Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Sign up
Appearance settings

Commit 53573ab

Browse files
author
Houssam El Mansouri
committed
Align JWT Testing Documentation
Signed-off-by: Houssam El Mansouri <elmansouri.houssam@gmail.com>
1 parent 628f3da commit 53573ab

File tree

2 files changed

+102
-8
lines changed

2 files changed

+102
-8
lines changed

‎docs/modules/ROOT/pages/reactive/test/web/oauth2.adoc‎

Lines changed: 51 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -787,11 +787,58 @@ client
787787
======
788788

789789
[[webflux-testing-jwt]]
790-
== Testing JWT Authentication
790+
== Testing OAuth 2.0 Resource Servers with JWT
791791

792-
To make an authorized request on a resource server, you need a bearer token.
793-
If your resource server is configured for JWTs, the bearer token needs to be signed and then encoded according to the JWT specification.
794-
All of this can be quite daunting, especially when this is not the focus of your test.
792+
Similar to <<webflux-testing-opaque-token,opaque tokens>>, JWTs require an authorization server in order to verify their validity, which can make testing more difficult.
793+
To help with that, Spring Security has test support for JWTs.
794+
795+
Suppose you have a controller that retrieves the authentication as a `Jwt`:
796+
797+
[tabs]
798+
======
799+
Java::
800+
+
801+
[source,java,role="primary"]
802+
----
803+
@GetMapping("/endpoint")
804+
public Mono<String> foo(@AuthenticationPrincipal Jwt jwt) {
805+
return Mono.just(jwt.getClaimAsString("sub"));
806+
}
807+
----
808+
809+
Kotlin::
810+
+
811+
[source,kotlin,role="secondary"]
812+
----
813+
@GetMapping("/endpoint")
814+
fun foo(@AuthenticationPrincipal jwt: Jwt): Mono<String> {
815+
return Mono.just(jwt.getClaimAsString("sub"))
816+
}
817+
----
818+
======
819+
820+
In that case, you can tell Spring Security to include a default `Jwt` by using the `SecurityMockServerConfigurers#mockJwt` method:
821+
822+
[tabs]
823+
======
824+
Java::
825+
+
826+
[source,java,role="primary"]
827+
----
828+
client
829+
.mutateWith(mockJwt()).get().uri("/endpoint").exchange();
830+
----
831+
832+
Kotlin::
833+
+
834+
[source,kotlin,role="secondary"]
835+
----
836+
client
837+
.mutateWith(mockJwt()).get().uri("/endpoint").exchange()
838+
----
839+
======
840+
841+
This example creates a mock `Jwt` and passes it through any authentication APIs so that it is available for your authorization mechanisms to verify.
795842

796843
Fortunately, there are a number of simple ways in which you can overcome this difficulty and let your tests focus on authorization and not on representing bearer tokens.
797844
We look at two of them in the next two subsections.

‎docs/modules/ROOT/pages/servlet/test/mockmvc/oauth2.adoc‎

Lines changed: 51 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -790,12 +790,59 @@ mvc.get("/endpoint") {
790790
======
791791

792792
[[testing-jwt]]
793-
== Testing JWT Authentication
793+
== Testing OAuth 2.0 Resource Servers with JWT
794794

795-
In order to make an authorized request on a resource server, you need a bearer token.
795+
Similar to <<testing-opaque-token,opaque tokens>>, JWTs require an authorization server in order to verify their validity, which can make testing more difficult.
796+
To help with that, Spring Security has test support for JWTs.
796797

797-
If your resource server is configured for JWTs, then this would mean that the bearer token needs to be signed and then encoded according to the JWT specification.
798-
All of this can be quite daunting, especially when this isn't the focus of your test.
798+
Let's say that we've got a controller that retrieves the authentication as a `Jwt`:
799+
800+
[tabs]
801+
======
802+
Java::
803+
+
804+
[source,java,role="primary"]
805+
----
806+
@GetMapping("/endpoint")
807+
public String foo(@AuthenticationPrincipal Jwt jwt) {
808+
return jwt.getClaimAsString("sub");
809+
}
810+
----
811+
812+
Kotlin::
813+
+
814+
[source,kotlin,role="secondary"]
815+
----
816+
@GetMapping("/endpoint")
817+
fun foo(@AuthenticationPrincipal jwt: Jwt): String {
818+
return jwt.getClaimAsString("sub")
819+
}
820+
----
821+
======
822+
823+
In that case, we can tell Spring Security to include a default `Jwt` using the `jwt` xref:servlet/test/mockmvc/request-post-processors.adoc[`RequestPostProcessor`], like so:
824+
825+
[tabs]
826+
======
827+
Java::
828+
+
829+
[source,java,role="primary"]
830+
----
831+
mvc
832+
.perform(get("/endpoint").with(jwt()));
833+
----
834+
835+
Kotlin::
836+
+
837+
[source,kotlin,role="secondary"]
838+
----
839+
mvc.get("/endpoint") {
840+
with(jwt())
841+
}
842+
----
843+
======
844+
845+
What this will do is create a mock `Jwt`, passing it correctly through any authentication APIs so that it's available for your authorization mechanisms to verify.
799846

800847
Fortunately, there are a number of simple ways that you can overcome this difficulty and allow your tests to focus on authorization and not on representing bearer tokens.
801848
We'll look at two of them now:

0 commit comments

Comments
(0)

AltStyle によって変換されたページ (->オリジナル) /