CurrentUserCookieFactory { public Cookie getCookie(UaaPrincipal uaaPrincipal) throws CurrentUserCookieEncodingException { CurrentUserInformation currentUserInformation = new CurrentUserInformation(); currentUserInformation.setUserId(uaaPrincipal.getId()); Cookie cookie = new Cookie(CURRENT_USER_COOKIE_NAME, urlEncode(JsonUtils.writeValueAsString(currentUserInformation))); cookie.setPath("/"); cookie.setHttpOnly(false); cookie.setSecure(secure); cookie.setMaxAge(sessionTimeout); return cookie; } CurrentUserCookieFactory(int sessionTimeout, boolean secure); Cookie getCookie(UaaPrincipal uaaPrincipal); Cookie getNullCookie(); public String CURRENT_USER_COOKIE_NAME; }
@Test void getCookie_returnsCookieWithNameCurrentUser() throws Exception { Cookie cookie = factory.getCookie(uaaPrincipal); assertEquals("Current-User", cookie.getName()); }
@Test void getCookie_returnsCookieMaxAgeEqualToSessionTimeout() throws Exception { Cookie cookie = factory.getCookie(uaaPrincipal); assertEquals(sessionTimeout, cookie.getMaxAge()); }
@Test void getCookie_setsContextPath() throws Exception { Cookie cookie = factory.getCookie(uaaPrincipal); assertEquals("/", cookie.getPath()); }
@Test void getCookie_containsUrlEncodedJsonBody() throws Exception { Cookie cookie = factory.getCookie(uaaPrincipal); assertEquals("%7B%22userId%22%3A%22user-guid%22%7D", cookie.getValue()); String decoded = URLDecoder.decode(cookie.getValue(), StandardCharsets.UTF_8); JsonNode parsedCookie = JsonUtils.readTree(decoded); assertEquals("\"user-guid\"", parsedCookie.get("userId").toString()); }
@Test void getCookie_doesNotIncludePersonallyIdentifiableInformation() throws Exception { Cookie cookie = factory.getCookie(uaaPrincipal); assertThat(cookie.getValue(), not(containsString(username))); assertThat(cookie.getValue(), not(containsString(email))); }
@Test void getCookie_isNotHttpOnlyBecauseSingularReadsFromBrowserJS() throws Exception { Cookie cookie = factory.getCookie(uaaPrincipal); assertFalse(cookie.isHttpOnly()); }