如何在Spring Boot测试中包含自定义安全拦截器

Question

我想对spring boot rest-api应用程序做一些端到端测试。使用spring mock MVC实现这个im。但是我无法得到200响应，因为rest api正在使用自定义的安全拦截器来验证请求中的令牌。相反，我一直得到401作为回应。如何在我的测试中包含此令牌验证？

@AutoConfigureMockMvc
@RunWith(SpringRunner.class)
@SpringBootTest(classes = VeripalServiceApplication.class)
@TestPropertySource(locations="classpath:test.properties")
@Transactional
public class VeripalTextConfigurationTest {

    @Autowired
    private MockMvc mockMvc;

    @Test
    public void happpyPath_thenReturns200() throws Exception {

        String jsonBody = "some json body";
        String endPoint = "/end_point_to_my_api";

        HttpHeaders headers = new HttpHeaders();
        headers.add("token", "this_is_my_token");
        headers.setContentType(aplication/json);

        /** Hit the API */
        mockMvc.perform(post(endPoint)
                .headers(httpHeaders)
                .content(jsonBody)
                )
                .andExpect(status().isOk()).andDo(print());
    }

}

@Configuration
@EnableScheduling
public class WebMvcConfig extends WebMvcConfigurerAdapter {

    @Autowired
    private ConsumerService consumerService;

    @Autowired
    private EndpointService endpointService;

    @Autowired
    private ConsumerConfigurationService consumerConfigurationService;

    @Autowired
    private AccessLimitService accessLimitService;

    @Autowired
    private ConfigurationHistoryService configurationHistoryService;

    @Autowired
    private LimitCarryOverService limitCarryOverService;

    @Override
    public void addInterceptors(InterceptorRegistry registry) {
        registry.addInterceptor(new Interceptor(consumerService, endpointService, consumerConfigurationService, accessLimitService, configurationHistoryService, limitCarryOverService));
    }
}

这是我的拦截课

public class Interceptor implements HandlerInterceptor {

    // some code here ...
}

Answer 1

您需要对Servlet API和Spring Security框架中的请求生命周期有一个清晰的了解。

本文可能有助于您理解此流程http://blog.florian-Hopf.de/2017/08/spring-security.html

因此，我非常肯定，您在身份验证过滤器中存在一个问题，因此您可以通过以下几种方法来解决它：

null

• Spring测试与安全性：如何模拟身份验证？

V2:使用IoC+Mockito，例如将其存根用于单元测试。我不明白您的代码是如何编写的，所以我相信下面的一段代码可能会对您有所帮助。

// @Import({MyAuthCustomInterceptor.class}) // eq to @Component/@Service to create a bean
public class WebMvcConfig extends WebMvcConfigurerAdapter {
    @Autowired
    MyAuthCustomInterceptor interceptor;

    @Override
    public void addInterceptors(InterceptorRegistry registry) {
        registry.addInterceptor(interceptor);
    }
}


public class VeripalTextConfigurationTest {
   @MockBean
   MyAuthCustomInterceptor interceptor;

   @SetUp
   public void setup(){
       Mockito.when(interceptor.preHandle(...)).thenReturn(true);
   }
}