docs: B-0 — deploy the BFF and read what autoconfiguration actually chose
The authorized client repository is AuthenticatedPrincipalOAuth2AuthorizedClientRepository, keyed by principal with no session id in it, which is the mechanism behind the sharing problem Q1 and Q3 describe. Sharing a store does not fix a lookup key. Five problems on the way in: only build output was committed under bff/, a duplicate YAML key broke the image build and was invisible until the full log was captured, env placeholders without defaults broke the tests, actuator was behind the login redirect so a 200 was the login page, and the 117KB beans response failed through the proxy. Deploying two replicas made the login itself fail before any experiment started, because the authorization request lives in per-instance memory and the callback lands elsewhere. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
DongHyeonka
co-authored by
Claude Opus 5
Claude Opus 5
parent
8f6d67df35
commit
e62bbb4df0
@@ -0,0 +1 @@
|
||||
target/
|
||||
@@ -0,0 +1,14 @@
|
||||
FROM maven:3.9.11-eclipse-temurin-21-alpine AS build
|
||||
WORKDIR /workspace
|
||||
COPY pom.xml .
|
||||
RUN mvn --batch-mode dependency:go-offline
|
||||
COPY src src
|
||||
RUN mvn --batch-mode verify
|
||||
|
||||
FROM eclipse-temurin:21-jre-alpine
|
||||
RUN addgroup -S spring && adduser -S spring -G spring
|
||||
WORKDIR /app
|
||||
COPY --from=build /workspace/target/keycloak-bff.jar app.jar
|
||||
USER spring:spring
|
||||
EXPOSE 8083
|
||||
ENTRYPOINT ["java", "-jar", "/app/app.jar"]
|
||||
+58
@@ -0,0 +1,58 @@
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<project xmlns="http://maven.apache.org/POM/4.0.0"
|
||||
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
|
||||
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
|
||||
<modelVersion>4.0.0</modelVersion>
|
||||
|
||||
<parent>
|
||||
<groupId>org.springframework.boot</groupId>
|
||||
<artifactId>spring-boot-starter-parent</artifactId>
|
||||
<version>3.5.16</version>
|
||||
<relativePath/>
|
||||
</parent>
|
||||
|
||||
<groupId>com.example</groupId>
|
||||
<artifactId>keycloak-bff</artifactId>
|
||||
<version>0.0.1-SNAPSHOT</version>
|
||||
<name>keycloak-bff</name>
|
||||
|
||||
<properties>
|
||||
<java.version>21</java.version>
|
||||
</properties>
|
||||
|
||||
<dependencies>
|
||||
<dependency>
|
||||
<groupId>org.springframework.boot</groupId>
|
||||
<artifactId>spring-boot-starter-actuator</artifactId>
|
||||
</dependency>
|
||||
<dependency>
|
||||
<groupId>org.springframework.boot</groupId>
|
||||
<artifactId>spring-boot-starter-oauth2-client</artifactId>
|
||||
</dependency>
|
||||
<dependency>
|
||||
<groupId>org.springframework.boot</groupId>
|
||||
<artifactId>spring-boot-starter-web</artifactId>
|
||||
</dependency>
|
||||
|
||||
<dependency>
|
||||
<groupId>org.springframework.boot</groupId>
|
||||
<artifactId>spring-boot-starter-test</artifactId>
|
||||
<scope>test</scope>
|
||||
</dependency>
|
||||
<dependency>
|
||||
<groupId>org.springframework.security</groupId>
|
||||
<artifactId>spring-security-test</artifactId>
|
||||
<scope>test</scope>
|
||||
</dependency>
|
||||
</dependencies>
|
||||
|
||||
<build>
|
||||
<finalName>keycloak-bff</finalName>
|
||||
<plugins>
|
||||
<plugin>
|
||||
<groupId>org.springframework.boot</groupId>
|
||||
<artifactId>spring-boot-maven-plugin</artifactId>
|
||||
</plugin>
|
||||
</plugins>
|
||||
</build>
|
||||
</project>
|
||||
@@ -0,0 +1,12 @@
|
||||
package com.example.keycloakpattern.bff;
|
||||
|
||||
import org.springframework.boot.SpringApplication;
|
||||
import org.springframework.boot.autoconfigure.SpringBootApplication;
|
||||
|
||||
@SpringBootApplication
|
||||
public class BffApplication {
|
||||
|
||||
public static void main(String[] args) {
|
||||
SpringApplication.run(BffApplication.class, args);
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,112 @@
|
||||
package com.example.keycloakpattern.bff;
|
||||
|
||||
import java.util.LinkedHashMap;
|
||||
import java.util.Map;
|
||||
import java.util.concurrent.atomic.AtomicReference;
|
||||
|
||||
import org.springframework.beans.factory.annotation.Value;
|
||||
import org.springframework.http.CacheControl;
|
||||
import org.springframework.http.HttpHeaders;
|
||||
import org.springframework.http.ResponseEntity;
|
||||
import org.springframework.security.core.Authentication;
|
||||
import org.springframework.security.oauth2.client.OAuth2AuthorizeRequest;
|
||||
import org.springframework.security.oauth2.client.OAuth2AuthorizedClient;
|
||||
import org.springframework.security.oauth2.client.OAuth2AuthorizedClientManager;
|
||||
import org.springframework.security.oauth2.client.OAuth2AuthorizedClientService;
|
||||
import org.springframework.web.bind.annotation.GetMapping;
|
||||
import org.springframework.web.bind.annotation.PostMapping;
|
||||
import org.springframework.web.bind.annotation.RequestParam;
|
||||
import org.springframework.web.bind.annotation.RestController;
|
||||
import org.springframework.web.client.RestClient;
|
||||
import org.springframework.web.server.ResponseStatusException;
|
||||
|
||||
import static org.springframework.http.HttpStatus.UNAUTHORIZED;
|
||||
|
||||
@RestController
|
||||
public class BffController {
|
||||
|
||||
private final OAuth2AuthorizedClientService authorizedClientService;
|
||||
private final OAuth2AuthorizedClientManager authorizedClientManager;
|
||||
private final RestClient resourceApi;
|
||||
private final AtomicReference<String> theme = new AtomicReference<>("system");
|
||||
|
||||
public BffController(
|
||||
OAuth2AuthorizedClientService authorizedClientService,
|
||||
OAuth2AuthorizedClientManager authorizedClientManager,
|
||||
RestClient.Builder restClientBuilder,
|
||||
@Value("${resource-api.base-url}") String resourceApiBaseUrl
|
||||
) {
|
||||
this.authorizedClientService = authorizedClientService;
|
||||
this.authorizedClientManager = authorizedClientManager;
|
||||
this.resourceApi = restClientBuilder.baseUrl(resourceApiBaseUrl).build();
|
||||
}
|
||||
|
||||
@GetMapping("/bff/token-boundary")
|
||||
ResponseEntity<Map<String, Object>> tokenBoundary(Authentication authentication) {
|
||||
OAuth2AuthorizedClient client = authorizedClientService.loadAuthorizedClient(
|
||||
"keycloak",
|
||||
authentication.getName()
|
||||
);
|
||||
|
||||
Map<String, Object> response = new LinkedHashMap<>();
|
||||
response.put("pattern", "AP3-backend-for-frontend");
|
||||
response.put("principal", authentication.getName());
|
||||
response.put("accessTokenStoredOnServer", client != null
|
||||
&& client.getAccessToken() != null);
|
||||
response.put("refreshTokenStoredOnServer", client != null
|
||||
&& client.getRefreshToken() != null);
|
||||
response.put("browserTokenCount", 0);
|
||||
response.put("csrfProtectionEnabled", true);
|
||||
|
||||
return ResponseEntity.ok()
|
||||
.cacheControl(CacheControl.noStore())
|
||||
.header("Pragma", "no-cache")
|
||||
.body(response);
|
||||
}
|
||||
|
||||
@GetMapping("/bff/api/me")
|
||||
ResponseEntity<?> currentUser(Authentication authentication) {
|
||||
OAuth2AuthorizedClient client = authorizedClient(authentication);
|
||||
return resourceApi.get()
|
||||
.uri("/api/me")
|
||||
.header(
|
||||
HttpHeaders.AUTHORIZATION,
|
||||
"Bearer " + client.getAccessToken().getTokenValue()
|
||||
)
|
||||
.retrieve()
|
||||
.toEntity(Map.class);
|
||||
}
|
||||
|
||||
@PostMapping("/bff/api/preferences")
|
||||
Map<String, Object> updatePreference(
|
||||
Authentication authentication,
|
||||
@RequestParam(defaultValue = "system") String theme
|
||||
) {
|
||||
this.theme.set(theme);
|
||||
return Map.of(
|
||||
"updated", true,
|
||||
"theme", this.theme.get(),
|
||||
"principal", authentication.getName()
|
||||
);
|
||||
}
|
||||
|
||||
@GetMapping("/bff/api/preferences")
|
||||
Map<String, String> preference() {
|
||||
return Map.of("theme", theme.get());
|
||||
}
|
||||
|
||||
private OAuth2AuthorizedClient authorizedClient(Authentication authentication) {
|
||||
OAuth2AuthorizeRequest request = OAuth2AuthorizeRequest
|
||||
.withClientRegistrationId("keycloak")
|
||||
.principal(authentication)
|
||||
.build();
|
||||
OAuth2AuthorizedClient client = authorizedClientManager.authorize(request);
|
||||
if (client == null || client.getAccessToken() == null) {
|
||||
throw new ResponseStatusException(
|
||||
UNAUTHORIZED,
|
||||
"No authorized Keycloak client is available"
|
||||
);
|
||||
}
|
||||
return client;
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,25 @@
|
||||
package com.example.keycloakpattern.bff;
|
||||
|
||||
import java.util.Map;
|
||||
|
||||
import org.springframework.http.CacheControl;
|
||||
import org.springframework.http.ResponseEntity;
|
||||
import org.springframework.security.web.csrf.CsrfToken;
|
||||
import org.springframework.web.bind.annotation.GetMapping;
|
||||
import org.springframework.web.bind.annotation.RestController;
|
||||
|
||||
@RestController
|
||||
public class CsrfController {
|
||||
|
||||
@GetMapping("/bff/csrf")
|
||||
ResponseEntity<Map<String, String>> csrf(CsrfToken csrfToken) {
|
||||
return ResponseEntity.ok()
|
||||
.cacheControl(CacheControl.noStore())
|
||||
.header("Pragma", "no-cache")
|
||||
.body(Map.of(
|
||||
"headerName", csrfToken.getHeaderName(),
|
||||
"parameterName", csrfToken.getParameterName(),
|
||||
"token", csrfToken.getToken()
|
||||
));
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,85 @@
|
||||
package com.example.keycloakpattern.bff;
|
||||
|
||||
import org.springframework.context.annotation.Bean;
|
||||
import org.springframework.context.annotation.Configuration;
|
||||
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
|
||||
import org.springframework.security.oauth2.client.AuthorizedClientServiceOAuth2AuthorizedClientManager;
|
||||
import org.springframework.security.oauth2.client.OAuth2AuthorizedClientManager;
|
||||
import org.springframework.security.oauth2.client.OAuth2AuthorizedClientProvider;
|
||||
import org.springframework.security.oauth2.client.OAuth2AuthorizedClientProviderBuilder;
|
||||
import org.springframework.security.oauth2.client.OAuth2AuthorizedClientService;
|
||||
import org.springframework.security.oauth2.client.registration.ClientRegistrationRepository;
|
||||
import org.springframework.security.oauth2.client.web.DefaultOAuth2AuthorizationRequestResolver;
|
||||
import org.springframework.security.oauth2.client.web.OAuth2AuthorizationRequestCustomizers;
|
||||
import org.springframework.security.web.SecurityFilterChain;
|
||||
import org.springframework.security.web.csrf.CookieCsrfTokenRepository;
|
||||
|
||||
@Configuration
|
||||
public class SecurityConfig {
|
||||
|
||||
@Bean
|
||||
SecurityFilterChain bffSecurity(
|
||||
HttpSecurity http,
|
||||
ClientRegistrationRepository clientRegistrationRepository
|
||||
) throws Exception {
|
||||
DefaultOAuth2AuthorizationRequestResolver authorizationRequestResolver =
|
||||
new DefaultOAuth2AuthorizationRequestResolver(
|
||||
clientRegistrationRepository,
|
||||
"/oauth2/authorization"
|
||||
);
|
||||
authorizationRequestResolver.setAuthorizationRequestCustomizer(
|
||||
OAuth2AuthorizationRequestCustomizers.withPkce()
|
||||
);
|
||||
|
||||
CookieCsrfTokenRepository csrfTokenRepository =
|
||||
CookieCsrfTokenRepository.withHttpOnlyFalse();
|
||||
csrfTokenRepository.setCookiePath("/");
|
||||
|
||||
return http
|
||||
.csrf(csrf -> csrf
|
||||
.csrfTokenRepository(csrfTokenRepository)
|
||||
.csrfTokenRequestHandler(new SpaCsrfTokenRequestHandler()))
|
||||
.authorizeHttpRequests(authorize -> authorize
|
||||
.requestMatchers(
|
||||
"/",
|
||||
"/index.html",
|
||||
"/app.js",
|
||||
"/favicon.ico",
|
||||
"/actuator/health",
|
||||
"/actuator/health/**",
|
||||
// 실험대 전용 — B-0 은 "자동구성이 실제로 무엇을 골랐는가"를
|
||||
// 밖에서 읽어야 답할 수 있다. 운영에서는 절대 열지 않는다:
|
||||
// /actuator/beans 와 /actuator/env 는 내부 구조와 설정값을
|
||||
// 그대로 드러낸다.
|
||||
"/actuator/**"
|
||||
)
|
||||
.permitAll()
|
||||
.anyRequest()
|
||||
.authenticated())
|
||||
.oauth2Login(oauth2 -> oauth2
|
||||
.authorizationEndpoint(endpoint -> endpoint
|
||||
.authorizationRequestResolver(authorizationRequestResolver))
|
||||
.defaultSuccessUrl("/", true))
|
||||
.build();
|
||||
}
|
||||
|
||||
@Bean
|
||||
OAuth2AuthorizedClientManager authorizedClientManager(
|
||||
ClientRegistrationRepository clientRegistrationRepository,
|
||||
OAuth2AuthorizedClientService authorizedClientService
|
||||
) {
|
||||
OAuth2AuthorizedClientProvider authorizedClientProvider =
|
||||
OAuth2AuthorizedClientProviderBuilder.builder()
|
||||
.authorizationCode()
|
||||
.refreshToken()
|
||||
.build();
|
||||
|
||||
AuthorizedClientServiceOAuth2AuthorizedClientManager manager =
|
||||
new AuthorizedClientServiceOAuth2AuthorizedClientManager(
|
||||
clientRegistrationRepository,
|
||||
authorizedClientService
|
||||
);
|
||||
manager.setAuthorizedClientProvider(authorizedClientProvider);
|
||||
return manager;
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,40 @@
|
||||
package com.example.keycloakpattern.bff;
|
||||
|
||||
import java.util.function.Supplier;
|
||||
|
||||
import jakarta.servlet.http.HttpServletRequest;
|
||||
import jakarta.servlet.http.HttpServletResponse;
|
||||
|
||||
import org.springframework.security.web.csrf.CsrfToken;
|
||||
import org.springframework.security.web.csrf.CsrfTokenRequestAttributeHandler;
|
||||
import org.springframework.security.web.csrf.CsrfTokenRequestHandler;
|
||||
import org.springframework.security.web.csrf.XorCsrfTokenRequestAttributeHandler;
|
||||
import org.springframework.util.StringUtils;
|
||||
|
||||
final class SpaCsrfTokenRequestHandler implements CsrfTokenRequestHandler {
|
||||
|
||||
private final CsrfTokenRequestHandler plain =
|
||||
new CsrfTokenRequestAttributeHandler();
|
||||
private final CsrfTokenRequestHandler xor =
|
||||
new XorCsrfTokenRequestAttributeHandler();
|
||||
|
||||
@Override
|
||||
public void handle(
|
||||
HttpServletRequest request,
|
||||
HttpServletResponse response,
|
||||
Supplier<CsrfToken> deferredCsrfToken
|
||||
) {
|
||||
xor.handle(request, response, deferredCsrfToken);
|
||||
}
|
||||
|
||||
@Override
|
||||
public String resolveCsrfTokenValue(
|
||||
HttpServletRequest request,
|
||||
CsrfToken csrfToken
|
||||
) {
|
||||
if (StringUtils.hasText(request.getHeader(csrfToken.getHeaderName()))) {
|
||||
return plain.resolveCsrfTokenValue(request, csrfToken);
|
||||
}
|
||||
return xor.resolveCsrfTokenValue(request, csrfToken);
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,52 @@
|
||||
server:
|
||||
port: ${SERVER_PORT:8083}
|
||||
servlet:
|
||||
session:
|
||||
cookie:
|
||||
name: AP3_SESSION
|
||||
http-only: true
|
||||
same-site: lax
|
||||
|
||||
spring:
|
||||
application:
|
||||
name: keycloak-bff
|
||||
security:
|
||||
oauth2:
|
||||
client:
|
||||
registration:
|
||||
keycloak:
|
||||
provider: keycloak
|
||||
client-id: bff-confidential
|
||||
client-secret: ${KEYCLOAK_CLIENT_SECRET}
|
||||
client-authentication-method: client_secret_basic
|
||||
authorization-grant-type: authorization_code
|
||||
redirect-uri: "{baseUrl}/login/oauth2/code/{registrationId}"
|
||||
scope:
|
||||
- openid
|
||||
- profile
|
||||
- email
|
||||
provider:
|
||||
keycloak:
|
||||
# 브라우저가 리다이렉트되는 주소와 BFF 가 서버끼리 부르는 주소는 다르다.
|
||||
# 앞의 것은 외부에서 닿는 이름이어야 하고, 뒤의 것은 클러스터 안 주소여도 된다.
|
||||
authorization-uri: ${KC_ISSUER_EXTERNAL:http://localhost:8080/realms/keycloak-patterns}/protocol/openid-connect/auth
|
||||
token-uri: ${KC_ISSUER_INTERNAL:http://keycloak:8080/realms/keycloak-patterns}/protocol/openid-connect/token
|
||||
jwk-set-uri: ${KC_ISSUER_INTERNAL:http://keycloak:8080/realms/keycloak-patterns}/protocol/openid-connect/certs
|
||||
user-info-uri: ${KC_ISSUER_INTERNAL:http://keycloak:8080/realms/keycloak-patterns}/protocol/openid-connect/userinfo
|
||||
user-name-attribute: preferred_username
|
||||
|
||||
resource-api:
|
||||
base-url: ${RESOURCE_API_BASE_URL:http://localhost:8081}
|
||||
|
||||
management:
|
||||
endpoint:
|
||||
health:
|
||||
probes:
|
||||
enabled: true
|
||||
show-details: always
|
||||
endpoints:
|
||||
web:
|
||||
exposure:
|
||||
# beans / conditions 는 B-0 에서 "자동구성이 실제로 무엇을 골랐는가"를
|
||||
# 보기 위해 연다. 운영에 그대로 두면 내부 구조가 노출된다.
|
||||
include: health,info,beans,conditions,env
|
||||
@@ -0,0 +1,59 @@
|
||||
const result = document.querySelector("#result");
|
||||
|
||||
function render(value) {
|
||||
result.textContent = JSON.stringify(value, null, 2);
|
||||
}
|
||||
|
||||
function readCookie(name) {
|
||||
const prefix = `${encodeURIComponent(name)}=`;
|
||||
const value = document.cookie
|
||||
.split("; ")
|
||||
.find((cookie) => cookie.startsWith(prefix));
|
||||
return value ? decodeURIComponent(value.slice(prefix.length)) : null;
|
||||
}
|
||||
|
||||
async function request(path, options = {}) {
|
||||
const response = await fetch(path, {
|
||||
...options,
|
||||
headers: { Accept: "application/json", ...options.headers },
|
||||
});
|
||||
if (response.redirected || response.status === 401) {
|
||||
window.location.assign("/oauth2/authorization/keycloak");
|
||||
return null;
|
||||
}
|
||||
const body = await response.json();
|
||||
render({ status: response.status, ...body });
|
||||
return { response, body };
|
||||
}
|
||||
|
||||
document.querySelector("#login").addEventListener("click", () => {
|
||||
window.location.assign("/oauth2/authorization/keycloak");
|
||||
});
|
||||
|
||||
document.querySelector("#inspect").addEventListener("click", () => {
|
||||
void request("/bff/token-boundary");
|
||||
});
|
||||
|
||||
document.querySelector("#call-bff").addEventListener("click", () => {
|
||||
void request("/bff/api/me");
|
||||
});
|
||||
|
||||
document.querySelector("#change-with-csrf").addEventListener("click", async () => {
|
||||
const csrfResponse = await fetch("/bff/csrf", {
|
||||
headers: { Accept: "application/json" },
|
||||
});
|
||||
const csrf = await csrfResponse.json();
|
||||
const csrfToken = readCookie("XSRF-TOKEN");
|
||||
if (!csrfToken) {
|
||||
render({ status: 500, error: "XSRF-TOKEN cookie was not created" });
|
||||
return;
|
||||
}
|
||||
await request("/bff/api/preferences", {
|
||||
method: "POST",
|
||||
body: new URLSearchParams({ theme: "dark" }),
|
||||
headers: {
|
||||
"Content-Type": "application/x-www-form-urlencoded",
|
||||
[csrf.headerName]: csrfToken,
|
||||
},
|
||||
});
|
||||
});
|
||||
@@ -0,0 +1,31 @@
|
||||
<!doctype html>
|
||||
<html lang="ko">
|
||||
<head>
|
||||
<meta charset="utf-8">
|
||||
<meta name="viewport" content="width=device-width, initial-scale=1">
|
||||
<title>AP3 · Backend-for-Frontend</title>
|
||||
<style>
|
||||
:root { color-scheme: light dark; font-family: system-ui, sans-serif; }
|
||||
body { max-width: 58rem; margin: 6vh auto; padding: 0 1.5rem; line-height: 1.6; }
|
||||
button { margin: 0 0.5rem 0.5rem 0; padding: 0.6rem 0.9rem; cursor: pointer; }
|
||||
pre { min-height: 9rem; padding: 1rem; border-radius: 0.4rem;
|
||||
background: color-mix(in srgb, CanvasText 9%, Canvas); white-space: pre-wrap; }
|
||||
</style>
|
||||
</head>
|
||||
<body>
|
||||
<main>
|
||||
<h1>AP3 · Backend-for-Frontend</h1>
|
||||
<p>
|
||||
브라우저에는 OAuth token이 전혀 전달되지 않습니다. HttpOnly session
|
||||
cookie로 BFF만 호출하고, BFF가 서버 보관 access token을 Resource
|
||||
Server 요청에 붙입니다.
|
||||
</p>
|
||||
<button id="login" type="button">Keycloak 로그인</button>
|
||||
<button id="inspect" type="button">token 경계 확인</button>
|
||||
<button id="call-bff" type="button">BFF 경유 API 호출</button>
|
||||
<button id="change-with-csrf" type="button">CSRF token으로 상태 변경</button>
|
||||
<pre id="result" aria-live="polite"></pre>
|
||||
</main>
|
||||
<script type="module" src="/app.js"></script>
|
||||
</body>
|
||||
</html>
|
||||
@@ -0,0 +1,90 @@
|
||||
package com.example.keycloakpattern.bff;
|
||||
|
||||
import static org.mockito.Mockito.mock;
|
||||
import static org.mockito.Mockito.when;
|
||||
import static org.springframework.security.test.web.servlet.request.SecurityMockMvcRequestPostProcessors.oidcLogin;
|
||||
import static org.springframework.security.test.web.servlet.request.SecurityMockMvcRequestPostProcessors.csrf;
|
||||
import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get;
|
||||
import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.post;
|
||||
import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.header;
|
||||
import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.jsonPath;
|
||||
import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;
|
||||
|
||||
import org.junit.jupiter.api.Test;
|
||||
import org.springframework.beans.factory.annotation.Autowired;
|
||||
import org.springframework.boot.test.autoconfigure.web.servlet.AutoConfigureMockMvc;
|
||||
import org.springframework.boot.test.context.SpringBootTest;
|
||||
import org.springframework.security.oauth2.client.OAuth2AuthorizedClient;
|
||||
import org.springframework.security.oauth2.client.OAuth2AuthorizedClientManager;
|
||||
import org.springframework.security.oauth2.client.OAuth2AuthorizedClientService;
|
||||
import org.springframework.security.oauth2.core.OAuth2AccessToken;
|
||||
import org.springframework.security.oauth2.core.OAuth2RefreshToken;
|
||||
import org.springframework.test.context.bean.override.mockito.MockitoBean;
|
||||
import org.springframework.test.web.servlet.MockMvc;
|
||||
|
||||
@SpringBootTest(properties = {
|
||||
"KEYCLOAK_CLIENT_SECRET=test-only-secret",
|
||||
"resource-api.base-url=http://127.0.0.1:9"
|
||||
})
|
||||
@AutoConfigureMockMvc
|
||||
class BffControllerTest {
|
||||
|
||||
@Autowired
|
||||
private MockMvc mockMvc;
|
||||
|
||||
@MockitoBean
|
||||
private OAuth2AuthorizedClientService authorizedClientService;
|
||||
|
||||
@MockitoBean
|
||||
private OAuth2AuthorizedClientManager authorizedClientManager;
|
||||
|
||||
@Test
|
||||
void reportsServerTokenCustodyWithoutReturningTokens() throws Exception {
|
||||
OAuth2AuthorizedClient client = mock(OAuth2AuthorizedClient.class);
|
||||
when(client.getAccessToken()).thenReturn(mock(OAuth2AccessToken.class));
|
||||
when(client.getRefreshToken()).thenReturn(mock(OAuth2RefreshToken.class));
|
||||
when(authorizedClientService.loadAuthorizedClient("keycloak", "test-subject"))
|
||||
.thenReturn(client);
|
||||
|
||||
mockMvc.perform(get("/bff/token-boundary").with(oidcLogin()
|
||||
.idToken(token -> token.subject("test-subject"))))
|
||||
.andExpect(status().isOk())
|
||||
.andExpect(header().string("Cache-Control", "no-store"))
|
||||
.andExpect(jsonPath("$.accessTokenStoredOnServer").value(true))
|
||||
.andExpect(jsonPath("$.refreshTokenStoredOnServer").value(true))
|
||||
.andExpect(jsonPath("$.browserTokenCount").value(0))
|
||||
.andExpect(jsonPath("$.csrfProtectionEnabled").value(true))
|
||||
.andExpect(jsonPath("$.access_token").doesNotExist())
|
||||
.andExpect(jsonPath("$.refresh_token").doesNotExist());
|
||||
}
|
||||
|
||||
@Test
|
||||
void rejectsStateChangeWithoutCsrfToken() throws Exception {
|
||||
mockMvc.perform(post("/bff/api/preferences")
|
||||
.param("theme", "attacker")
|
||||
.with(oidcLogin().idToken(token -> token.subject("test-subject"))))
|
||||
.andExpect(status().isForbidden());
|
||||
}
|
||||
|
||||
@Test
|
||||
void acceptsStateChangeWithCsrfToken() throws Exception {
|
||||
mockMvc.perform(post("/bff/api/preferences")
|
||||
.param("theme", "dark")
|
||||
.with(oidcLogin().idToken(token -> token.subject("test-subject")))
|
||||
.with(csrf()))
|
||||
.andExpect(status().isOk())
|
||||
.andExpect(jsonPath("$.updated").value(true))
|
||||
.andExpect(jsonPath("$.theme").value("dark"));
|
||||
}
|
||||
|
||||
@Test
|
||||
void exposesSpaCsrfTokenWithoutCaching() throws Exception {
|
||||
mockMvc.perform(get("/bff/csrf").with(oidcLogin()
|
||||
.idToken(token -> token.subject("test-subject"))))
|
||||
.andExpect(status().isOk())
|
||||
.andExpect(header().string("Cache-Control", "no-store"))
|
||||
.andExpect(header().exists("Set-Cookie"))
|
||||
.andExpect(jsonPath("$.headerName").value("X-XSRF-TOKEN"))
|
||||
.andExpect(jsonPath("$.token").isNotEmpty());
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user