[스프링 시큐리티] 스프링 시큐리티 테스트 - RequestPostProcessor, Annotations

기존의 불편한 수동테스트

1. 직접 파라미터를 통한 가입 - 로그인 - 조회로 테스트
2. 반복되는 수동 단위 테스트에 불필요한 시간 소모가 큼

pom.xml

		<dependency>
			<groupId>org.springframework.security</groupId>
			<artifactId>spring-security-test</artifactId>
			<scope>test</scope>
			<version>${spring-security.version}</version>
		</dependency>

spring-security version을 따라가게끔 설정

 

SecurityMockMvcRequestPostProcessors를 이용한 테스트 방법

@ExtendWith(SpringExtension.class)
@SpringBootTest
@AutoConfigureMockMvc
public class AccountControllerTest {

    @Autowired
    MockMvc mockMvc;

    @Test
    public void index_anonymous() throws Exception {
        mockMvc.perform(get("/").with(anonymous()))
                .andDo(print())
                .andExpect(status().isOk());
    }

    @Test
    public void index_user() throws Exception {
        mockMvc.perform(get("/").with(user("twlee").roles("USER")))
                .andDo(print())
                .andExpect(status().isOk());
    }

    @Test
    public void index_admin() throws Exception {
        mockMvc.perform(get("/").with(user("admin").roles("ADMIN")))
                .andDo(print())
                .andExpect(status().isOk());
    }

    @Test
    public void admin_user() throws Exception {
        mockMvc.perform(get("/admin").with(user("twlee").roles("USER")))
                .andDo(print())
                .andExpect(status().isForbidden());
    }

    @Test
    public void admin_admin() throws Exception {
        mockMvc.perform(get("/admin").with(user("admin").roles("ADMIN")))
                .andDo(print())
                .andExpect(status().isOk());
    }

• with(user("user")), with(anonymous()), with(user("admin")) 와 같은 구문으로 유저 타겟팅 가능
  • https://docs.spring.io/spring-security/site/docs/5.1.5.RELEASE/reference/htmlsingle/#test-mockmvc-securitycontextholder-rpp

 

어노테이션을 이용한 테스트 방법

 

    @Test
    @WithAnonymousUser
    public void index_anonymous_annotation() throws Exception {
        mockMvc.perform(get("/"))
                .andDo(print())
                .andExpect(status().isOk());
    }
    
    @Test
    @WithMockUser(username = "twlee", roles = "USER")
    public void admin_user_annotation() throws Exception {
        mockMvc.perform(get("/admin"))
                .andDo(print())
                .andExpect(status().isForbidden());
    }

    @Test
    @WithMockUser(username = "admin", roles = "ADMIN")
    public void admin_admin_annotation() throws Exception {
        mockMvc.perform(get("/admin"))
                .andDo(print())
                .andExpect(status().isOk());
    }

• WithAnonymousUser, WithMockUser 어노테이션으로 RequestPostProcessor 대체가능
  • https://docs.spring.io/spring-security/site/docs/5.1.5.RELEASE/reference/htmlsingle/#running-as-a-user-in-spring-mvc-test-with-annotations

어노테이션은 반복되면 커스텀 어노테이션으로 분리하여 재사용가능

@Retention(RetentionPolicy.RUNTIME)
@WithMockUser(username = "twlee", roles = "USER")
public @interface WithUser {
}

위와 같은 커스텀 어노테이션으로 분리 후

@Test
@WithUser
public void index_user_annotation() throws Exception {
    mockMvc.perform(get("/"))
            .andDo(print())
            .andExpect(status().isOk());
}

@WithUser로 재사용가능하다