Skip to content

Commit be802f5

Browse files
Steve Riesenbergeleftherias
Steve Riesenberg
authored andcommitted
Add hasIpAddress to Reactive Kotlin DSL
Closes gh-10571
1 parent 176f7b2 commit be802f5

File tree

2 files changed

+48
-4
lines changed

2 files changed

+48
-4
lines changed

config/src/main/kotlin/org/springframework/security/config/web/server/AuthorizeExchangeDsl.kt

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2020 the original author or authors.
2+
* Copyright 2002-2021 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -22,6 +22,7 @@ import org.springframework.security.authorization.AuthorizationDecision
2222
import org.springframework.security.authorization.ReactiveAuthorizationManager
2323
import org.springframework.security.core.Authentication
2424
import org.springframework.security.web.server.authorization.AuthorizationContext
25+
import org.springframework.security.web.server.authorization.IpAddressReactiveAuthorizationManager
2526
import org.springframework.security.web.server.util.matcher.ServerWebExchangeMatcher
2627
import org.springframework.security.web.server.util.matcher.ServerWebExchangeMatchers
2728
import org.springframework.security.web.util.matcher.RequestMatcher
@@ -108,6 +109,13 @@ class AuthorizeExchangeDsl {
108109
fun hasAnyAuthority(vararg authorities: String): ReactiveAuthorizationManager<AuthorizationContext> =
109110
AuthorityReactiveAuthorizationManager.hasAnyAuthority<AuthorizationContext>(*authorities)
110111

112+
/**
113+
* Require a specific IP or range of IP addresses.
114+
* @since 5.7
115+
*/
116+
fun hasIpAddress(ipAddress: String): ReactiveAuthorizationManager<AuthorizationContext> =
117+
IpAddressReactiveAuthorizationManager.hasIpAddress(ipAddress)
118+
111119
/**
112120
* Require an authenticated user.
113121
*/

config/src/test/kotlin/org/springframework/security/config/web/server/AuthorizeExchangeDslTests.kt

Lines changed: 39 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -22,16 +22,16 @@ import org.springframework.beans.factory.annotation.Autowired
2222
import org.springframework.context.ApplicationContext
2323
import org.springframework.context.annotation.Bean
2424
import org.springframework.security.config.annotation.web.reactive.EnableWebFluxSecurity
25-
import org.springframework.security.core.userdetails.MapReactiveUserDetailsService
26-
import org.springframework.security.core.userdetails.User
2725
import org.springframework.security.config.test.SpringTestContext
2826
import org.springframework.security.config.test.SpringTestContextExtension
27+
import org.springframework.security.core.userdetails.MapReactiveUserDetailsService
28+
import org.springframework.security.core.userdetails.User
2929
import org.springframework.security.web.server.SecurityWebFilterChain
3030
import org.springframework.test.web.reactive.server.WebTestClient
3131
import org.springframework.web.bind.annotation.RequestMapping
3232
import org.springframework.web.bind.annotation.RestController
3333
import org.springframework.web.reactive.config.EnableWebFlux
34-
import java.util.*
34+
import java.util.Base64
3535

3636
/**
3737
* Tests for [AuthorizeExchangeDsl]
@@ -181,4 +181,40 @@ class AuthorizeExchangeDslTests {
181181
return MapReactiveUserDetailsService(user)
182182
}
183183
}
184+
185+
@Test
186+
fun `request when ip address does not match then responds with forbidden`() {
187+
this.spring.register(HasIpAddressConfig::class.java).autowire()
188+
189+
this.client
190+
.get()
191+
.uri("/")
192+
.header("Authorization", "Basic " + Base64.getEncoder().encodeToString("user:password".toByteArray()))
193+
.exchange()
194+
.expectStatus().isForbidden
195+
}
196+
197+
@EnableWebFluxSecurity
198+
@EnableWebFlux
199+
open class HasIpAddressConfig {
200+
@Bean
201+
open fun springWebFilterChain(http: ServerHttpSecurity): SecurityWebFilterChain {
202+
return http {
203+
authorizeExchange {
204+
authorize(anyExchange, hasIpAddress("10.0.0.0/24"))
205+
}
206+
httpBasic { }
207+
}
208+
}
209+
210+
@Bean
211+
open fun userDetailsService(): MapReactiveUserDetailsService {
212+
val user = User.withDefaultPasswordEncoder()
213+
.username("user")
214+
.password("password")
215+
.roles("USER")
216+
.build()
217+
return MapReactiveUserDetailsService(user)
218+
}
219+
}
184220
}

0 commit comments

Comments
 (0)