Unit testing with Spring Security

Spring Security

Unit Testing

Java

Software Testing

Application Security

Unit testing with Spring Security

System Design practice on Codemia

Work through 120+ system design problems with detailed solutions, from rate limiters to multi-region storage.

Practice system design

Security & Auth Java Testing

Unit testing is an essential part of software development which ensures the reliability and correctness of your code. In the context of Spring Security, unit testing is critical to verify that your security configurations and logic are functioning as intended. This article provides a comprehensive guide on how to perform unit testing with Spring Security, highlighting key concepts, configurations, and examples to get you started.

Introduction to Unit Testing in Spring Security

Spring Security is a powerful and customizable authentication and access control framework for Java applications. Unit testing focuses on validating the smallest testable parts of your code, such as methods or classes, to ensure they perform as expected. When it comes to Spring Security, unit tests help confirm that security restrictions and configurations behave correctly.

Prerequisites

Before diving into unit testing with Spring Security, ensure that you have the following prerequisites:

Understanding of Java programming
Familiarity with Spring Framework and Spring Security
Knowledge of JUnit and Mockito

Setting Up Your Environment

To get started with unit testing in Spring Security, ensure you have the necessary dependencies in your project. If you are using Maven, add the following dependencies to your pom.xml:

xml

1<dependency>
2    <groupId>org.springframework.boot</groupId>
3    <artifactId>spring-boot-starter-security</artifactId>
4</dependency>
5<dependency>
6    <groupId>org.springframework.boot</groupId>
7    <artifactId>spring-boot-starter-test</artifactId>
8    <scope>test</scope>
9</dependency>
10<dependency>
11    <groupId>org.mockito</groupId>
12    <artifactId>mockito-core</artifactId>
13    <scope>test</scope>
14</dependency>
15<dependency>
16    <groupId>org.springframework.security</groupId>
17    <artifactId>spring-security-test</artifactId>
18    <scope>test</scope>
19</dependency>

Unit Testing Security Configurations

When testing security configurations, you usually check if your URL endpoints are protected as expected. Consider a simple security configuration as shown below:

java

1import org.springframework.context.annotation.Bean;
2import org.springframework.security.config.annotation.web.builders.HttpSecurity;
3import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
4import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
5
6@EnableWebSecurity
7public class SecurityConfig extends WebSecurityConfigurerAdapter {
8    @Override
9    protected void configure(HttpSecurity http) throws Exception {
10        http
11            .authorizeRequests()
12            .antMatchers("/public").permitAll()
13            .anyRequest().authenticated()
14            .and()
15            .formLogin();
16    }
17}

To test this configuration, you can use SpringSecurityTestExecutionListener along with MockMvc to simulate HTTP requests and verify responses:

java

1import org.junit.jupiter.api.Test;
2import org.springframework.beans.factory.annotation.Autowired;
3import org.springframework.boot.test.autoconfigure.web.servlet.AutoConfigureMockMvc;
4import org.springframework.boot.test.context.SpringBootTest;
5import org.springframework.security.test.context.support.WithMockUser;
6import org.springframework.test.web.servlet.MockMvc;
7
8import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get;
9import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.status;
10
11@SpringBootTest
12@AutoConfigureMockMvc
13public class SecurityConfigTest {
14
15    @Autowired
16    private MockMvc mockMvc;
17
18    @Test
19    public void whenAccessPublicEndpoint_thenExpectOk() throws Exception {
20        mockMvc.perform(get("/public"))
21               .andExpect(status().isOk());
22    }
23
24    @Test
25    public void whenAccessProtectedEndpointWithoutAuth_thenExpectUnauthorized() throws Exception {
26        mockMvc.perform(get("/protected"))
27               .andExpect(status().isUnauthorized());
28    }
29
30    @Test
31    @WithMockUser
32    public void whenAccessProtectedEndpointWithAuth_thenExpectOk() throws Exception {
33        mockMvc.perform(get("/protected"))
34               .andExpect(status().isOk());
35    }
36}

In this example, the test:

Confirms that public endpoints are accessible without authentication (/public).
Asserts that the protected endpoints like /protected require authentication.
Uses the @WithMockUser annotation to simulate an authenticated user for accessing protected resources.

Testing Custom Authentication Providers

If you have custom authentication logic, it's crucial to test these components isolated from the rest of the application. Suppose you have a custom authentication provider:

java

1import org.springframework.security.authentication.AuthenticationProvider;
2import org.springframework.security.core.Authentication;
3import org.springframework.security.core.AuthenticationException;
4import org.springframework.security.core.userdetails.User;
5
6public class CustomAuthenticationProvider implements AuthenticationProvider {
7
8    @Override
9    public Authentication authenticate(Authentication authentication) throws AuthenticationException {
10        String username = authentication.getName();
11        String password = (String) authentication.getCredentials();
12
13        if ("user".equals(username) && "password".equals(password)) {
14            return new UsernamePasswordAuthenticationToken(username, password, User::authorities);
15        } else {
16            throw new BadCredentialsException("Invalid username or password");
17        }
18    }
19
20    @Override
21    public boolean supports(Class<?> authentication) {
22        return authentication.equals(UsernamePasswordAuthenticationToken.class);
23    }
24}

To test this provider, use Mockito to mock dependencies:

java

1import org.junit.jupiter.api.Test;
2import org.mockito.Mockito;
3import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
4import org.springframework.security.core.Authentication;
5import org.springframework.security.core.AuthenticationException;
6
7import static org.junit.jupiter.api.Assertions.*;
8
9public class CustomAuthenticationProviderTest {
10
11    private final CustomAuthenticationProvider provider = new CustomAuthenticationProvider();
12
13    @Test
14    public void whenCorrectUsernameAndPassword_thenAuthenticate() {
15        Authentication auth = new UsernamePasswordAuthenticationToken("user", "password");
16        Authentication result = provider.authenticate(auth);
17        assertNotNull(result);
18        assertEquals("user", result.getName());
19    }
20
21    @Test
22    public void whenInvalidUsernameAndPassword_thenThrowException() {
23        Authentication auth = new UsernamePasswordAuthenticationToken("user", "wrongpassword");
24        assertThrows(AuthenticationException.class, () -> provider.authenticate(auth));
25    }
26}

Summary of Key Points

Unit testing in the Spring Security context involves a deep understanding of the security configurations, authentication mechanisms, and how to simulate user interactions. Below is a quick summary of essential points:

Key Concept	Description
Setup Dependencies	Add Spring Security and testing libraries to your project's build file like Maven or Gradle. Use `spring-security-test` for testing Spring Security components.
Test Security Configs	Use `MockMvc` for testing URL access rules and ensure endpoints are protected correctly.
Custom Auth Testing	Test custom authentication logic by mocking dependencies with Mockito. Factor authentication scenarios and expected outcomes.
Use Annotations	Leverage `@WithMockUser` to simulate authenticated users in `MockMvc` tests.

Additional Considerations

Integration vs. Unit Testing: While unit tests are crucial for testing isolated components, integration tests can help test the full application stack, including security, database interactions, etc.
Performance: Excessive mocking in unit tests could lead to an illusion of correctness. Ensure all necessary components are adequately covered in tests.
Continuous Integration: Automate your test suite to run on CI/CD platforms to catch security issues early.

Understanding how to unit test with Spring Security significantly contributes to building secure and robust applications. Mastering these concepts will ensure your application's security mechanisms are thoroughly validated and reliable in production environments.

System Design Fundamentals

Build a strong foundation in designing scalable, reliable distributed systems.

View the course

Track what you have practised

A free account saves your progress, solutions and study plan across every problem on Codemia.

System Design practice on Codemia

Work through 120+ system design problems with detailed solutions, from rate limiters to multi-region storage.

Practice system design

Unit testing with Spring Security

System Design practice on Codemia

Introduction to Unit Testing in Spring Security

Prerequisites

Setting Up Your Environment

Unit Testing Security Configurations

Testing Custom Authentication Providers

Summary of Key Points

Additional Considerations

Related reading

System Design Fundamentals

Track what you have practised

System Design practice on Codemia