AuthenticityFilter implements Filter { @Override public Result filter(FilterChain filterChain, Context context) { String authenticityToken = context.getParameter(NinjaConstant.AUTHENTICITY_TOKEN); if (!context.getSession().getAuthenticityToken().equals(authenticityToken)) { logger.warn("Authenticity token mismatch. Request from {} is forbidden!", context.getRemoteAddr()); return ninja.getForbiddenResult(context); } return filterChain.next(context); } @Inject  AuthenticityFilter(Ninja ninja); @Override Result filter(FilterChain filterChain, Context context);  }
@Test public void testAuthenticityFail() { when(context.getParameter(NinjaConstant.AUTHENTICITY_TOKEN)).thenReturn("foo"); when(context.getSession()).thenReturn(session); when(context.getSession().getAuthenticityToken()).thenReturn("bar"); this.authenticityFilter.filter(filterChain, context); Mockito.verify(ninjaDefault).getForbiddenResult(context); }
@Test public void testAuthenticityWorks() { when(context.getParameter(NinjaConstant.AUTHENTICITY_TOKEN)).thenReturn("foo"); when(context.getSession()).thenReturn(session); when(context.getSession().getAuthenticityToken()).thenReturn("foo"); this.authenticityFilter.filter(filterChain, context); Mockito.verify(filterChain).next(context); }