mockmvc post request without csrf or invalid csrf is not failing - spring-boot

Question

I have a spring boot-2.5.1 application with spring security 5.
WebSecurityConfig looks as below:
#Slf4j
#Configuration
#EnableWebSecurity
#RequiredArgsConstructor
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
private final CustomProperties customProperties;
#Override
protected void configure(HttpSecurity http) throws Exception {
if (customProperties.isEnabled()) {
log.info("authentication enabled.");
http.authorizeRequests()
.anyRequest()
.authenticated()
.and()
.oauth2Login()
.redirectionEndpoint()
.baseUri(customProperties.getAuthorizationResponseUri())
.and()
.userInfoEndpoint(userInfo -> userInfo.userService(new CustomOAuth2UserService()::loadUser));
} else {
log.info("authentication disabled.");
http.authorizeRequests()
.anyRequest()
.permitAll();
}
}
public void configure(WebSecurity webSecurity) {
webSecurity.ignoring()
.antMatchers("/actuator/info", "/actuator/health/*");
}
}
}
Controller looks like as below:
#Controller
#RequiredArgsConstructor
public class UserController {
private final UserService userService;
#PostMapping("/users")
public #ResponseBody Mono<Map<String, String>> saveUsers(#RequestBody List<UserDto> userDtos) {
return userService.saveUser(userDtos);
}
}
JUnit corresponding to the above controller:
#AutoConfigureMockMvc
#WebMvcTest(UserController.class)
class UserControllerTest {
#Autowired
private MockMvc mockMvc;
#MockBean
private UserService userService;
#SneakyThrows
#Test
#WithMockTestUser
void shouldSaveUsers() {
var userDtos = "...";
mockMvc.perform(post("/users")
.contentType(APPLICATION_JSON)
.content(userDtos))
.andDo(print())
.andExpect(status().isOk());
}
}
Above JUnit without CSRF is giving status as OK instead of forbidden request.
If I debug, I could see, if csrf() is not included then no token will be generated & assigned to request. However, still, the request is passing. Ideally, it should throw forbidden request access.
Even with csrf(), I can see token is generated & assigned to parameter.
In both cases, I do not see anywhere POST request is being validated whether it contains CSRF token or not with mockmvc.
Does mockmvc need any extra configuration to validate whether POST request contains CSRF or not?

Answer 1

Rather than auto-configuring MockMvc, you need to build MockMvc using SecurityMockMvcConfigurers.springSecurity().
This adds the Spring Bean named "springSecurityFilterChain" as a Filter and ensures that the TestSecurityContextHolder is leveraged for each request.
#Autowired
private WebApplicationContext context;
private MockMvc mockMvc;
#Before
public void setup() {
this.mockMvc = MockMvcBuilders
.webAppContextSetup(this.context)
.apply(springSecurity())
.build();
}