No API to perform formLogin and logout on webflux

[bkolb]

Summary

While SecurityMockMvcRequestBuilders provides APIs to perform a formLogin and logout, there seems to be no equivalent for the reactive stack.

Configuration

My current configuration looks as follow:

    @Before
    public void setup() {
        this.rest = WebTestClient
            .bindToApplicationContext(this.context)
            .apply(springSecurity())
            .configureClient()
            .filter(basicAuthentication())
            .build();
    }

Instead of the basicAuthentication filter, I'd like to use a formAuthentication
Also a Utility to perform a logout is required.

Version

5.0.6.RELEASE

[rwinch]

Thanks for the feedback. Would you be interested in providing a Pull Request?

[bkolb]

If you can give me some hints for where to start I would like to give it a try. I just tried to manually create a post request with the respective params, but I am constantly getting a 403

[rwinch]

The problem is likely that the CSRF token is not included in the request. You can include using mutateWith(csrf())

I don't know of a good way to create a request externally with WebTestClient. We might need to create a ticket with Spring Framework to add support for a way to externalize the request.

[bkolb]

You were right with the missing csrf token. But I am still stuck. What I can see in the debugger is that the login succeeds and then redirects as expected to /. However when I then create the next request to access the controller I get an unexpected redirect to the login page. From what I could see in the debugger 2 SecurityContextImpl are created. One at the beginning and the second once the by AuthenticationWebFilter.onAuthenticationSuccess. However, when I create the next request I see that ReactorContextTestExecutionListener.currentContext still uses the context that got created initially and not the one created by onAuthenticationSuccess.

I checked in a minimal example of my config here: https://github.com/bkolb/springFormLogin/

I am not sure if this is expected or if the ReactorContextTestExecutionListener misses to update the context

[bkolb]

Actually it is not ReactorContextTestExecutionListener that misses to update the context.

AuthenticationWebFilter.onAuthenticationSuccess stores the authentication in the ServerSecurityContextRepository. I guess ReactorContextTestExecutionListener should use a ServerSecurityContextRepository instead of a TestSecurityContextHolder, right?

[rwinch]

@bkolb Thanks for the response and the sample. I have provided a PR which demonstrates what you are looking for. Please read through each commit comment as it describes the reasoning for each change in detail bkolb/springFormLogin#1

I'm going to close this question as answered. Please reopen if you find a problem. If you have additional questions, the best place is StackOverflow with the spring-security tag.

[rwinch]

I just realized that this was an "aside" type of question vs the main point of the original report. I'm reopening. Sorry about that