Support Spring Security with @WebMvcTest

[philwebb]

The new annotation needs to really work with Spring Security.

[wilkinsona]

Here's one possible approach. It adds a new @AutoConfigureSecurity annotation which imports SecurityAutoConfiguration and auto-configures a MockMvcBuilderCustomizer that applies SecurityMockMvcConfigurers.springSecurity() to the builder.

A test that uses it looks like this:

@RunWith(SpringRunner.class)
@WebMvcTest
@AutoConfigureSecurity
@TestPropertySource(properties = "security.user.password=secret")
public class Gh5476ApplicationTests {

    @Autowired
    MockMvc mockMvc;

    @Test
    @WithMockUser(username = "test", password = "test", roles = "USER")
    public void okResponseWithMockUser() throws Exception {
        this.mockMvc.perform(get("/")).andExpect(status().isOk());
    }

    @Test
    public void unauthorizedResponseWithNoUser() throws Exception {
        this.mockMvc.perform(get("/")).andExpect(status().isUnauthorized());
    }

    @Test
    public void okResponseWithBasicAuthCredentialsForKnownUser() throws Exception {
        this.mockMvc
                .perform(get("/").header(HttpHeaders.AUTHORIZATION,
                        "Basic " + Base64Utils.encodeToString("user:secret".getBytes())))
                .andExpect(status().isOk());
    }

}

I'm undecided on the separate @AutoConfigureSecurity annotation. I wonder if we could achieve the same end result with a secure attribute on @WebMvcTest? @rwinch @philwebb, what do you think?

One thing that I haven't addressed yet is that Spring Security's filter is added twice. I think we need a way for security test auto-configuration to prevent the security filter from being added in the general purpose auto-configuration of MockMvc.

[rwinch]

@wilkinsona I'd prefer to have it enabled by default. After all if users want customizations, they still can leverage the MockMvc API directly or use the customizer. Another possibility would be to set @TestPropertySource security.test=false to disable it (perhaps that is what you meant)

[wilkinsona]

Thinking about this some more, we can't use springSecurity() as it applies the security filter without considering the other filters and their ordering. To keep all of the filters in the user's desired order, we'll have to rely on the existing mechanism for filter registration. Well then call testSecurityContext() and, whenever we pick up a new version of Spring Security, check that springSecurity() hasn't been changed to do anything other than add the filter and apply testSecurityContext().