Skip to content

Commit 7f69e41

Browse files
wilkinsonawilkinsona
committed
Merge pull request #16319 from Spring Operator
* gh-16319: Polish "Use HTTPS for external links wherever possible" Use HTTPS for external links wherever possible
2 parents e2de2c8 + 14b2102 commit 7f69e41

File tree

36 files changed

+180
-179
lines changed

36 files changed

+180
-179
lines changed

‎spring-boot-project/spring-boot-actuator-autoconfigure/src/test/java/org/springframework/boot/actuate/autoconfigure/cloudfoundry/reactive/CloudFoundryWebFluxEndpointIntegrationTests.java

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -113,9 +113,9 @@ public void responseToOptionsRequestIncludesCorsHeaders() {
113113
this.contextRunner.run(withWebTestClient((client) -> client.options()
114114
.uri("/cfApplication/test").accept(MediaType.APPLICATION_JSON)
115115
.header("Access-Control-Request-Method", "POST")
116-
.header("Origin", "http://example.com").exchange().expectStatus().isOk()
116+
.header("Origin", "https://example.com").exchange().expectStatus().isOk()
117117
.expectHeader()
118-
.valueEquals("Access-Control-Allow-Origin", "http://example.com")
118+
.valueEquals("Access-Control-Allow-Origin", "https://example.com")
119119
.expectHeader().valueEquals("Access-Control-Allow-Methods", "GET,POST")));
120120
}
121121

@@ -204,7 +204,7 @@ public CloudFoundryWebFluxEndpointHandlerMapping cloudFoundryWebEndpointServletH
204204
EndpointMediaTypes endpointMediaTypes,
205205
CloudFoundrySecurityInterceptor interceptor) {
206206
CorsConfiguration corsConfiguration = new CorsConfiguration();
207-
corsConfiguration.setAllowedOrigins(Arrays.asList("http://example.com"));
207+
corsConfiguration.setAllowedOrigins(Arrays.asList("https://example.com"));
208208
corsConfiguration.setAllowedMethods(Arrays.asList("GET", "POST"));
209209
return new CloudFoundryWebFluxEndpointHandlerMapping(
210210
new EndpointMapping("/cfApplication"),

‎spring-boot-project/spring-boot-actuator-autoconfigure/src/test/java/org/springframework/boot/actuate/autoconfigure/cloudfoundry/reactive/ReactiveCloudFoundryActuatorAutoConfigurationTests.java

Lines changed: 11 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -102,7 +102,7 @@ public void cloudFoundryPlatformActive() {
102102
this.contextRunner
103103
.withPropertyValues("VCAP_APPLICATION:---",
104104
"vcap.application.application_id:my-app-id",
105-
"vcap.application.cf_api:http://my-cloud-controller.com")
105+
"vcap.application.cf_api:https://my-cloud-controller.com")
106106
.run((context) -> {
107107
CloudFoundryWebFluxEndpointHandlerMapping handlerMapping = getHandlerMapping(
108108
context);
@@ -126,7 +126,7 @@ public void cloudfoundryapplicationProducesActuatorMediaType() {
126126
this.contextRunner
127127
.withPropertyValues("VCAP_APPLICATION:---",
128128
"vcap.application.application_id:my-app-id",
129-
"vcap.application.cf_api:http://my-cloud-controller.com")
129+
"vcap.application.cf_api:https://my-cloud-controller.com")
130130
.run((context) -> {
131131
WebTestClient webTestClient = WebTestClient
132132
.bindToApplicationContext(context).build();
@@ -140,7 +140,7 @@ public void cloudFoundryPlatformActiveSetsApplicationId() {
140140
this.contextRunner
141141
.withPropertyValues("VCAP_APPLICATION:---",
142142
"vcap.application.application_id:my-app-id",
143-
"vcap.application.cf_api:http://my-cloud-controller.com")
143+
"vcap.application.cf_api:https://my-cloud-controller.com")
144144
.run((context) -> {
145145
CloudFoundryWebFluxEndpointHandlerMapping handlerMapping = getHandlerMapping(
146146
context);
@@ -157,7 +157,7 @@ public void cloudFoundryPlatformActiveSetsCloudControllerUrl() {
157157
this.contextRunner
158158
.withPropertyValues("VCAP_APPLICATION:---",
159159
"vcap.application.application_id:my-app-id",
160-
"vcap.application.cf_api:http://my-cloud-controller.com")
160+
"vcap.application.cf_api:https://my-cloud-controller.com")
161161
.run((context) -> {
162162
CloudFoundryWebFluxEndpointHandlerMapping handlerMapping = getHandlerMapping(
163163
context);
@@ -168,7 +168,7 @@ public void cloudFoundryPlatformActiveSetsCloudControllerUrl() {
168168
String cloudControllerUrl = (String) ReflectionTestUtils
169169
.getField(interceptorSecurityService, "cloudControllerUrl");
170170
assertThat(cloudControllerUrl)
171-
.isEqualTo("http://my-cloud-controller.com");
171+
.isEqualTo("https://my-cloud-controller.com");
172172
});
173173
}
174174

@@ -193,7 +193,7 @@ public void cloudFoundryPathsIgnoredBySpringSecurity() {
193193
this.contextRunner
194194
.withPropertyValues("VCAP_APPLICATION:---",
195195
"vcap.application.application_id:my-app-id",
196-
"vcap.application.cf_api:http://my-cloud-controller.com")
196+
"vcap.application.cf_api:https://my-cloud-controller.com")
197197
.run((context) -> {
198198
WebFilterChainProxy chainProxy = context
199199
.getBean(WebFilterChainProxy.class);
@@ -240,7 +240,7 @@ public void allEndpointsAvailableUnderCloudFoundryWithoutEnablingWebIncludes() {
240240
this.contextRunner.withUserConfiguration(TestConfiguration.class)
241241
.withPropertyValues("VCAP_APPLICATION:---",
242242
"vcap.application.application_id:my-app-id",
243-
"vcap.application.cf_api:http://my-cloud-controller.com")
243+
"vcap.application.cf_api:https://my-cloud-controller.com")
244244
.run((context) -> {
245245
CloudFoundryWebFluxEndpointHandlerMapping handlerMapping = getHandlerMapping(
246246
context);
@@ -258,7 +258,7 @@ public void endpointPathCustomizationIsNotApplied() {
258258
this.contextRunner.withUserConfiguration(TestConfiguration.class)
259259
.withPropertyValues("VCAP_APPLICATION:---",
260260
"vcap.application.application_id:my-app-id",
261-
"vcap.application.cf_api:http://my-cloud-controller.com")
261+
"vcap.application.cf_api:https://my-cloud-controller.com")
262262
.run((context) -> {
263263
CloudFoundryWebFluxEndpointHandlerMapping handlerMapping = getHandlerMapping(
264264
context);
@@ -282,7 +282,7 @@ public void healthEndpointInvokerShouldBeCloudFoundryWebExtension() {
282282
AutoConfigurations.of(HealthEndpointAutoConfiguration.class))
283283
.withPropertyValues("VCAP_APPLICATION:---",
284284
"vcap.application.application_id:my-app-id",
285-
"vcap.application.cf_api:http://my-cloud-controller.com")
285+
"vcap.application.cf_api:https://my-cloud-controller.com")
286286
.run((context) -> {
287287
Collection<ExposableWebEndpoint> endpoints = getHandlerMapping(
288288
context).getEndpoints();
@@ -304,7 +304,7 @@ public void skipSslValidation() {
304304
AutoConfigurations.of(HealthEndpointAutoConfiguration.class))
305305
.withPropertyValues("VCAP_APPLICATION:---",
306306
"vcap.application.application_id:my-app-id",
307-
"vcap.application.cf_api:http://my-cloud-controller.com",
307+
"vcap.application.cf_api:https://my-cloud-controller.com",
308308
"management.cloudfoundry.skip-ssl-validation:true")
309309
.run((context) -> {
310310
CloudFoundryWebFluxEndpointHandlerMapping handlerMapping = getHandlerMapping(
@@ -327,7 +327,7 @@ public void sslValidationNotSkippedByDefault() {
327327
AutoConfigurations.of(HealthEndpointAutoConfiguration.class))
328328
.withPropertyValues("VCAP_APPLICATION:---",
329329
"vcap.application.application_id:my-app-id",
330-
"vcap.application.cf_api:http://my-cloud-controller.com")
330+
"vcap.application.cf_api:https://my-cloud-controller.com")
331331
.run((context) -> {
332332
CloudFoundryWebFluxEndpointHandlerMapping handlerMapping = getHandlerMapping(
333333
context);

‎spring-boot-project/spring-boot-actuator-autoconfigure/src/test/java/org/springframework/boot/actuate/autoconfigure/cloudfoundry/reactive/ReactiveCloudFoundrySecurityInterceptorTests.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -61,7 +61,7 @@ public void setup() {
6161
@Test
6262
public void preHandleWhenRequestIsPreFlightShouldBeOk() {
6363
MockServerWebExchange request = MockServerWebExchange.from(MockServerHttpRequest
64-
.options("/a").header(HttpHeaders.ORIGIN, "http://example.com")
64+
.options("/a").header(HttpHeaders.ORIGIN, "https://example.com")
6565
.header(HttpHeaders.ACCESS_CONTROL_REQUEST_METHOD, "GET").build());
6666
StepVerifier.create(this.interceptor.preHandle(request, "/a")).consumeNextWith(
6767
(response) -> assertThat(response.getStatus()).isEqualTo(HttpStatus.OK))

‎spring-boot-project/spring-boot-actuator-autoconfigure/src/test/java/org/springframework/boot/actuate/autoconfigure/cloudfoundry/reactive/ReactiveCloudFoundrySecurityServiceTests.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,7 @@ public class ReactiveCloudFoundrySecurityServiceTests {
4646
private static final String CLOUD_CONTROLLER_PERMISSIONS = CLOUD_CONTROLLER
4747
+ "/v2/apps/my-app-id/permissions";
4848

49-
private static final String UAA_URL = "http://my-cloud-controller.com/uaa";
49+
private static final String UAA_URL = "https://my-cloud-controller.com/uaa";
5050

5151
private ReactiveCloudFoundrySecurityService securityService;
5252

‎spring-boot-project/spring-boot-actuator-autoconfigure/src/test/java/org/springframework/boot/actuate/autoconfigure/cloudfoundry/reactive/ReactiveTokenValidatorTests.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -259,7 +259,7 @@ public void validateTokenWhenExpiredShouldThrowException() throws Exception {
259259
public void validateTokenWhenIssuerIsNotValidShouldThrowException() throws Exception {
260260
given(this.securityService.fetchTokenKeys()).willReturn(Mono.just(VALID_KEYS));
261261
given(this.securityService.getUaaUrl())
262-
.willReturn(Mono.just("http://other-uaa.com"));
262+
.willReturn(Mono.just("https://other-uaa.com"));
263263
String header = "{ \"alg\": \"RS256\", \"kid\": \"valid-key\", \"typ\": \"JWT\", \"scope\": [\"actuator.read\"]}";
264264
String claims = "{ \"exp\": 2147483647, \"iss\": \"http://localhost:8080/uaa/oauth/token\", \"scope\": [\"foo.bar\"]}";
265265
StepVerifier

‎spring-boot-project/spring-boot-actuator-autoconfigure/src/test/java/org/springframework/boot/actuate/autoconfigure/cloudfoundry/servlet/CloudFoundryActuatorAutoConfigurationTests.java

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -84,7 +84,7 @@ public void cloudFoundryPlatformActive() {
8484
this.contextRunner
8585
.withPropertyValues("VCAP_APPLICATION:---",
8686
"vcap.application.application_id:my-app-id",
87-
"vcap.application.cf_api:http://my-cloud-controller.com")
87+
"vcap.application.cf_api:https://my-cloud-controller.com")
8888
.run((context) -> {
8989
CloudFoundryWebEndpointServletHandlerMapping handlerMapping = getHandlerMapping(
9090
context);
@@ -108,7 +108,7 @@ public void cloudfoundryapplicationProducesActuatorMediaType() throws Exception
108108
this.contextRunner
109109
.withPropertyValues("VCAP_APPLICATION:---",
110110
"vcap.application.application_id:my-app-id",
111-
"vcap.application.cf_api:http://my-cloud-controller.com")
111+
"vcap.application.cf_api:https://my-cloud-controller.com")
112112
.run((context) -> {
113113
MockMvc mockMvc = MockMvcBuilders.webAppContextSetup(context).build();
114114
mockMvc.perform(get("/cloudfoundryapplication"))
@@ -122,7 +122,7 @@ public void cloudFoundryPlatformActiveSetsApplicationId() {
122122
this.contextRunner
123123
.withPropertyValues("VCAP_APPLICATION:---",
124124
"vcap.application.application_id:my-app-id",
125-
"vcap.application.cf_api:http://my-cloud-controller.com")
125+
"vcap.application.cf_api:https://my-cloud-controller.com")
126126
.run((context) -> {
127127
CloudFoundryWebEndpointServletHandlerMapping handlerMapping = getHandlerMapping(
128128
context);
@@ -139,7 +139,7 @@ public void cloudFoundryPlatformActiveSetsCloudControllerUrl() {
139139
this.contextRunner
140140
.withPropertyValues("VCAP_APPLICATION:---",
141141
"vcap.application.application_id:my-app-id",
142-
"vcap.application.cf_api:http://my-cloud-controller.com")
142+
"vcap.application.cf_api:https://my-cloud-controller.com")
143143
.run((context) -> {
144144
CloudFoundryWebEndpointServletHandlerMapping handlerMapping = getHandlerMapping(
145145
context);
@@ -150,7 +150,7 @@ public void cloudFoundryPlatformActiveSetsCloudControllerUrl() {
150150
String cloudControllerUrl = (String) ReflectionTestUtils
151151
.getField(interceptorSecurityService, "cloudControllerUrl");
152152
assertThat(cloudControllerUrl)
153-
.isEqualTo("http://my-cloud-controller.com");
153+
.isEqualTo("https://my-cloud-controller.com");
154154
});
155155
}
156156

@@ -159,7 +159,7 @@ public void skipSslValidation() {
159159
this.contextRunner
160160
.withPropertyValues("VCAP_APPLICATION:---",
161161
"vcap.application.application_id:my-app-id",
162-
"vcap.application.cf_api:http://my-cloud-controller.com",
162+
"vcap.application.cf_api:https://my-cloud-controller.com",
163163
"management.cloudfoundry.skip-ssl-validation:true")
164164
.run((context) -> {
165165
CloudFoundryWebEndpointServletHandlerMapping handlerMapping = getHandlerMapping(
@@ -229,7 +229,7 @@ public void allEndpointsAvailableUnderCloudFoundryWithoutExposeAllOnWeb() {
229229
this.contextRunner.withUserConfiguration(TestConfiguration.class)
230230
.withPropertyValues("VCAP_APPLICATION:---",
231231
"vcap.application.application_id:my-app-id",
232-
"vcap.application.cf_api:http://my-cloud-controller.com")
232+
"vcap.application.cf_api:https://my-cloud-controller.com")
233233
.run((context) -> {
234234
CloudFoundryWebEndpointServletHandlerMapping handlerMapping = getHandlerMapping(
235235
context);
@@ -247,7 +247,7 @@ public void endpointPathCustomizationIsNotApplied() {
247247
this.contextRunner
248248
.withPropertyValues("VCAP_APPLICATION:---",
249249
"vcap.application.application_id:my-app-id",
250-
"vcap.application.cf_api:http://my-cloud-controller.com",
250+
"vcap.application.cf_api:https://my-cloud-controller.com",
251251
"management.endpoints.web.path-mapping.test=custom")
252252
.withUserConfiguration(TestConfiguration.class).run((context) -> {
253253
CloudFoundryWebEndpointServletHandlerMapping handlerMapping = getHandlerMapping(
@@ -271,7 +271,7 @@ public void healthEndpointInvokerShouldBeCloudFoundryWebExtension() {
271271
this.contextRunner
272272
.withPropertyValues("VCAP_APPLICATION:---",
273273
"vcap.application.application_id:my-app-id",
274-
"vcap.application.cf_api:http://my-cloud-controller.com")
274+
"vcap.application.cf_api:https://my-cloud-controller.com")
275275
.withConfiguration(
276276
AutoConfigurations.of(HealthEndpointAutoConfiguration.class))
277277
.run((context) -> {

‎spring-boot-project/spring-boot-actuator-autoconfigure/src/test/java/org/springframework/boot/actuate/autoconfigure/cloudfoundry/servlet/CloudFoundryMvcWebEndpointIntegrationTests.java

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -98,9 +98,9 @@ public void responseToOptionsRequestIncludesCorsHeaders() {
9898
load(TestEndpointConfiguration.class, (client) -> client.options()
9999
.uri("/cfApplication/test").accept(MediaType.APPLICATION_JSON)
100100
.header("Access-Control-Request-Method", "POST")
101-
.header("Origin", "http://example.com").exchange().expectStatus().isOk()
101+
.header("Origin", "https://example.com").exchange().expectStatus().isOk()
102102
.expectHeader()
103-
.valueEquals("Access-Control-Allow-Origin", "http://example.com")
103+
.valueEquals("Access-Control-Allow-Origin", "https://example.com")
104104
.expectHeader().valueEquals("Access-Control-Allow-Methods", "GET,POST"));
105105
}
106106

@@ -203,7 +203,7 @@ public CloudFoundryWebEndpointServletHandlerMapping cloudFoundryWebEndpointServl
203203
EndpointMediaTypes endpointMediaTypes,
204204
CloudFoundrySecurityInterceptor interceptor) {
205205
CorsConfiguration corsConfiguration = new CorsConfiguration();
206-
corsConfiguration.setAllowedOrigins(Arrays.asList("http://example.com"));
206+
corsConfiguration.setAllowedOrigins(Arrays.asList("https://example.com"));
207207
corsConfiguration.setAllowedMethods(Arrays.asList("GET", "POST"));
208208
return new CloudFoundryWebEndpointServletHandlerMapping(
209209
new EndpointMapping("/cfApplication"),

‎spring-boot-project/spring-boot-actuator-autoconfigure/src/test/java/org/springframework/boot/actuate/autoconfigure/cloudfoundry/servlet/CloudFoundrySecurityInterceptorTests.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -64,7 +64,7 @@ public void setup() {
6464
@Test
6565
public void preHandleWhenRequestIsPreFlightShouldReturnTrue() {
6666
this.request.setMethod("OPTIONS");
67-
this.request.addHeader(HttpHeaders.ORIGIN, "http://example.com");
67+
this.request.addHeader(HttpHeaders.ORIGIN, "https://example.com");
6868
this.request.addHeader(HttpHeaders.ACCESS_CONTROL_REQUEST_METHOD, "GET");
6969
SecurityResponse response = this.interceptor.preHandle(this.request,
7070
EndpointId.of("test"));

‎spring-boot-project/spring-boot-actuator/src/test/java/org/springframework/boot/actuate/endpoint/web/LinkTests.java

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -41,21 +41,21 @@ public void createWhenHrefIsNullShouldThrowException() {
4141

4242
@Test
4343
public void getHrefShouldReturnHref() {
44-
String href = "http://example.com";
44+
String href = "https://example.com";
4545
Link link = new Link(href);
4646
assertThat(link.getHref()).isEqualTo(href);
4747
}
4848

4949
@Test
5050
public void isTemplatedWhenContainsPlaceholderShouldReturnTrue() {
51-
String href = "http://example.com/{path}";
51+
String href = "https://example.com/{path}";
5252
Link link = new Link(href);
5353
assertThat(link.isTemplated()).isTrue();
5454
}
5555

5656
@Test
5757
public void isTemplatedWhenContainsNoPlaceholderShouldReturnFalse() {
58-
String href = "http://example.com/path";
58+
String href = "https://example.com/path";
5959
Link link = new Link(href);
6060
assertThat(link.isTemplated()).isFalse();
6161
}

‎spring-boot-project/spring-boot-actuator/src/test/java/org/springframework/boot/actuate/endpoint/web/reactive/WebFluxEndpointIntegrationTests.java

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -82,9 +82,9 @@ public void responseToOptionsRequestIncludesCorsHeaders() {
8282
load(TestEndpointConfiguration.class, (client) -> client.options().uri("/test")
8383
.accept(MediaType.APPLICATION_JSON)
8484
.header("Access-Control-Request-Method", "POST")
85-
.header("Origin", "http://example.com").exchange().expectStatus().isOk()
85+
.header("Origin", "https://example.com").exchange().expectStatus().isOk()
8686
.expectHeader()
87-
.valueEquals("Access-Control-Allow-Origin", "http://example.com")
87+
.valueEquals("Access-Control-Allow-Origin", "https://example.com")
8888
.expectHeader().valueEquals("Access-Control-Allow-Methods", "GET,POST"));
8989
}
9090

@@ -127,7 +127,7 @@ public WebFluxEndpointHandlerMapping webEndpointHandlerMapping(
127127
Environment environment, WebEndpointDiscoverer endpointDiscoverer,
128128
EndpointMediaTypes endpointMediaTypes) {
129129
CorsConfiguration corsConfiguration = new CorsConfiguration();
130-
corsConfiguration.setAllowedOrigins(Arrays.asList("http://example.com"));
130+
corsConfiguration.setAllowedOrigins(Arrays.asList("https://example.com"));
131131
corsConfiguration.setAllowedMethods(Arrays.asList("GET", "POST"));
132132
return new WebFluxEndpointHandlerMapping(
133133
new EndpointMapping(environment.getProperty("endpointPath")),

0 commit comments

Comments
 (0)