requestmatcher | powerful way for making programatic assertions | Mock library

by concretesolutions Java Version: Current License: Apache-2.0

X-Ray Key Features Code Snippets Community Discussions(10)Vulnerabilities Install Support

kandi X-RAY | requestmatcher Summary

requestmatcher is a Java library typically used in Testing, Mock applications. requestmatcher has no vulnerabilities, it has build file available, it has a Permissive License and it has low support. However requestmatcher has 2 bugs. You can download it from GitHub.

A simple and powerful way for making assertions in your mocked API. To properly test an Android application we must isolate all the external dependencies that we can't control. Normally, in a client/server application, this boils down to the API calls.

Support

Quality

Security

License

Reuse

Support

requestmatcher has a low active ecosystem.

It has 44 star(s) with 11 fork(s). There are 13 watchers for this library.

It had no major release in the last 6 months.

There are 4 open issues and 4 have been closed. On average issues are closed in 12 days. There are 2 open pull requests and 0 closed requests.

It has a neutral sentiment in the developer community.

The latest version of requestmatcher is current.

Quality

requestmatcher has 2 bugs (0 blocker, 0 critical, 2 major, 0 minor) and 36 code smells.

Security

requestmatcher has no vulnerabilities reported, and its dependent libraries have no vulnerabilities reported.

requestmatcher code analysis shows 0 unresolved vulnerabilities.

There are 2 security hotspots that need review.

License

requestmatcher is licensed under the Apache-2.0 License. This license is Permissive.

Permissive licenses have the least restrictions, and you can use them in most projects.

Reuse

requestmatcher releases are not available. You will need to build from source code and install.

Build file is available. You can build the component from source.

Installation instructions, examples and code snippets are available.

requestmatcher saves you 741 person hours of effort in developing the same functionality from scratch.

It has 1708 lines of code, 127 functions and 30 files.

It has medium code complexity. Code complexity directly impacts maintainability of the code.

Top functions reviewed by kandi - BETA

kandi has reviewed requestmatcher and discovered the below as its top functions. This is intended to give you an instant insight into requestmatcher implemented functionality, and help decide if they suit your requirements.

Handles a request
Perform assertion
Build a map of query parameters
Build headers map
Sets the query matchers
Creates a matcher that matches the provided size
Matches an empty map
Apply the order matcher
Throws an IllegalStateException if the target object is null
Get the full URL for a relative path
Executes an assertion
Adds a header to the rule
Sets the body of the request body as JSON matcher
Sets the body matcher
Match the headers with the given header key
Reads a fixture from a fixture file
Sets headers matcher
Only matching query matcher
Sets the query matcher
Sets the path matcher
Sets the path
Sets the matching method matcher
Sets the method to be used
Expects that a body is empty
Builds the request message
Build the expected matchers

Get all kandi verified functions for this library.

requestmatcher Key Features

No Key Features are available at this moment for requestmatcher.

requestmatcher Examples and Code Snippets

No Code Snippets are available at this moment for requestmatcher.

Community Discussions

Trending Discussions on requestmatcher

Why does a Keycloak bearer token appear to be truncated during security filter chain processing

How to secure some URLS while keeping others without authentication?

AbstractSecurityInterceptor must provide a non-null AccessDecisionManager

Why got 404 while add project name in entry point url

JwtAuthenticationToken is not in the allowlist, Jackson issue

Spring boot 2.6.0 Error creating bean with name 'webSecurityConfig'

spring boot actuator endpoints with Keycloak security

OAUTH2 user service with Custom Authentication Providers

Vaadin 21 Flow + Spring Security OAuth2: Couldn't find route for 'oauth2/authorization/google'

Vaadin 21 View Roles

QUESTION

Why does a Keycloak bearer token appear to be truncated during security filter chain processing

Asked 2022-Mar-24 at 08:15

I am working with Keycloak 16.1.0, spring boot 2.6.2 and an external application client that sends a bearer token in to my server application to the endpoint http://romanmed-host:8888/actuator/health.

By cranking the debugging level up to maximum, I can see the access token before its processed. I can verify that its accurate by using the JWT Debug site JSON Web Tokens to verify that the signature is correct.

Yet several lines later in the output log the same bearer token appears to be somewhat truncated, its listed with an error saying that it failed to verify. When checked by using the JWT site indicates a signature error, but the token content is correct.

Naturally I would like to know why it appears to be truncated and what I can do about it.

I can match the output from the client program to the server and its not been changed, so truncation must occur within the server program.
The program is accepting the request by a get request, since the token can be checked by JWT as valid at this point, its not truncated by the get request input method.
I have not inserted a filter in the security filter chain, so I can see how any of my code could be doing anything to invalid the token.
Other than the Failed to verify token no other error messages are generated, suggesting that until this point everything is correct.

I can see that the WebAsyncManagerIntegrationFilter, SecurityContextPersistenceFilter, HeaderWriterFilter,KeycloakPreAuthActionsFilter and KeycloakAuthenticationProcessingFilter have all been invoked.

I am assuming that the problem is somewhere within the KeycloakAuthenticationProcessingFilter, but I don't understand why the token appears to have been truncated at this point.

The received bearer token is

eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJ3dUhKc1pvWnduelVsU1Zqc2JyTkxsbUNhR0ZIVkV0cTcyQkI5V0pORTVVIn0.eyJleHAiOjE2NDY0MDI3NTAsImlhdCI6MTY0NjQwMjQ1MCwianRpIjoiMjIyMjUxZDgtNDYxMy00OGQwLWEwNzAtMjU5YTYyY2NhZDkyIiwiaXNzIjoiaHR0cDovL2xvY2FsaG9zdDo4MDg1L2F1dGgvcmVhbG1zL0Jvb3RBZG1pbiIsImF1ZCI6WyJybS1jb25maWctc2VydmVyIiwiYXBwLXRvZG8iLCJhY2NvdW50Il0sInN1YiI6Ijc4ZTU1YjhiLWQ5MjAtNGQ0Yi1hNWQ5LWIyZDk3MDYzNDgyYiIsInR5cCI6IkJlYXJlciIsImF6cCI6ImFwcC1hZG1pbiIsImFjciI6IjEiLCJhbGxvd2VkLW9yaWdpbnMiOlsiaHR0cDovL2xvY2FsaG9zdDozMDAwMSJdLCJyZWFsbV9hY2Nlc3MiOnsicm9sZXMiOlsib2ZmbGluZV9hY2Nlc3MiLCJ1bWFfYXV0aG9yaXphdGlvbiIsImRlZmF1bHQtcm9sZXMtYm9vdGFkbWluIl19LCJyZXNvdXJjZV9hY2Nlc3MiOnsicm0tY29uZmlnLXNlcnZlciI6eyJyb2xlcyI6WyJhY3R1YXRvciJdfSwiYXBwLWFkbWluIjp7InJvbGVzIjpbImFjdHVhdG9yIl19LCJhcHAtdG9kbyI6eyJyb2xlcyI6WyJhY3R1YXRvciJdfSwiYWNjb3VudCI6eyJyb2xlcyI6WyJtYW5hZ2UtYWNjb3VudCIsIm1hbmFnZS1hY2NvdW50LWxpbmtzIiwidmlldy1wcm9maWxlIl19fSwic2NvcGUiOiJlbWFpbCBwcm9maWxlIiwiY2xpZW50SWQiOiJhcHAtYWRtaW4iLCJjbGllbnRIb3N0IjoiMTI3LjAuMC4xIiwiZW1haWxfdmVyaWZpZWQiOmZhbHNlLCJwcmVmZXJyZWRfdXNlcm5hbWUiOiJzZXJ2aWNlLWFjY291bnQtYXBwLWFkbWluIiwiY2xpZW50QWRkcmVzcyI6IjEyNy4wLjAuMSJ9.fwQPLiSIrUSjnRnTBrd1vvGic49OSf7aGDemc0TdmTshZzJ-eYhiEqnAh9-QU2rxDayPIhoIzA9CgBXmGPCnl1Qu4CujDddpBcLpnjszBoBdzwjDgpShgwFpGk0fGCM0fxtSZgMWRfeS_sRjBpRzZ42GelCYZ2E1kZX_E7o_LB3thpiv5oYqgTNucusNmzpm0-iFcEUe5rfnu2ZOHI_hLQvIYKlGURnNld4jov-KDLf2QTh2h3XqjbsGHG9PDq4MbFPhKY_9yF0jQkhF6F3oYrw9MIH4SbemrR-CHw6-aWqGmgucjJ7iKMY5o86HxLPu2tzM06NdaurQZX4ImLCBlQ

Its truncated format is

eyJhbGciOiJSUzI1NiIsInR5cCIgOiAiSldUIiwia2lkIiA6ICJ3dUhKc1pvWnduelVsU1Zqc2JyTkxsbUNhR0ZIVkV0cTcyQkI5V0pORTVVIn0.eyJleHAiOjE2NDY0MDI3NTAsImlhdCI6MTY0NjQwMjQ1MCwianRpIjoiMjIyMjUxZDgtNDYxMy00OGQwLWEwNzAtMjU5YTYyY2NhZDkyIiwiaXNzIjoiaHR0cDovL2xvY2FsaG9zdDo4MDg1L2F1dGgvcmVhbG1zL0Jvb3RBZG1pbiIsImF1ZCI6WyJybS1jb25maWctc2VydmVyIiwiYXBwLXRvZG8iLCJhY2NvdW50Il0sInN1YiI6Ijc4ZTU1YjhiLWQ5MjAtNGQ0Yi1hNWQ5LWIyZDk3MDYzNDgyYiIsInR5cCI6IkJlYXJlciIsImF6cCI6ImFwcC1hZG1pbiIsImFjciI6IjEiLCJhbGxvd2VkLW9yaWdpbnMiOlsiaHR0cDovL2xvY2FsaG9zdDozMDAwMSJdLCJyZWFsbV9hY2Nlc3MiOnsicm9sZXMiOlsib2ZmbGluZV9hY2Nlc3MiLCJ1bWFfYXV0aG9yaXphdGlvbiIsImRlZmF1bHQtcm9sZXMtYm9vdGFkbWluIl19LCJyZXNvdXJjZV9hY2Nlc3MiOnsicm0tY29uZmlnLXNlcnZlciI6eyJyb2xlcyI6WyJhY3R1YXRvciJdfSwiYXBwLWFkbWluIjp7InJvbGVzIjpbImFjdHVhdG9yIl19LCJhcHAtdG9kbyI6eyJyb2xlcyI6WyJhY3R1YXRvciJdfSwiYWNjb3VudCI6eyJyb2xlcyI6WyJtYW5hZ2UtYWNjb3VudCIsIm1hbmFnZS1hY2NvdW50LWxpbmtzIiwidmlldy1wcm9maWxlIl19fSwic2NvcGUiOiJlbWFpbCBwcm9maWxlIiwiY2xpZW50SWQiOiJhcHAtYWRtaW4iLCJjbGllbnRIb3N0IjoiMTI3LjAuMC4xIiwiZW1haWxfdmVyaWZpZWQiOmZhbHNlLCJwcmVmZXJyZWRfdXNlcm5hbWUiOiJzZXJ2aWNlLWFjY291bnQtYXBwLWFkbWluIiwiY2xpZW50QWRkcmVzcyI6IjEyNy4wLjAuMSJ9

The debug log is

...

ANSWER

Answered 2022-Mar-07 at 08:32

The problem is the set up of the client and server programs.

The server used the value

auth-server-url: http://localhost:8085/auth

in its application.yml file to define the location of the Keycloak server, the client used the value

auth-server-url: http://romanmed-host:8085/auth

to define the location of Keycloak where the machine name romanmed-host is an alias for localhost. Having changed these values to be the same value, everything works as expected.

The diagnostics generated by the debugging/trace code are confusing, string described as truncated header seems to be truncated the bearer token, with out the signature. What the 'Keycloak` diagnostic is attempting to print is the part of the token which defines the tokens permissions and not the signature section.

Running the entire bearer token through the JWT site does show that the token is valid, because its a correctly encoded token and is legitimate.

The problem is not the token, but the way the token is being used! The client was expecting a legal signed token generated by them instance of Keycloak that it knew about, what it got was a legal signed token generated by Keycloak with a different address, which it correctly objected to.

The problem being the nature of the generated error message, it just claimed that the token signature was invalid, had it said something about an invalid/unexpected hostname, the nature of the problem would have been rather more obvious and resolved much faster. Keycloak is design to be flexible, so error messages tend to more vague to cover all situations, hence the message there is something wrong with your bearer token signature which is correct, but vague.

There seems to several schools of thought on how to resolve issues like this, one is to use an raw ip address which will always resolve to the same value. Thus avoid problems like this. This suffers from if the Keycloak server is moved to another machine there are lots of values to change.

My solution is to define an alias value in the hosts/dns server for the address of the eycloak server and always use that value in the support files. Hence if the Keycloak server is ever moved to another address, there is only one value to change.

Source https://stackoverflow.com/questions/71353307

QUESTION

How to secure some URLS while keeping others without authentication?

Asked 2022-Mar-16 at 12:30

I have a Spring Boot based application. I want the URL /camunda/app/welcome/default/#!/login to be accessible without any authentication, while the URLs

/camunda/app/welcome/default/#!/welcome,
/camunda/app/welcome/default/#!/dashboard,
/camunda/app/tasklist/**, and
/camunda/app/admin/**

must be secured (i. e. only authenticated users should be able to access them).

To achieve this, I wrote the following configuration:

...

ANSWER

Answered 2022-Mar-16 at 12:19

Make sure you use the URL encoding of #, which is %23 when calling the endpoints. Otherwise, the characters after the # will not be considered.

Making a request to /camunda/app/welcome/default/#!/welcome without properly encoding will be interpreted as a request to /camunda/app/welcome/default/. Since that endpoint doesn't require authentication then anyone will be allowed to access it.

Since all endpoints except /camunda/app/welcome/default/#!/login require authentication you condense your HttpSecurity configuration. I'll rewrite it below using the lambda style configuration to make it more readable:

Source https://stackoverflow.com/questions/71496623

QUESTION

AbstractSecurityInterceptor must provide a non-null AccessDecisionManager

Asked 2022-Mar-04 at 09:09

Since upgrade of Spring Security to 5.6.2 I have issues running my application as I keep getting:

...

ANSWER

Answered 2022-Mar-04 at 09:09

This issue stems from creating a custom FilterSecurityInterceptor.
This filter is not meant to be replaced in the filter chain.
It would be best to create a different type of custom filter and insert it before the FilterSecurityInterceptor. For example, it could extend OncePerRequestFilter and instead of throwing an AccessDeniedException if the user is unauthorized it could simply return.

Source https://stackoverflow.com/questions/71339301

QUESTION

Why got 404 while add project name in entry point url

Asked 2022-Feb-17 at 03:35

If run project with Spring security, the entry point URL is:

http://localhost:8099/login

Meanwhile I need to put global project name in entry point URL as follows:

http://localhost:8099/pojoname/login

Here down is my Spring Security Configuration file:

...

ANSWER

Answered 2021-Aug-23 at 12:10

The requested feature is what is know as web context (or formerly Servlet context in a Servlet container work).

This is supported out of the box within Spring Boot and can be switched / activated using the configuration property server.servlet.contextPath with the desired value.

Inside your application.properties file, add below line:

For a version < Spring Boot 2.0:

Source https://stackoverflow.com/questions/68891014

QUESTION

JwtAuthenticationToken is not in the allowlist, Jackson issue

Asked 2022-Feb-05 at 14:37

I have created my authorization server using org.springframework.security:spring-security-oauth2-authorization-server:0.2.2 and my client using org.springframework.boot:spring-boot-starter-oauth2-client. The users are able to sign in and out successfully, however, while testing I noticed that if I log in successfully then restart the client (but not the server) without signing out and try to login in again the server throws the following error in an endless loop of redirects

...

ANSWER

Answered 2022-Feb-05 at 14:37

After trying out different solutions this was how I was able to solve it.

I changed my OAuth2AuthorizationService bean to look like this.

Source https://stackoverflow.com/questions/70919216

QUESTION

Spring boot 2.6.0 Error creating bean with name 'webSecurityConfig'

Asked 2022-Jan-23 at 12:51

I am unable to update my spring boot app to 2.6.0 from 2.5.7. It throws the following error.

...

ANSWER

Answered 2021-Dec-07 at 19:14

The problem is the password encoder. It is required to build the auto-configured UserDetailsService that you inject in the contructor of the class.

You can break the cycle by making the bean factory method static:

Source https://stackoverflow.com/questions/70254555

QUESTION

spring boot actuator endpoints with Keycloak security

Asked 2022-Jan-18 at 17:35

we have a spring boot project (2.3.0.RELEASE) with actuator endpoints and we are introducing keycloak to the project with KeycloakWebSecurityConfigurerAdapter how can I prevent actuator endpoints being secured by the keycloak filter chain.

We would like to have the "/actuator/**" endpoints secured by basic auth.

Currently we have a custom WebSecurityConfigurerAdapter with @Order(1) where we apply the basic auth to "/actuator/**" and then we have with @Order(2) antotated the KeycloakWebSecurityConfigurerAdapter

so 2 filter chains gets registered and when I call the actuator endpoints the second filter chain fails as unauthorised 401

is it possible to prevent handling the "/actuator/**" resorce path on the second filter chain?

First actuator security configuration.

...

ANSWER

Answered 2022-Jan-18 at 17:35

When you extend KeycloakWebSecurityConfigurerAdapter, the adapter register a Bean of type KeycloakAuthenticationProcessingFilter. This filter is registered in the Spring Security's SecurityFilterChain, and because it's a Bean, it is also automatically registered by Spring Boot in the original chain, therefore even if Spring Security doesn't apply it, it will be applied later on in original the filter chain.

Try disabling this filter from being registered by Spring Boot, like so:

Source https://stackoverflow.com/questions/70756991

QUESTION

OAUTH2 user service with Custom Authentication Providers

Asked 2021-Dec-08 at 11:45

I am new to Spring Security and Oauth2. In my spring boot application, I have implemented authentication with Oauth2 with following set of changes:

Custom Ouath2 User service is as follows:

...

ANSWER

Answered 2021-Dec-08 at 11:45

I've created a simplified setup starting from your code with support for both OAuth2 and Basic Auth.

/tenant2/** will start a basic authentication. /** (everything else) triggers an OAuth2 Authorization Code authentication.

The key to achieve this is to have one @Configuration class per authentication type.

Let's start with the controllers:

Tenant1HomeController

Source https://stackoverflow.com/questions/70194951

QUESTION

Vaadin 21 Flow + Spring Security OAuth2: Couldn't find route for 'oauth2/authorization/google'

Asked 2021-Nov-27 at 00:11

I am trying to implement Google Sign-In in Vaadin 21 application + Spring Security using available tutorial for Vaadin 14.

...

ANSWER

Answered 2021-Nov-27 at 00:11

This is the solution to the problem.

https://github.com/vaadin/vaadin-oauth-example/issues/6

Source https://stackoverflow.com/questions/70082575

QUESTION

Vaadin 21 View Roles

Asked 2021-Nov-15 at 22:20

I want to rewrite my Vaadin application to Vaadin 21. With the Vaadin starter builder (https://vaadin.com/start) I created a simple app. Currently my main struggle is to apply my simple CustomAuthenticationProvider to the Security manager to able to use the @RolesAllowed({ "user", "admin","USER"}) annotation.

Main problem that my AuthToken is generated somewhere else... Its generate somewhere an empty Granted Authrities and ignore my custom AuthProvider code.

Question: How to nicely handle role based access control?

Where I can use this annotation correctly:

...

ANSWER

Answered 2021-Nov-12 at 09:36

You must add the ROLE_ prefix to tell Spring Security that the GrantedAuthority is of type role.

Source https://stackoverflow.com/questions/69940357

Community Discussions, Code Snippets contain sources that include Stack Exchange Network

Vulnerabilities

No vulnerabilities reported

Install requestmatcher

The library is available in JCenter repositories. To use it, just declare it in your app's build.gradle:.
MockWebServer: this is the mock server implementation from Square.
JUnit 4: the test runner library
Hamcrest: a generic Java assert library
Json Path (optional for Json matching)

Support

For any new features, suggestions and bugs create an issue on GitHub. If you have any questions check and ask questions on community page Stack Overflow .

Find more information at: