View Javadoc
1   /*
2    * SPDX-License-Identifier: MIT
3    * See LICENSE file for details.
4    *
5    * Copyright 2010-2026 The Waffle Project Contributors: https://github.com/Waffle/waffle/graphs/contributors
6    */
7   package waffle.util;
8   
9   import org.assertj.core.api.BDDSoftAssertions;
10  import org.junit.jupiter.api.Assertions;
11  import org.junit.jupiter.api.Test;
12  
13  import waffle.mock.http.SimpleHttpRequest;
14  
15  /**
16   * The Class AuthorizationHeaderTest.
17   */
18  class AuthorizationHeaderTest {
19  
20      /** The Constant DIGEST_HEADER. */
21      private static final String DIGEST_HEADER = "Digest username=\"admin\", realm=\"milton\", nonce=\"YjNjZDgxNDYtOGIwMS00NDk0LTlkMTItYzExMGJkNTcxZjli\", uri=\"/case-user-data/431b971d9e1441d381adb277de4f39f8/test\", response=\"30d2d15e89e0b7596325a12852ae6ca5\", qop=auth, nc=00000025, cnonce=\"fb2f97a275d3d9cb\"";
22  
23      /**
24       * Test get header with lowercase header name.
25       */
26      @Test
27      void testGetHeaderWithLowercaseHeaderName() {
28          final SimpleHttpRequest request = new SimpleHttpRequest();
29          final AuthorizationHeader header = new AuthorizationHeader(request);
30          Assertions.assertNull(header.getHeader());
31          request.addHeader("authorization", "NTLM TlRMTVNTUAABAAAABzIAAAYABgArAAAACwALACAAAABXT1JLU1RBVElPTkRPTUFJTg==");
32          Assertions.assertNotNull(header.getHeader());
33          Assertions.assertFalse(header.isNull());
34      }
35  
36      /**
37       * Test is null.
38       */
39      @Test
40      void testIsNull() {
41          final SimpleHttpRequest request = new SimpleHttpRequest();
42          final AuthorizationHeader header = new AuthorizationHeader(request);
43          Assertions.assertTrue(header.isNull());
44          request.addHeader("Authorization", "");
45          Assertions.assertTrue(header.isNull());
46          request.addHeader("Authorization", "12344234");
47          Assertions.assertFalse(header.isNull());
48      }
49  
50      /**
51       * Test get security package.
52       */
53      @Test
54      void testGetSecurityPackage() {
55          final SimpleHttpRequest request = new SimpleHttpRequest();
56          final AuthorizationHeader header = new AuthorizationHeader(request);
57          request.addHeader("Authorization", "NTLM TlRMTVNTUAABAAAABzIAAAYABgArAAAACwALACAAAABXT1JLU1RBVElPTkRPTUFJTg==");
58          Assertions.assertEquals("NTLM", header.getSecurityPackage());
59          request.addHeader("Authorization",
60                  "Negotiate TlRMTVNTUAABAAAABzIAAAYABgArAAAACwALACAAAABXT1JLU1RBVElPTkRPTUFJTg==");
61          Assertions.assertEquals("Negotiate", header.getSecurityPackage());
62      }
63  
64      /**
65       * Test is ntlm type1 message.
66       */
67      @Test
68      void testIsNtlmType1Message() {
69          final SimpleHttpRequest request = new SimpleHttpRequest();
70          final AuthorizationHeader header = new AuthorizationHeader(request);
71          Assertions.assertFalse(header.isNtlmType1Message());
72          request.addHeader("Authorization", "");
73          Assertions.assertFalse(header.isNtlmType1Message());
74          request.addHeader("Authorization", "NTLM TlRMTVNTUAABAAAABzIAAAYABgArAAAACwALACAAAABXT1JLU1RBVElPTkRPTUFJTg==");
75          Assertions.assertTrue(header.isNtlmType1Message());
76      }
77  
78      /**
79       * Test is ntlm type1 post authorization header.
80       */
81      @Test
82      void testIsNtlmType1PostAuthorizationHeader() {
83          final SimpleHttpRequest request = new SimpleHttpRequest();
84          request.setContentLength(0);
85          request.addHeader("Authorization", "NTLM TlRMTVNTUAABAAAABzIAAAYABgArAAAACwALACAAAABXT1JLU1RBVElPTkRPTUFJTg==");
86          // GET
87          request.setMethod("GET");
88          final AuthorizationHeader header = new AuthorizationHeader(request);
89          Assertions.assertFalse(header.isNtlmType1PostAuthorizationHeader());
90          // POST
91          request.setMethod("POST");
92          Assertions.assertTrue(header.isNtlmType1PostAuthorizationHeader());
93          // PUT
94          request.setMethod("PUT");
95          Assertions.assertTrue(header.isNtlmType1PostAuthorizationHeader());
96      }
97  
98      /**
99       * Test is sp nego message.
100      */
101     @Test
102     void testIsSPNegTokenInitMessage() {
103         final SimpleHttpRequest request = new SimpleHttpRequest();
104         final AuthorizationHeader header = new AuthorizationHeader(request);
105         Assertions.assertFalse(header.isSPNegTokenInitMessage());
106         request.addHeader("Authorization", "");
107         Assertions.assertFalse(header.isSPNegTokenInitMessage());
108         request.addHeader("Authorization",
109                 "Negotiate YHYGBisGAQUFAqBsMGqgMDAuBgorBgEEAYI3AgIKBgkqhkiC9xIBAgIGCSqGSIb3EgECAgYKKwYBBAGCNwICHqI2BDROVExNU1NQAAEAAACXsgjiAwADADEAAAAJAAkAKAAAAAYBsR0AAAAPR0xZQ0VSSU5FU0FE");
110         Assertions.assertTrue(header.isSPNegTokenInitMessage());
111     }
112 
113     /**
114      * Test is sp nego post authorization header.
115      */
116     @Test
117     void testIsSPNegoPostAuthorizationHeader() {
118         final SimpleHttpRequest request = new SimpleHttpRequest();
119         request.setContentLength(0);
120         request.addHeader("Authorization",
121                 "Negotiate YHYGBisGAQUFAqBsMGqgMDAuBgorBgEEAYI3AgIKBgkqhkiC9xIBAgIGCSqGSIb3EgECAgYKKwYBBAGCNwICHqI2BDROVExNU1NQAAEAAACXsgjiAwADADEAAAAJAAkAKAAAAAYBsR0AAAAPR0xZQ0VSSU5FU0FE");
122         // GET
123         request.setMethod("GET");
124         final AuthorizationHeader header = new AuthorizationHeader(request);
125         Assertions.assertFalse(header.isNtlmType1PostAuthorizationHeader());
126         // POST
127         request.setMethod("POST");
128         Assertions.assertTrue(header.isNtlmType1PostAuthorizationHeader());
129         // PUT
130         request.setMethod("PUT");
131         Assertions.assertTrue(header.isNtlmType1PostAuthorizationHeader());
132     }
133 
134     /**
135      * This test was designed to specifically test a try/catch that was added around base64 processing to ensure that we
136      * push out a more readable error condition when unsupported type is sent in. Specifically, this is testing the
137      * Digest which is closely related to NTLM but not supported in Waffle.
138      */
139     @Test
140     void testIsDigestAuthorizationHeaderFailure() {
141         final SimpleHttpRequest request = new SimpleHttpRequest();
142         final AuthorizationHeader header = new AuthorizationHeader(request);
143         request.addHeader("Authorization", AuthorizationHeaderTest.DIGEST_HEADER);
144 
145         final BDDSoftAssertions softly = new BDDSoftAssertions();
146         softly.thenThrownBy(() -> header.getTokenBytes()).isInstanceOf(RuntimeException.class)
147                 .hasMessageContaining("Invalid authorization header");
148     }
149 
150     /**
151      * Test is bearer authorization header returns true.
152      */
153     @Test
154     void testIsBearerAuthorizationHeaderTrue() {
155         final SimpleHttpRequest request = new SimpleHttpRequest();
156         request.addHeader("Authorization", "Bearer sometoken");
157         final AuthorizationHeader header = new AuthorizationHeader(request);
158         Assertions.assertTrue(header.isBearerAuthorizationHeader());
159     }
160 
161     /**
162      * Test is bearer authorization header returns false for NTLM.
163      */
164     @Test
165     void testIsBearerAuthorizationHeaderFalseForNtlm() {
166         final SimpleHttpRequest request = new SimpleHttpRequest();
167         request.addHeader("Authorization", "NTLM TlRMTVNTUAABAAAABzIAAAYABgArAAAACwALACAAAABXT1JLU1RBVElPTkRPTUFJTg==");
168         final AuthorizationHeader header = new AuthorizationHeader(request);
169         Assertions.assertFalse(header.isBearerAuthorizationHeader());
170     }
171 
172     /**
173      * Test is bearer authorization header returns false when null.
174      */
175     @Test
176     void testIsBearerAuthorizationHeaderFalseWhenNull() {
177         final SimpleHttpRequest request = new SimpleHttpRequest();
178         final AuthorizationHeader header = new AuthorizationHeader(request);
179         Assertions.assertFalse(header.isBearerAuthorizationHeader());
180     }
181 
182     /**
183      * Test to string when null.
184      */
185     @Test
186     void testToStringWhenNull() {
187         final SimpleHttpRequest request = new SimpleHttpRequest();
188         final AuthorizationHeader header = new AuthorizationHeader(request);
189         Assertions.assertEquals("<none>", header.toString());
190     }
191 
192     /**
193      * Test to string when header present.
194      */
195     @Test
196     void testToStringWhenHeaderPresent() {
197         final SimpleHttpRequest request = new SimpleHttpRequest();
198         final String headerValue = "NTLM TlRMTVNTUAABAAAABzIAAAYABgArAAAACwALACAAAABXT1JLU1RBVElPTkRPTUFJTg==";
199         request.addHeader("Authorization", headerValue);
200         final AuthorizationHeader header = new AuthorizationHeader(request);
201         Assertions.assertEquals(headerValue, header.toString());
202     }
203 
204     /**
205      * Test is ntlm type1 post authorization header with DELETE method.
206      */
207     @Test
208     void testIsNtlmType1PostAuthorizationHeaderWithDelete() {
209         final SimpleHttpRequest request = new SimpleHttpRequest();
210         request.setContentLength(0);
211         request.addHeader("Authorization", "NTLM TlRMTVNTUAABAAAABzIAAAYABgArAAAACwALACAAAABXT1JLU1RBVElPTkRPTUFJTg==");
212         request.setMethod("DELETE");
213         final AuthorizationHeader header = new AuthorizationHeader(request);
214         Assertions.assertTrue(header.isNtlmType1PostAuthorizationHeader());
215     }
216 
217     /**
218      * Test is ntlm type1 post authorization header with non-zero content length.
219      */
220     @Test
221     void testIsNtlmType1PostAuthorizationHeaderWithContent() {
222         final SimpleHttpRequest request = new SimpleHttpRequest();
223         request.setContentLength(100);
224         request.addHeader("Authorization", "NTLM TlRMTVNTUAABAAAABzIAAAYABgArAAAACwALACAAAABXT1JLU1RBVElPTkRPTUFJTg==");
225         request.setMethod("POST");
226         final AuthorizationHeader header = new AuthorizationHeader(request);
227         Assertions.assertFalse(header.isNtlmType1PostAuthorizationHeader());
228     }
229 
230     /**
231      * Test get security package throws when no space in header.
232      */
233     @Test
234     void testGetSecurityPackageThrowsWhenNoSpace() {
235         final SimpleHttpRequest request = new SimpleHttpRequest();
236         request.addHeader("Authorization", "NoSpaceHere");
237         final AuthorizationHeader header = new AuthorizationHeader(request);
238         Assertions.assertThrows(RuntimeException.class, header::getSecurityPackage);
239     }
240 
241     /**
242      * Test get security package throws when header is null.
243      */
244     @Test
245     void testGetSecurityPackageThrowsWhenNull() {
246         final SimpleHttpRequest request = new SimpleHttpRequest();
247         final AuthorizationHeader header = new AuthorizationHeader(request);
248         Assertions.assertThrows(RuntimeException.class, header::getSecurityPackage);
249     }
250 }