mcpField
S
spring-security-testing

spring-security-testing

github.com/spring-ai-communityTesting & quality5239 installsUpdated 27w ago
Repository

About spring-security-testing

spring-security-testing is a skill for writing security-focused tests in Spring applications. It covers common authentication, authorization, CSRF, JWT, OAuth2, and OIDC test patterns for developers using JUnit 5.

Key features

  1. 01Set up mock users and user details
  2. 02Test per-request authentication
  3. 03Include CSRF tokens in requests
  4. 04Test JWT resource server behavior
  5. 05Test OAuth2 and OIDC login
  6. 06Test method security and custom contexts

Use cases

  1. 01Test access rules with mock users
  2. 02Exercise secured POST, PUT, and DELETE requests
  3. 03Verify JWT-protected endpoints
  4. 04Test OAuth2 or OIDC authentication flows

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/spring-ai-community/spring-testing-skills --skill spring-security-testing

After installing, type/spring-security-testingin Claude Code to confirm it loaded.

Bundled filesreferences/security-testing-patterns.md

Details

From the project README

Spring Security Testing

Signals: @WithMockUser, @WithUserDetails, csrf(), jwt(), oauth2Login(), mockOidcLogin(), @WithSecurityContext, SecurityMockMvcRequestPostProcessors, AccessDeniedException, SCOPE_

Tested With

  • Spring Boot 3.2+ / Spring Boot 4.x
  • Spring Security 6.x / 7.x
  • Spring Framework 6.x / Spring Framework 7.x
  • JUnit 5

Do NOT Use This Skill When

  • Testing REST controller HTTP behavior (status codes, JSON body, headers) without security focus → use spring-mvc-testing
  • Testing reactive endpoints with security → use spring-webflux-testing
  • Testing JPA repositories → use spring-jpa-testing
  • Writing pure unit tests for service logic without security context → use spring-testing-fundamentals

When to Read References

SituationRead
@WithMockUser and @WithUserDetails setupreferences/security-testing-patterns.md
roles vs authorities and the ROLE_ prefix trapreferences/security-testing-patterns.md
Per-request auth with SecurityMockMvcRequestPostProcessors (user(), httpBasic())references/security-testing-patterns.md
CSRF on POST/PUT/DELETE — preventing 403 in testsreferences/security-testing-patterns.md
JWT resource server testing with jwt() post-processorreferences/security-testing-patterns.md
OAuth2 login and OIDC testing with oauth2Login(), mockOidcLogin()references/security-testing-patterns.md
Custom @WithSecurityContext for complex JWT scenariosreferences/security-testing-patterns.md
@PreAuthorize method security testingreferences/security-testing-patterns.md
Boot 3.x → 4.x security testing changesreferences/security-testing-patterns.md

Comments

Markdown supported