Exemplo n.º 1
0
  @Test
  public void testRequestHasUserGetsDifferentTimeout() throws Exception {
    httpServletRequest.setRemoteUser("bill");
    HttpSession session = httpServletRequest.getSession(true); // make a session
    session.setMaxInactiveInterval(MAX_INACTIVE_INTERVAL);

    botKiller.processRequest(httpServletRequest);

    assertEquals(USER_LOW_INACTIVE_TIMEOUT, session.getMaxInactiveInterval());
    assertEquals(MAX_INACTIVE_INTERVAL, session.getAttribute(BotKiller.class.getName()));
  }
Exemplo n.º 2
0
  @Test
  public void testWhenTheyHaveALowDefaultSessionTimeout() {
    httpServletRequest.setRemoteUser("bill");
    HttpSession session = httpServletRequest.getSession(true); // make a session
    session.setMaxInactiveInterval(5);

    botKiller.processRequest(httpServletRequest);

    assertEquals(5, session.getMaxInactiveInterval());
    assertNull(session.getAttribute(BotKiller.class.getName()));
  }
Exemplo n.º 3
0
  @Test
  public void testNeverSeenThisSessionSoItsLowered() throws Exception {
    HttpSession session = httpServletRequest.getSession(true); // make a session
    session.setMaxInactiveInterval(MAX_INACTIVE_INTERVAL);

    botKiller.processRequest(httpServletRequest);

    assertEquals(LOW_INACTIVE_TIMEOUT, session.getMaxInactiveInterval());
    assertEquals(MAX_INACTIVE_INTERVAL, session.getAttribute(BotKiller.class.getName()));

    // now have a second request
    botKiller.processRequest(httpServletRequest);
    assertEquals(MAX_INACTIVE_INTERVAL, Integer.valueOf(session.getMaxInactiveInterval()));
    assertEquals(MAX_INACTIVE_INTERVAL, session.getAttribute(BotKiller.class.getName()));

    // any future requests is still the same timeout on the session

    for (int i = 0; i < 10; i++) {
      botKiller.processRequest(httpServletRequest);
      assertEquals(MAX_INACTIVE_INTERVAL, Integer.valueOf(session.getMaxInactiveInterval()));
      assertEquals(MAX_INACTIVE_INTERVAL, session.getAttribute(BotKiller.class.getName()));
    }
  }
Exemplo n.º 4
0
  @Test
  public void testErrorWhenCheckingUsernameDoesNotKillBotKiller() {
    botKiller =
        new BotKiller(
            new MockUserManager(null) {
              @Override
              public String getRemoteUsername(HttpServletRequest request) {
                throw new RuntimeException("a most unexpected error");
              }
            });

    httpServletRequest.setRemoteUser("bill");
    HttpSession session = httpServletRequest.getSession(true); // make a session
    session.setMaxInactiveInterval(MAX_INACTIVE_INTERVAL);

    botKiller.processRequest(httpServletRequest);

    assertEquals(LOW_INACTIVE_TIMEOUT, session.getMaxInactiveInterval());
    assertEquals(MAX_INACTIVE_INTERVAL, session.getAttribute(BotKiller.class.getName()));
  }
Exemplo n.º 5
0
  @Test
  public void testNoSessionIsAccidentallyEquated() throws Exception {
    botKiller.processRequest(httpServletRequest);

    assertNull(httpServletRequest.getSession(false));
  }