OAuthSecurityFilter implements Filter { @Override public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain chain) throws IOException, ServletException { HttpServletRequest request = (HttpServletRequest) servletRequest; HttpServletResponse response = (HttpServletResponse) servletResponse; if (securedResources.contains(request.getRequestURI())) { Session session = new Session(getCookieValue(request, "SID")); if (!sessionSecurity.exists(session)) { String path = uriPath + "/login"; if (!Strings.isNullOrEmpty(loginPagePath)) { path = loginPagePath; } String location = path + "?redirectUrl=" + getRedirectURI(request); response.sendRedirect(location); return; } } chain.doFilter(request, response); } @Inject  OAuthSecurityFilter(SessionSecurity sessionSecurity, SecuredResources securedResources, @UriPath String uriPath, @LoginPageUrl String loginPagePath); @Override void init(FilterConfig filterConfig); @Override void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain chain); @Override void destroy();  }
@Test public void happyPath() throws Exception { final Session session = new Session("token123"); final FakeHttpServletRequest servletRequest = new FakeHttpServletRequest("/auth", authCookie(session.value)); final FakeHttpServletResponse servletResponse = new FakeHttpServletResponse(); context.checking(new Expectations() {{ oneOf(sessionSecurity).exists(session); will(Expectations.returnValue(true)); oneOf(chain).doFilter(servletRequest, servletResponse); }}); filter.doFilter(servletRequest, servletResponse, chain); }
@Test public void invalidSession() throws Exception { final Session session = new Session("123token"); final FakeHttpServletRequest servletRequest = new FakeHttpServletRequest("/xxx?redirect_uri=http: final FakeHttpServletResponse servletResponse = new FakeHttpServletResponse(); context.checking(new Expectations() {{ oneOf(sessionSecurity).exists(session); will(Expectations.returnValue(false)); }}); filter.doFilter(servletRequest, servletResponse, chain); servletResponse.assertRedirectTo("/login?redirectUrl=%2Fxxx%3Fredirect_uri%3Dhttp%3A%2F%2Fabv.bg%2F"); }
@Test public void invalidSessionRedirectToThLoginPath() throws Exception { final Session session = new Session("123token"); final FakeHttpServletRequest servletRequest = new FakeHttpServletRequest("/xxx?redirect_uri=http: final FakeHttpServletResponse servletResponse = new FakeHttpServletResponse(); context.checking(new Expectations() {{ oneOf(sessionSecurity).exists(session); will(Expectations.returnValue(false)); }}); filter = new OAuthSecurityFilter(sessionSecurity,securedResources, "", "/loginPagePath"); filter.doFilter(servletRequest, servletResponse, chain); servletResponse.assertRedirectTo("/loginPagePath?redirectUrl=%2Fxxx%3Fredirect_uri%3Dhttp%3A%2F%2Fabv.bg%2F"); }
@Test public void unsecuredResource() throws Exception { final FakeHttpServletRequest servletRequest = new FakeHttpServletRequest("/login", authCookie("token")); final FakeHttpServletResponse servletResponse = new FakeHttpServletResponse(); context.checking(new Expectations() {{ oneOf(chain).doFilter(servletRequest, servletResponse); }}); filter.doFilter(servletRequest, servletResponse, chain); }