test(security): extend authorization tests for endpoints permitted in #347 - #349
Merged
hirokiterashima merged 1 commit intoSep 10, 2026
Conversation
…ISE-Community#347 Cover the anonymous-access endpoints that WISE-Community#347 added to the permitAll whitelist: static asset paths, password recovery (both student and teacher), contact form, news, announcements, project info, Google user registration checks, project preview, survey entry, error dispatch paths, and favicon. Also cover the pre-existing permitAll endpoints that had no test: registration (teacher, student, questions), OAuth2 authorization and callback paths, login page, and the root path. Add a negative test that verifies unauthenticated requests to protected endpoints (/api/teacher/**, /author/**, /api/admin/**) are still denied, so that a future whitelist change that accidentally opens a role-guarded path is caught. Introduce an assertDeniedForAnonymous helper that checks for 403 or a 302 redirect specifically targeting /login, so that a controller-level redirect (which would mean the request passed the security layer) does not make the test pass vacuously.
hirokiterashima
approved these changes
Sep 10, 2026
hirokiterashima
left a comment
hirokiterashima
left a comment
Member
There was a problem hiding this comment.
LGTM. Thanks for adding these tests.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Following up on #347 and @hirokiterashima's review comment about extending
WebSecurityConfigAuthorizationTestto cover the newly permitted endpoints and prevent regression.What this adds
Eight test methods exercising the anonymous-access whitelist through the real Spring Security filter chain:
unauthenticated_staticAssetPaths_shouldBeAllowed/pages/resources/**,/portal/javascript/**,/portal/themes/**,/portal/translate/**,/vle/**,/projectIcons/**unauthenticated_passwordRecoveryEndpoints_shouldBeAllowed/api/student/forgot/**,/api/teacher/forgot/**unauthenticated_contactNewsAndAnnouncement_shouldBeAllowedPOST /api/contact,/api/news/**,/api/announcementunauthenticated_projectInfoAndGoogleUserChecks_shouldBeAllowed/api/project/info/*,/api/google-user/check-user-exists,/api/google-user/check-user-matchesunauthenticated_previewAndSurveyPaths_shouldBeAllowed/previewproject.html,/run-survey/**unauthenticated_errorAndFrameworkPaths_shouldBeAllowed/error,/errors/**,/favicon.icounauthenticated_registrationAndOAuthEndpoints_shouldBeAllowed/api/teacher/register,/api/student/register,/api/student/register/questions,/oauth2/**,/login/oauth2/**,/login,/unauthenticated_protectedEndpoints_shouldBeDenied/api/teacher/**,/author/**,/api/admin/**must reject anonymous requestsHelpers
assertDeniedForAnonymouschecks for 403 or a 302 redirect specifically targeting/login. A plain 302 check would not be enough: some controllers return their own redirects, so a security regression that lets the request through to the controller would produce a 302 from the handler and pass the test vacuously.Why the negative test matters
The existing suite only tested that permitted endpoints are reachable. Without a test that protected endpoints are not reachable anonymously, a future whitelist change that accidentally opens a role-guarded path would pass the suite silently.