Resource server test fails with Auth0 issuer uri - spring-boot

Question

I created a simple example, only acts Resource server to provide APIs for clients.
The complete codes can be found on Github - hantsy/spring-webmvc-auth0-sample.
I have browsed Spring security samples, it used a jwk-set-uri, in my application, I used issuer-uri instead.
security:
oauth2:
resourceserver:
jwt:
issuer-uri: <auth0 provided issuer uri>
And I followed Auth0 Spring security 5 API Guide , add audience claim validation.
I tried to add a ApplicationTests using MockMVC.
#Test
public void testGetById() throws Exception {
Post post = Post.builder().title("test").content("test content").build();
post.setId(1L);
given(this.posts.findById(anyLong())).willReturn(Optional.of(post));
this.mockMvc
.perform(
get("/posts/{id}", 1L)
.accept(MediaType.APPLICATION_JSON)
)
.andExpect(status().isOk())
.andExpect(jsonPath("$.name").value("test"));
verify(this.posts, times(1)).findById(any(Long.class));
verifyNoMoreInteractions(this.posts);
}
And my security config is similar to this.
#Bean
SecurityFilterChain springWebFilterChain(HttpSecurity http) throws Exception {
return http
.httpBasic(AbstractHttpConfigurer::disable)
.csrf(AbstractHttpConfigurer::disable)
.sessionManagement(c -> c.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
.authorizeRequests(c -> c
.antMatchers("/", "/info").permitAll()
.antMatchers(HttpMethod.GET, "/posts/**").permitAll()//.hasAuthority("SCOPE_read:posts")
.antMatchers(HttpMethod.POST, "/posts/**").hasAuthority("SCOPE_write:posts")
.antMatchers(HttpMethod.PUT, "/posts/**").hasAuthority("SCOPE_write:posts")
.antMatchers(HttpMethod.DELETE, "/posts/**").hasAuthority("SCOPE_delete:posts")
.anyRequest().authenticated()
)
.oauth2ResourceServer(OAuth2ResourceServerConfigurer::jwt)
.cors().and().build();
}
When running the tests.
org.springframework.web.util.NestedServletException: Request processing failed; nested exception is java.lang.NullPointerException: Cannot invoke "org.springframework.test.web.servlet.DefaultMvcResult.setHandler(Object)" because "mvcResult" is null
at org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:1014)
at org.springframework.web.servlet.FrameworkServlet.doGet(FrameworkServlet.java:898)
I am not sure where is wrong? I have checked the official samples, it includes a spring.factories file to enable a mockserver env, it is requried in the Spring Boot?

Answer 1

The issue appears to be the inclusion of cors() in the configuration.
Spring Security's CorsFilter delegates by default to HandlerMappingInterceptor, which wraps the request in a specialized HttpServletRequestWrapper. When combined with RouterFunctions, MockMvc's MVC_REQUEST_ATTRIBUTE request attribute is getting removed.
One fix, then, is to remove cors() from your configuration. Indeed, when I remove it from your sample, the tests run as expected.
Another is to not use the HandlerMappingInterceptor default. Instead, you can publish your own CorsConfigurationSource, like so:
#Bean
CorsConfigurationSource corsConfigurationSource() {
CorsConfiguration configuration = new CorsConfiguration();
configuration.setAllowedOrigins(Arrays.asList("https://example.com"));
configuration.setAllowedMethods(Arrays.asList("GET","POST"));
UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
source.registerCorsConfiguration("/**", configuration);
return source;
}
In your sample app, when I added the above to your SecurityConfig, the tests ran again as expected.
It seems like there might be a way to adjust this specialized wrapper in HandlerMappingIntrospector as well so as to not accidentally remove the MVC_REQUEST_ATTRIBUTE, but the Spring Framework team will probably have more to say if any adjustments are needed. I've filed a ticket there to see if anything can be done.