CsrfAwareEntryPointAndDeniedHandler implements AccessDeniedHandler, AuthenticationEntryPoint { @Override public void handle(HttpServletRequest request, HttpServletResponse response, AccessDeniedException accessDeniedException) throws IOException, ServletException { request.setAttribute(WebAttributes.ACCESS_DENIED_403, accessDeniedException); internalHandle(request, response, accessDeniedException); } CsrfAwareEntryPointAndDeniedHandler(String login, String redirectCsrf, String redirectNotLoggedIn);  CsrfAwareEntryPointAndDeniedHandler(String redirectCsrf, String redirectNotLoggedIn); @Override void handle(HttpServletRequest request,
                       HttpServletResponse response,
                       AccessDeniedException accessDeniedException); @Override void commence(HttpServletRequest request, HttpServletResponse response, AuthenticationException authException);  }
@Test public void testHandleWhenNotLoggedInAndNoCsrf() throws Exception { AccessDeniedException ex = new MissingCsrfTokenException("something"); handler.handle(request, response, ex); assertEquals(HttpServletResponse.SC_FOUND, response.getStatus()); assertSame(request.getAttribute(WebAttributes.ACCESS_DENIED_403), ex); assertTrue(response.isCommitted()); assertEquals("http: assertEquals(HttpServletResponse.SC_MOVED_TEMPORARILY, response.getStatus()); }
@Test public void testHandleWhenCsrfMissingForJson() throws Exception { request.addHeader("Accept", MediaType.APPLICATION_JSON_VALUE); AccessDeniedException ex = new MissingCsrfTokenException("something"); handler.handle(request, response, ex); assertEquals(HttpServletResponse.SC_FORBIDDEN, response.getStatus()); assertEquals("{\"error\":\"Could not verify the provided CSRF token because your session was not found.\"}", response.getContentAsString()); assertNull(response.getErrorMessage()); }
@Test public void testHandleWhenNotLoggedIn() throws Exception { AccessDeniedException ex = new AccessDeniedException("something"); handler.handle(request, response, ex); assertEquals(HttpServletResponse.SC_FOUND, response.getStatus()); assertSame(request.getAttribute(WebAttributes.ACCESS_DENIED_403), ex); assertTrue(response.isCommitted()); assertEquals("http: assertEquals(HttpServletResponse.SC_MOVED_TEMPORARILY, response.getStatus()); }
@Test public void testHandleWhenNotLoggedInJson() throws Exception { request.addHeader("Accept", MediaType.APPLICATION_JSON_VALUE); AccessDeniedException ex = new AccessDeniedException("something"); handler.handle(request, response, ex); assertEquals(HttpServletResponse.SC_FORBIDDEN, response.getStatus()); assertEquals("{\"error\":\"something\"}", response.getContentAsString()); assertNull(response.getErrorMessage()); }