Why does Spring MockMvc result not contain a cookie?

Question

I am trying to unit-test login and security in my REST API, so I try to mock real-life request sequences as close as possible.

My first request would be:

this.mockMvc = MockMvcBuilders.webAppContextSetup(this.wac).
    addFilters(springSecurityFilterChain).build();
this.mapper = new ObjectMapper();
....
MvcResult result=mockMvc.perform(get("/login/csrf")).andExpect(status().is(200)).andReturn();
Cookie[] cookies = result.getResponse().getCookies();

(See full class on pastebin).

I try to get the cookie here to be able to login with the received CSRF token later, but the cookies array is empty!

However, if I run my application and call

curl -i http://localhost:8080/login/csrf

I do get back a Set-Cookie header and can use that cookie (and the CSRF token) later to authenticate.

So the question is: How do I get MockMvc to return a cookie to me?

@SotiriosDelimanolis I edited my code in the question to show that. When I get time, I will put the test class' relevant bits to here or a pastebin. — P.Péter, Oct 01 '14 at 15:48
The relevant parts of my test class are on pastebin: http://pastebin.com/LiNeRFT0 — P.Péter, Oct 02 '14 at 12:38

score 13 · Answer 1 · answered Oct 09 '14 at 15:10

13

I have found a workaround, using the ability to directly extract session objects from the MockHttpServletRequest:

session=(MockHttpSession)result.getRequest().getSession();

And later inserting the session directly:

req.session(session);

The reason why I am not pleased with this solution is that if the mock httpservlet behaves differently than the real servlet in this regard, how can I be sure whether it behaves the same as the real servlet in other cases. So I am not testing the application itself, which potentially leaves gaps in the tests.

answered Oct 09 '14 at 15:10

P.Péter

1,527
16
39

This is not the same session as used in login authentication. – Tiina Dec 04 '18 at 09:55
2

Correction. To check if session exists use `result.getRequest().getSession(false)`, or otherwise, session will be created, if it doesn't exist. – GreenTea Mar 21 '20 at 11:57
what is the `req` object in your code here? How do get it from `MockMvc`? – Pat Jun 03 '22 at 07:08
@GreenTea I did not find that `req` in our current code, it presumably stood for a _request_ that we were creating. Currently we use a `org.springframework.test.web.servlet.request.MockHttpServletRequestBuilder`, and use the session extracted using the above way to build mock requests with the correct session information. – P.Péter Jun 08 '22 at 13:45

score 0 · Answer 2 · answered Sep 13 '17 at 19:42

I work with RestTemplate for testing with cookies. RestTemplate cookies handler

@RunWith(SpringRunner.class)
@SpringBootTest(webEnvironment = WebEnvironment.RANDOM_PORT)
@Import(RestTemplateWithCookies.class)
public class ApplicationTest {

    @LocalServerPort
    private int port;

    @Autowired
    private Environment env;

    @Autowired
    private RestTemplateWithCookies restTemplate;

    @Test
    public void appTest() throws Exception {
        HttpHeaders headers = new HttpHeaders();
        headers.set("Referer", env.getProperty("allowed_referer"));
        HttpEntity<String> entity = new HttpEntity<String>("parameters", headers);
        ResponseEntity<String> response = restTemplate.exchange("http://localhost:" + port + "/scan?email=xxx@xxx.com", HttpMethod.GET, entity, String.class);
        assertTrue(response.getStatusCode() == HttpStatus.FOUND);
        HttpCookie c = restTemplate.getCoookies().stream().filter(x -> env.getProperty("server.session.cookie.name").equals(x.getName())).findAny().orElse(null);
        assertTrue(c != null);

    }

}

Nagy Attila · Answer 3 · 2017-11-02T07:55:18.397

Based on P.Péter's answer a made this code fragment which will get and put back the session automatically for each request performed (MockHttpServletRequestBuilder) on mockMvc.

@Autowired
private WebApplicationContext webApplicationContext;

@Autowired
private Filter springSecurityFilterChain;

@Before
public void setUp() throws Exception {
    final MockHttpServletRequestBuilder defaultRequestBuilder = get("/dummy-path");
    this.mockMvc = MockMvcBuilders.webAppContextSetup(this.webApplicationContext)
            .defaultRequest(defaultRequestBuilder)
            .alwaysDo(result -> setSessionBackOnRequestBuilder(defaultRequestBuilder, result.getRequest()))
            .apply(springSecurity(springSecurityFilterChain))
            .build();
}

private MockHttpServletRequest setSessionBackOnRequestBuilder(final MockHttpServletRequestBuilder requestBuilder,
                                                             final MockHttpServletRequest request) {
    requestBuilder.session((MockHttpSession) request.getSession());
    return request;
}

For a long answer: check this solution (the answer is for spring 4): How to login a user with spring 3.2 new mvc testing

Why does Spring MockMvc result not contain a cookie?

3 Answers3

Linked