Spring Security Testing

Testing security configurations in your Spring Boot application is crucial to ensure that your application is properly secured. This guide covers key concepts and steps for testing Spring Security, including adding dependencies, configuring test security, and writing tests for secured endpoints.

Key Concepts of Spring Security Testing

• Security Testing: Validating that your security configurations work as expected.
• Mock Authentication: Simulating authentication in tests to validate secured endpoints.
• Test Configuration: Configuring Spring Security in test environments.

Adding Dependencies

Include the Spring Security Test dependency in your pom.xml file:

<dependency>
    <groupId>org.springframework.security</groupId>
    <artifactId>spring-security-test</artifactId>
    <version>5.4.6</version>
    <scope>test</scope>
</dependency>

Configuring Test Security

Configure security for your tests by creating a test configuration class:

Example: TestSecurityConfig.java

// TestSecurityConfig.java
package com.example.myapp.config;

import org.springframework.boot.test.context.TestConfiguration;
import org.springframework.context.annotation.Bean;
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
import org.springframework.security.core.userdetails.UserDetailsService;
import org.springframework.security.provisioning.InMemoryUserDetailsManager;
import org.springframework.security.core.userdetails.User;

@TestConfiguration
public class TestSecurityConfig extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(AuthenticationManagerBuilder auth) throws Exception {
        auth.inMemoryAuthentication()
            .withUser("user").password("{noop}password").roles("USER")
            .and()
            .withUser("admin").password("{noop}admin").roles("ADMIN");
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.csrf().disable()
            .authorizeRequests().anyRequest().authenticated()
            .and().httpBasic();
    }

    @Bean
    @Override
    public UserDetailsService userDetailsService() {
        return new InMemoryUserDetailsManager(
            User.withUsername("user").password("{noop}password").roles("USER").build(),
            User.withUsername("admin").password("{noop}admin").roles("ADMIN").build());
    }
}

Writing Security Tests

Write tests for secured endpoints using the @WithMockUser annotation:

Example: SecurityTests.java

// SecurityTests.java
package com.example.myapp;

import com.example.myapp.config.TestSecurityConfig;
import org.junit.jupiter.api.Test;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.boot.test.autoconfigure.web.servlet.WebMvcTest;
import org.springframework.context.annotation.Import;
import org.springframework.security.test.context.support.WithMockUser;
import org.springframework.test.web.servlet.MockMvc;

import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get;
import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;

@WebMvcTest
@Import(TestSecurityConfig.class)
public class SecurityTests {

    @Autowired
    private MockMvc mockMvc;

    @Test
    @WithMockUser(username = "user", roles = {"USER"})
    public void testUserAccess() throws Exception {
        mockMvc.perform(get("/user"))
                .andExpect(status().isOk());
    }

    @Test
    @WithMockUser(username = "admin", roles = {"ADMIN"})
    public void testAdminAccess() throws Exception {
        mockMvc.perform(get("/admin"))
                .andExpect(status().isOk());
    }

    @Test
    public void testUnauthorizedAccess() throws Exception {
        mockMvc.perform(get("/admin"))
                .andExpect(status().isUnauthorized());
    }
}

Using Security MockMvc

Use SecurityMockMvcRequestPostProcessors for more advanced security testing:

Example: AdvancedSecurityTests.java

// AdvancedSecurityTests.java
package com.example.myapp;

import com.example.myapp.config.TestSecurityConfig;
import org.junit.jupiter.api.Test;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.boot.test.autoconfigure.web.servlet.WebMvcTest;
import org.springframework.context.annotation.Import;
import org.springframework.security.test.web.servlet.request.SecurityMockMvcRequestPostProcessors;
import org.springframework.test.web.servlet.MockMvc;

import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get;
import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;

@WebMvcTest
@Import(TestSecurityConfig.class)
public class AdvancedSecurityTests {

    @Autowired
    private MockMvc mockMvc;

    @Test
    public void testUserAccess() throws Exception {
        mockMvc.perform(get("/user").with(SecurityMockMvcRequestPostProcessors.user("user").roles("USER")))
                .andExpect(status().isOk());
    }

    @Test
    public void testAdminAccess() throws Exception {
        mockMvc.perform(get("/admin").with(SecurityMockMvcRequestPostProcessors.user("admin").roles("ADMIN")))
                .andExpect(status().isOk());
    }

    @Test
    public void testUnauthorizedAccess() throws Exception {
        mockMvc.perform(get("/admin"))
                .andExpect(status().isUnauthorized());
    }
}

Key Points

Conclusion

Testing Spring Security configurations is essential to ensure that your application is properly secured. By understanding and implementing security testing, mock authentication, and test configuration, you can validate the security of your Spring Boot application. Happy coding!