement> entries = getElementsByXPath(USER_BAR_ENTRIES_LOCATOR);
123124
return WebElementUtils.convertToListWithText(entries);
124125
}
125126

@@ -182,6 +183,10 @@ protected List<WebElement> getElementsByClassName(String className) {
182183
return driver.findElements(By.className(className));
183184
}
184185

186+
protected List<WebElement> getElementsByXPath(String xpath) {
187+
return driver.findElements(By.xpath(xpath));
188+
}
189+
185190
//
186191
// Helpers for getting element's value
187192
//
@@ -243,8 +248,9 @@ public void login(String login, String password) {
243248

244249
public void logout() {
245250
// TODO: check than we not authenticated and do nothing
246-
LogoutAccountPage logoutPage = new LogoutAccountPage(driver);
247-
logoutPage.open();
251+
252+
WebElement logoutButton = getElementByXPath(LOGOUT_BUTTON_LOCATOR);
253+
logoutButton.submit();
248254

249255
// return to current page
250256
open();

‎src/test/java/ru/mystamps/web/tests/page/LogoutAccountPage.java

Lines changed: 0 additions & 30 deletions
This file was deleted.

0 commit comments

Comments
 (0)