如何禁用控制器单元测试的安全性？

Question

我尝试禁用控制器单元测试的安全性，但总是出现错误 403。

我的单元测试：

@RunWith(SpringRunner.class)
@WebMvcTest(value = MeasureController.class, secure = false)
@AutoConfigureMockMvc(secure = false)
public class MeasureControllerTest {

    @Autowired
    private MockMvc mvc;
    @Autowired
    private ObjectMapper objectMapper;
    @MockBean
    private ObjectService objectService;
    @Autowired
    private MeasureController measureController;

    /**
     * Test of sayHello method, of class MeasureController.
     *
     * @throws java.lang.Exception
     */
    @Test
    public void OnPostShouldReturnCreatedStatusIfEmptyMeasure() throws Exception {
        final String url = "/object/" + uuidKey + "/measures/";
        this.mvc.perform(post(url)
                .content("[]")
                .contentType(MediaType.APPLICATION_JSON)
                .accept(MediaType.APPLICATION_JSON))
                .andExpect(status().isCreated());

        verifyZeroInteractions(objectService);
    }
}

安全配置：

@Configuration
@EnableResourceServer
public class SecurityResourceServerConfig extends ResourceServerConfigurerAdapter {

    @Override
    public void configure(HttpSecurity http) throws Exception {
        http
                .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS)
                .and().authorizeRequests()
                .antMatchers("/v2/api-docs", "/swagger-resources/**", "/swagger-ui.html", "/webjars/**").permitAll()
                .anyRequest().authenticated()
                ;
    }

    @Primary
    @Bean
    public RemoteTokenServices tokenServices() {
        final RemoteTokenServices tokenService = new RemoteTokenServices();
        tokenService.setCheckTokenEndpointUrl("https://..../oauth/check_token");
        tokenService.setClientId(".....");
        tokenService.setClientSecret(".....");
        return tokenService;
    }
}

spring 文档说要将 AutoConfigureMockMvc.secure 设置为 false 或将 WebMvcTest.secure 设置为 false。但两者都不会禁用安全性。我错过了什么？

我使用 Spring Boot 2.0.4。和 spring-security-oauth2 2.3.3.RELEASE

Answer 1

“WebMvcTest.secure”已被弃用。您必须对控制器进行测试：

@RunWith(SpringRunner.class)
@WebMvcTest(value = PatientDeviceController.class, excludeAutoConfiguration = SecurityAutoConfiguration.class)
@AutoConfigureMockMvc(secure = false)

Answer 2

对于其他来这里寻找答案的人（以及我未来的自己），在 Spring Boot 2.2 中进行了测试：

@WebMvcTest(controllers = YourController.class,
        excludeFilters = { @ComponentScan.Filter(type = FilterType.ASSIGNABLE_TYPE, value = WebSecurityConfigurer.class) },
        excludeAutoConfiguration = { SecurityAutoConfiguration.class})

• excludeFilters 将停止 @WebMvcTest 拾取任何实现它默认执行的安全性的类： https://docs.spring.io/spring-boot/docs/2.2.1.RELEASE/reference/htmlsingle/#boot-features-testing-spring-boot-applications-testing-autoconfigured-mvc-tests 如果您要添加自己的安全类（很可能通过扩展 WebSecurityConfigurerAdapter）来阻止 Spring 拾取和创建这些 bean，则需要这样做。
• excludeAutoConfiguration 将确保默认 Spring Boot 的逻辑也不会启动