BasicAuthSecurityFilter implements Filter { @Override public void doFilter(final ServletRequest _request, final ServletResponse _response, final FilterChain chain) throws IOException, ServletException { final HttpServletRequest request = (HttpServletRequest) _request; final HttpServletResponse response = (HttpServletResponse) _response; if (isExceptionPath(request)) { chain.doFilter(request, response); return; } HttpSession session = request.getSession(false); final User user = authenticationService.getUser(); try { if (user == null) { if (authenticate(request)) { chain.doFilter(request, response); if (response.isCommitted()) { authenticationService.logout(); } } else { challengeClient(request, response); } } else { chain.doFilter(request, response); } } finally { if (session == null && invalidate) { session = request.getSession(false); if (session != null) { session.invalidate(); } } } }  @Override void init(final FilterConfig filterConfig); @Override void destroy(); @Override void doFilter(final ServletRequest _request,
                         final ServletResponse _response,
                         final FilterChain chain); void challengeClient(final HttpServletRequest request,
                                final HttpServletResponse response); static final String REALM_NAME_PARAM; static final String INVALIDATE_PARAM; static final String EXCEPTION_PATHS; }
@Test public void testIndependentSessionInvalidated() throws Exception { SessionProvider sessionProvider = new SessionProvider(httpSession, 1); when(authenticationService.getUser()).thenReturn(new UserImpl("testUser")); when(request.getSession(anyBoolean())).then((InvocationOnMock invocationOnMock) -> sessionProvider.provideSession()); final BasicAuthSecurityFilter filter = new BasicAuthSecurityFilter(); filter.authenticationService = authenticationService; filter.doFilter(request, response, chain); verify(httpSession, times(1)).invalidate(); }
@Test public void testExistingSessionNotInvalidated() throws Exception { SessionProvider sessionProvider = new SessionProvider(httpSession); when(authenticationService.getUser()).thenReturn(new UserImpl("testUser")); when(request.getSession(anyBoolean())).then((InvocationOnMock invocationOnMock) -> sessionProvider.provideSession()); final BasicAuthSecurityFilter filter = new BasicAuthSecurityFilter(); filter.authenticationService = authenticationService; filter.doFilter(request, response, chain); verify(httpSession, never()).invalidate(); }
@Test public void testEmptyPassword() throws Exception { String username = "fakeUser"; String password = ""; String authData = username + ":" + password; String authEncoded = Base64.encodeBase64String(authData.getBytes()); when(request.getHeader("Authorization")).thenReturn("Basic " + authEncoded); final BasicAuthSecurityFilter filter = new BasicAuthSecurityFilter(); filter.authenticationService = authenticationService; filter.doFilter(request, response, chain); verify(authenticationService, times(1)).login(username, password); }