SEC-3211: SecurityContextRequestPostProcessorSupport dirties context and causes side effects

[spring-projects-issues]

Martin Bonato (Migrated from SEC-3211) said:

Using SecurityMockMvcRequestPostProcessors like authentication(), securityContext(), testSecurityContext(), user(), etc. in unit tests might cause side effects on other tests in the same application context.

SecurityMockMvcRequestPostProcessors.SecurityContextRequestPostProcessorSupport.save(SecurityContext, HttpServletRequest) calls WebTestUtils.setSecurityContextRepository(HttpServletRequest, SecurityContextRepository) to set a TestSecurityContextRepository in the SecurityContextPersistenceFilter registered in the application context. This dirties the context, because a registered bean (SecurityContextPersistenceFilter) is modified such that it causes side effects.

Since the side effects are rather rare and seem to show up randomly, it took me a while to track down the issue.

Here is an example of two unit tests where the first unit test influences the second:

    @Test
    @WithMockUser
    public void test1() throws Exception {
        mvc.perform(get("/"))//
                .andExpect(authenticated().withRoles("USER"));
    }

    // fails if executed after test1 in the same context
    @Test
    public void test2() throws Exception {
        mvc.perform(get("/"))//
            .andExpect(unauthenticated());
    }

If test2() is executed in its own application context it succeeds, since the default HttpSessionSecurityContexRepository used by the SecurityContextPersistenceFilter does not store anonymous authentication tokens. However, if test2() is executed after test1() in the same context it fails, because @WithMocUser caused the TestSecurityContextRepository to be registered which stores anonymous authentication tokens.

[rwinch]

@mbonato Thanks for reporting SEC-3211. We migrated all our issues on GitHub.

I'm running this with the latest version of Spring Security and unable to reproduce an issue. Can you expand on the problem you are encountering?

[mbonato]

@rwinch I've created a test case for the issue: https://github.com/primesign/spring-security-issue3409. The test case still fails with the current release candidate 4.1.0.RC1.

[rwinch]

@mbonato Thanks for the sample application. The problem appears to only happen when accessing public URLs. I created a PR to address this. See #3818