{"action":"created","issue":{"url":"https://api.github.com/repos/spring-projects/spring-boot/issues/5476","repository_url":"https://api.github.com/repos/spring-projects/spring-boot","labels_url":"https://api.github.com/repos/spring-projects/spring-boot/issues/5476/labels{/name}","comments_url":"https://api.github.com/repos/spring-projects/spring-boot/issues/5476/comments","events_url":"https://api.github.com/repos/spring-projects/spring-boot/issues/5476/events","html_url":"https://github.com/spring-projects/spring-boot/issues/5476","id":143171149,"number":5476,"title":"Support Spring Security with @WebMvcTest","user":{"login":"philwebb","id":519772,"avatar_url":"https://avatars.githubusercontent.com/u/519772?v=3","gravatar_id":"","url":"https://api.github.com/users/philwebb","html_url":"https://github.com/philwebb","followers_url":"https://api.github.com/users/philwebb/followers","following_url":"https://api.github.com/users/philwebb/following{/other_user}","gists_url":"https://api.github.com/users/philwebb/gists{/gist_id}","starred_url":"https://api.github.com/users/philwebb/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/philwebb/subscriptions","organizations_url":"https://api.github.com/users/philwebb/orgs","repos_url":"https://api.github.com/users/philwebb/repos","events_url":"https://api.github.com/users/philwebb/events{/privacy}","received_events_url":"https://api.github.com/users/philwebb/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":{"login":"wilkinsona","id":914682,"avatar_url":"https://avatars.githubusercontent.com/u/914682?v=3","gravatar_id":"","url":"https://api.github.com/users/wilkinsona","html_url":"https://github.com/wilkinsona","followers_url":"https://api.github.com/users/wilkinsona/followers","following_url":"https://api.github.com/users/wilkinsona/following{/other_user}","gists_url":"https://api.github.com/users/wilkinsona/gists{/gist_id}","starred_url":"https://api.github.com/users/wilkinsona/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/wilkinsona/subscriptions","organizations_url":"https://api.github.com/users/wilkinsona/orgs","repos_url":"https://api.github.com/users/wilkinsona/repos","events_url":"https://api.github.com/users/wilkinsona/events{/privacy}","received_events_url":"https://api.github.com/users/wilkinsona/received_events","type":"User","site_admin":false},"milestone":{"url":"https://api.github.com/repos/spring-projects/spring-boot/milestones/62","html_url":"https://github.com/spring-projects/spring-boot/milestones/1.4.0.M3","labels_url":"https://api.github.com/repos/spring-projects/spring-boot/milestones/62/labels","id":1608585,"number":62,"title":"1.4.0.M3","description":"Target for Spring I/O Conference","creator":{"login":"philwebb","id":519772,"avatar_url":"https://avatars.githubusercontent.com/u/519772?v=3","gravatar_id":"","url":"https://api.github.com/users/philwebb","html_url":"https://github.com/philwebb","followers_url":"https://api.github.com/users/philwebb/followers","following_url":"https://api.github.com/users/philwebb/following{/other_user}","gists_url":"https://api.github.com/users/philwebb/gists{/gist_id}","starred_url":"https://api.github.com/users/philwebb/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/philwebb/subscriptions","organizations_url":"https://api.github.com/users/philwebb/orgs","repos_url":"https://api.github.com/users/philwebb/repos","events_url":"https://api.github.com/users/philwebb/events{/privacy}","received_events_url":"https://api.github.com/users/philwebb/received_events","type":"User","site_admin":false},"open_issues":56,"closed_issues":37,"state":"open","created_at":"2016-02-26T18:37:00Z","updated_at":"2016-04-21T11:36:53Z","due_on":"2016-05-12T07:00:00Z","closed_at":null},"comments":1,"created_at":"2016-03-24T07:16:15Z","updated_at":"2016-04-21T14:34:23Z","closed_at":null,"body":"The new annotation needs to really work with Spring Security."},"comment":{"url":"https://api.github.com/repos/spring-projects/spring-boot/issues/comments/212946690","html_url":"https://github.com/spring-projects/spring-boot/issues/5476#issuecomment-212946690","issue_url":"https://api.github.com/repos/spring-projects/spring-boot/issues/5476","id":212946690,"user":{"login":"wilkinsona","id":914682,"avatar_url":"https://avatars.githubusercontent.com/u/914682?v=3","gravatar_id":"","url":"https://api.github.com/users/wilkinsona","html_url":"https://github.com/wilkinsona","followers_url":"https://api.github.com/users/wilkinsona/followers","following_url":"https://api.github.com/users/wilkinsona/following{/other_user}","gists_url":"https://api.github.com/users/wilkinsona/gists{/gist_id}","starred_url":"https://api.github.com/users/wilkinsona/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/wilkinsona/subscriptions","organizations_url":"https://api.github.com/users/wilkinsona/orgs","repos_url":"https://api.github.com/users/wilkinsona/repos","events_url":"https://api.github.com/users/wilkinsona/events{/privacy}","received_events_url":"https://api.github.com/users/wilkinsona/received_events","type":"User","site_admin":false},"created_at":"2016-04-21T14:34:23Z","updated_at":"2016-04-21T14:34:23Z","body":"Here's one possible [approach](https://github.com/wilkinsona/spring-boot/tree/gh-5476). It adds a new `@AutoConfigureSecurity` annotation which imports `SecurityAutoConfiguration` and auto-configures a `MockMvcBuilderCustomizer` that applies `SecurityMockMvcConfigurers.springSecurity()` to the builder.\r\n\r\nA test that uses it looks like this:\r\n\r\n```java\r\n@RunWith(SpringRunner.class)\r\n@WebMvcTest\r\n@AutoConfigureSecurity\r\n@TestPropertySource(properties = \"security.user.password=secret\")\r\npublic class Gh5476ApplicationTests {\r\n\r\n\t@Autowired\r\n\tMockMvc mockMvc;\r\n\r\n\t@Test\r\n\t@WithMockUser(username = \"test\", password = \"test\", roles = \"USER\")\r\n\tpublic void okResponseWithMockUser() throws Exception {\r\n\t\tthis.mockMvc.perform(get(\"/\")).andExpect(status().isOk());\r\n\t}\r\n\r\n\t@Test\r\n\tpublic void unauthorizedResponseWithNoUser() throws Exception {\r\n\t\tthis.mockMvc.perform(get(\"/\")).andExpect(status().isUnauthorized());\r\n\t}\r\n\r\n\t@Test\r\n\tpublic void okResponseWithBasicAuthCredentialsForKnownUser() throws Exception {\r\n\t\tthis.mockMvc\r\n\t\t\t\t.perform(get(\"/\").header(HttpHeaders.AUTHORIZATION,\r\n\t\t\t\t\t\t\"Basic \" + Base64Utils.encodeToString(\"user:secret\".getBytes())))\r\n\t\t\t\t.andExpect(status().isOk());\r\n\t}\r\n\r\n}\r\n```\r\n\r\nI'm undecided on the separate `@AutoConfigureSecurity` annotation. I wonder if we could achieve the same end result with a `secure` attribute on `@WebMvcTest`? @rwinch @philwebb, what do you think?\r\n\r\nOne thing that I haven't addressed yet is that Spring Security's filter is added twice. I think we need a way for security test auto-configuration to prevent the security filter from being added in the general purpose auto-configuration of MockMvc.\r\n"}}