CODEWITHSUNDEEP
unit-testingspring-bootspring-securityspring-test-mvc
BokC
BokC

Reputation: 332

How to disable securty on controller Unit Test?

I try to disable the security on controller Unit test but I allways have error 403.

My Unit Test :

@RunWith(SpringRunner.class)
@WebMvcTest(value = MeasureController.class, secure = false)
@AutoConfigureMockMvc(secure = false)
public class MeasureControllerTest {

    @Autowired
    private MockMvc mvc;
    @Autowired
    private ObjectMapper objectMapper;
    @MockBean
    private ObjectService objectService;
    @Autowired
    private MeasureController measureController;

    /**
     * Test of sayHello method, of class MeasureController.
     *
     * @throws java.lang.Exception
     */
    @Test
    public void OnPostShouldReturnCreatedStatusIfEmptyMeasure() throws Exception {
        final String url = "/object/" + uuidKey + "/measures/";
        this.mvc.perform(post(url)
                .content("[]")
                .contentType(MediaType.APPLICATION_JSON)
                .accept(MediaType.APPLICATION_JSON))
                .andExpect(status().isCreated());

        verifyZeroInteractions(objectService);
    }
}

The security configuration :

@Configuration
@EnableResourceServer
public class SecurityResourceServerConfig extends ResourceServerConfigurerAdapter {

    @Override
    public void configure(HttpSecurity http) throws Exception {
        http
                .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS)
                .and().authorizeRequests()
                .antMatchers("/v2/api-docs", "/swagger-resources/**", "/swagger-ui.html", "/webjars/**").permitAll()
                .anyRequest().authenticated()
                ;
    }

    @Primary
    @Bean
    public RemoteTokenServices tokenServices() {
        final RemoteTokenServices tokenService = new RemoteTokenServices();
        tokenService.setCheckTokenEndpointUrl("https://..../oauth/check_token");
        tokenService.setClientId(".....");
        tokenService.setClientSecret(".....");
        return tokenService;
    }
}

The spring documentation say to put AutoConfigureMockMvc.secure to false or the WebMvcTest.secure to false. But the both not disable the security. I mis something?

I use Spring boot 2.0.4. and spring-security-oauth2 2.3.3.RELEASE

Upvotes: 1

Views: 5610

Answers (2)

Lili
Lili

Reputation: 843

For others who come here looking for answers (and my future self), tested in Spring Boot 2.2:

@WebMvcTest(controllers = YourController.class,
        excludeFilters = { @ComponentScan.Filter(type = FilterType.ASSIGNABLE_TYPE, value = WebSecurityConfigurer.class) },
        excludeAutoConfiguration = { SecurityAutoConfiguration.class})

Upvotes: 2

BokC
BokC

Reputation: 332

The "WebMvcTest.secure" was deprecated. You have to put to your controller test :

@RunWith(SpringRunner.class)
@WebMvcTest(value = PatientDeviceController.class, excludeAutoConfiguration = SecurityAutoConfiguration.class)
@AutoConfigureMockMvc(secure = false)

Upvotes: 1

Related Questions