Vfrdtyky

I am trying to write some tests for a practice project with spring security and I am using MockMvc and related classes to do so.

So my basic configuration looks like this:

@Autowired

private WebApplicationContext context;



private MockMvc mvc;



@Before

public void setup() {

    mvc = MockMvcBuilders

            .webAppContextSetup(context)

            .apply(springSecurity())

            .build();

}

With tests similar to this one:

@Test

public void handleUserJSONRequest_shouldReturn401_withoutLoggedInUser() throws Exception{

    ResultActions action = mvc.perform(get("/userAsJSON"));



    int status = action.andReturn().getResponse().getStatus();

    assertTrue("expected status code = 401 ; current status code = " + status, status == 401);

}

What I still fail to achieve is to write a test to verify that my custom session-timeout is working.

I tried the following:

@Test

public void sessionTimeoutShouldInvalidateSession_withLoggedInUser() throws Exception{

    ResultActions action = mvc.perform(get("/userAsJSON").with(user("user")));

    MockHttpSession session = (MockHttpSession) action.andReturn().getRequest().getSession();



    TimeUnit.SECONDS.sleep(20);



    ResultActions action2 = mvc.perform(get("/userAsJSON").session(session));

    int status2 = action2.andReturn().getResponse().getStatus();



    assertTrue("expected status code = 401 ; current status code = " + status2, status2 == 401);

}

But it will still return 200 (session timeout is set to 10 for testing purposes and can be verified to be working via curl); so I assume that has something to do with how MockMvc and MockHttpSession work.

Is there a way I can still test my session-timeout's functionality?

EDIT: On request -> my configuration:

@Override

protected void configure(HttpSecurity http) throws Exception

{

    http.sessionManagement()

            //number of concurrent sessions allowed for the same user

            .maximumSessions(1)

            .and()

            .sessionFixation()

                .migrateSession();

    http.addFilterBefore(authenticationFilter(), BasicAuthenticationFilter.class)

            .csrf().disable()

            .httpBasic().disable()

            .exceptionHandling()

            .authenticationEntryPoint(myRestAuthenticationEntryPoint)

            .and()

            .authorizeRequests()

                .antMatchers("/secured")

                    .hasRole("ADMIN")

                .antMatchers("/userAsJSON")

                    .authenticated()

                .antMatchers("/unsecured")

                    .permitAll()

                .antMatchers("/login")

                    .permitAll()

                    .and()

            .logout()

                .logoutUrl("/logout")

                .logoutSuccessHandler(this::handleLogoutSuccess)

                .invalidateHttpSession(true);

}

with:

public void handleLogoutSuccess(HttpServletRequest request, HttpServletResponse response, Authentication authentication){

    response.setStatus(HttpServletResponse.SC_OK);

}

and:

@Component

public class MyRestAuthenticationEntryPoint

        implements AuthenticationEntryPoint {



    @Override

    public void commence(

            HttpServletRequest request,

            HttpServletResponse response,

            AuthenticationException authException) throws IOException {



        response.sendError( HttpServletResponse.SC_UNAUTHORIZED, "Unauthorized" );

    }

}