/*
- * $Header: /cvsroot/securityfilter/securityfilter/src/test/org/securityfilter/test/http/form/PostMethodTest.java,v 1.3 2003/07/07 13:14:07 maxcooper Exp $
- * $Revision: 1.3 $
- * $Date: 2003/07/07 13:14:07 $
+ * $Header: /cvsroot/securityfilter/securityfilter/src/test/org/securityfilter/test/http/form/PostMethodTest.java,v 1.4 2003/10/25 10:49:03 maxcooper Exp $
+ * $Revision: 1.4 $
+ * $Date: 2003/10/25 10:49:03 $
*
* ====================================================================
* The SecurityFilter Software License, Version 1.1
import org.securityfilter.test.http.TestBase;
/**
- * LogoutTest - tests the logout functionality.
+ * PostMethodTest - tests that POSTed parameters are maintained through an authentication sequence.
*
* @author Max Cooper (max@maxcooper.com)
- * @version $Revision: 1.3 $ $Date: 2003/07/07 13:14:07 $
+ * @version $Revision: 1.4 $ $Date: 2003/10/25 10:49:03 $
*/
public class PostMethodTest extends TestBase {
private static final String POST_VALUE = "it works!";
* @throws Exception
*/
public void testKeepPostedParametersThroughLogin() throws Exception {
- // load the Home page to get the session manipulation form
+ // load the Home page to get the POST input form
WebRequest request = new GetMethodWebRequest(baseUrl + "/index.jsp");
WebResponse response = session.getResponse(request);
assertPageTitle(response, Constants.SECURE_TITLE);
// make sure the item we submitted is present
- TableCell postedValue = (TableCell) response.getElementWithID(Constants.SECURE_POSTED_VALUE_ID);
+ WebForm form = response.getFormWithName(Constants.SECURE_POSTED_VALUE_FORM);
+ String postedValue = form.getParameterValue(Constants.SECURE_POSTED_VALUE_FIELD);
assertNotNull("POSTed parameter not found in reponse", postedValue);
- assertEquals("POSTed parameter did not have the right value", postedValue.asText(), POST_VALUE);
+ assertEquals("POSTed parameter did not have the right value", postedValue, POST_VALUE);
}
}
--- /dev/null
+/*
+ * $Header: /cvsroot/securityfilter/securityfilter/src/test/org/securityfilter/test/http/form/SessionInvalidationTest.java,v 1.1 2003/10/25 10:49:03 maxcooper Exp $
+ * $Revision: 1.1 $
+ * $Date: 2003/10/25 10:49:03 $
+ *
+ * ====================================================================
+ * The SecurityFilter Software License, Version 1.1
+ *
+ * (this license is derived and fully compatible with the Apache Software
+ * License - see http://www.apache.org/LICENSE.txt)
+ *
+ * Copyright (c) 2002 SecurityFilter.org. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1. Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *
+ * 2. Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in
+ * the documentation and/or other materials provided with the
+ * distribution.
+ *
+ * 3. The end-user documentation included with the redistribution,
+ * if any, must include the following acknowledgment:
+ * "This product includes software developed by
+ * SecurityFilter.org (http://www.securityfilter.org/)."
+ * Alternately, this acknowledgment may appear in the software itself,
+ * if and wherever such third-party acknowledgments normally appear.
+ *
+ * 4. The name "SecurityFilter" must not be used to endorse or promote
+ * products derived from this software without prior written permission.
+ * For written permission, please contact license@securityfilter.org .
+ *
+ * 5. Products derived from this software may not be called "SecurityFilter",
+ * nor may "SecurityFilter" appear in their name, without prior written
+ * permission of SecurityFilter.org.
+ *
+ * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESSED OR IMPLIED
+ * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
+ * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL THE SECURITY FILTER PROJECT OR
+ * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF
+ * USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+ * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+ * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ * ====================================================================
+ */
+
+package org.securityfilter.test.http.form;
+
+import com.meterware.httpunit.*;
+import org.securityfilter.example.Constants;
+import org.securityfilter.test.http.TestBase;
+
+/**
+ * SessionInvalidationTest - tests the logout functionality.
+ *
+ * @author Max Cooper (max@maxcooper.com)
+ * @version $Revision: 1.1 $ $Date: 2003/10/25 10:49:03 $
+ */
+public class SessionInvalidationTest extends TestBase {
+ private static final String POST_VALUE_1 = "post1";
+ private static final String POST_VALUE_2 = "post2";
+
+ /**
+ * Constructor
+ *
+ * @param name
+ */
+ public SessionInvalidationTest(String name) {
+ super(name);
+ }
+
+ /**
+ * Test that the session is kept if the user spontaneously logs in again with the same username.
+ *
+ * @throws Exception
+ */
+ public void testKeepSessionForSameUser() throws Exception {
+
+ // login
+ WebConversation session = new WebConversation();
+ WebRequest request = new PostMethodWebRequest(baseUrl + "/j_security_check");
+ request.setParameter(Constants.LOGIN_USERNAME_FIELD, Constants.VALID_USERNAME);
+ request.setParameter(Constants.LOGIN_PASSWORD_FIELD, Constants.VALID_PASSWORD);
+ WebResponse response = session.getResponse(request);
+
+ // post the first value
+ request = new GetMethodWebRequest(baseUrl + "/index.jsp");
+ response = session.getResponse(request);
+ WebForm sessionForm = response.getFormWithID(Constants.HOME_FORM_ID);
+ sessionForm.setParameter(Constants.HOME_POST_FIELD, POST_VALUE_1);
+ response = sessionForm.submit();
+
+ // login again as the same user in the same session
+ request = new PostMethodWebRequest(baseUrl + "/j_security_check");
+ request.setParameter(Constants.LOGIN_USERNAME_FIELD, Constants.VALID_USERNAME);
+ request.setParameter(Constants.LOGIN_PASSWORD_FIELD, Constants.VALID_PASSWORD);
+ response = session.getResponse(request);
+
+ // post the second value
+ request = new GetMethodWebRequest(baseUrl + "/index.jsp");
+ response = session.getResponse(request);
+ sessionForm = response.getFormWithID(Constants.HOME_FORM_ID);
+ sessionForm.setParameter(Constants.HOME_POST_FIELD, POST_VALUE_2);
+ response = sessionForm.submit();
+
+ // make sure the response leads us to secure page
+ assertPageTitle(response, Constants.SECURE_TITLE);
+
+ // ensure that both the first and second POSTed values appear on the secure page
+ WebForm form = response.getFormWithName(Constants.SECURE_POSTED_VALUE_FORM);
+ String firstPostedValue = form.getParameterValue(Constants.SECURE_LAST_POSTED_VALUE_FIELD);
+ assertNotNull("First POSTed parameter not found in reponse", firstPostedValue);
+ assertEquals("First POSTed parameter did not have the right value", firstPostedValue, POST_VALUE_1);
+ String secondPostedValue = form.getParameterValue(Constants.SECURE_POSTED_VALUE_FIELD);
+ assertNotNull("Second POSTed parameter not found in reponse", secondPostedValue);
+ assertEquals("Second POSTed parameter did not have the right value", secondPostedValue, POST_VALUE_2);
+ }
+
+ /**
+ * Test that the session is invalidated if the user spontaneously logs in again with a different username.
+ *
+ * @throws Exception
+ */
+ public void testInvaidateSessionForDifferentUser() throws Exception {
+
+ // login
+ WebConversation session = new WebConversation();
+ WebRequest request = new PostMethodWebRequest(baseUrl + "/j_security_check");
+ request.setParameter(Constants.LOGIN_USERNAME_FIELD, Constants.VALID_USERNAME);
+ request.setParameter(Constants.LOGIN_PASSWORD_FIELD, Constants.VALID_PASSWORD);
+ WebResponse response = session.getResponse(request);
+
+ // post the first value
+ request = new GetMethodWebRequest(baseUrl + "/index.jsp");
+ response = session.getResponse(request);
+ WebForm sessionForm = response.getFormWithID(Constants.HOME_FORM_ID);
+ sessionForm.setParameter(Constants.HOME_POST_FIELD, POST_VALUE_1);
+ response = sessionForm.submit();
+
+ // login again as a different user in the same session
+ request = new PostMethodWebRequest(baseUrl + "/j_security_check");
+ request.setParameter(Constants.LOGIN_USERNAME_FIELD, Constants.VALID_USERNAME2);
+ request.setParameter(Constants.LOGIN_PASSWORD_FIELD, Constants.VALID_PASSWORD2);
+ response = session.getResponse(request);
+
+ // post the second value
+ request = new GetMethodWebRequest(baseUrl + "/index.jsp");
+ response = session.getResponse(request);
+ sessionForm = response.getFormWithID(Constants.HOME_FORM_ID);
+ sessionForm.setParameter(Constants.HOME_POST_FIELD, POST_VALUE_2);
+ response = sessionForm.submit();
+
+ // make sure the response leads us to secure page
+ assertPageTitle(response, Constants.SECURE_TITLE);
+
+ // ensure that both the first and second POSTed values appear on the secure page
+ WebForm form = response.getFormWithName(Constants.SECURE_POSTED_VALUE_FORM);
+ String firstPostedValue = form.getParameterValue(Constants.SECURE_LAST_POSTED_VALUE_FIELD);
+ assertNull("First POSTed parameter found in response, but it shouldn't be there", firstPostedValue);
+ String secondPostedValue = form.getParameterValue(Constants.SECURE_POSTED_VALUE_FIELD);
+ assertNotNull("Second POSTed parameter not found in reponse", secondPostedValue);
+ assertEquals("Second POSTed parameter did not have the right value", secondPostedValue, POST_VALUE_2);
+ }
+}
projects / securityfilter.git / commitdiff