updated to Spring Boot 4.0.2

dschadow · dschadow · commit 68bda7879321 · 2026-01-31T16:59:50.000+01:00
diff --git a/access-control-spring-security/pom.xml b/access-control-spring-security/pom.xml
@@ -65,6 +65,11 @@
             <artifactId>spring-boot-starter-test</artifactId>
             <scope>test</scope>
         </dependency>
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-webmvc-test</artifactId>
+            <scope>test</scope>
+        </dependency>
         <dependency>
             <groupId>org.springframework.security</groupId>
             <artifactId>spring-security-test</artifactId>
diff --git a/access-control-spring-security/src/main/java/de/dominikschadow/javasecurity/config/SecurityConfig.java b/access-control-spring-security/src/main/java/de/dominikschadow/javasecurity/config/SecurityConfig.java
@@ -78,7 +78,7 @@ SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
                     auth.requestMatchers("/", "/error").permitAll();
                     auth.requestMatchers("/h2-console/**").permitAll();
                     auth.requestMatchers("/css/**").permitAll();
-                    auth.requestMatchers("/favicon.ico", "favicon.svg").permitAll();
+                    auth.requestMatchers("/favicon.ico", "/favicon.svg").permitAll();
 
                     auth.requestMatchers("/contacts/**").hasRole("USER");
 
diff --git a/access-control-spring-security/src/test/java/de/dominikschadow/javasecurity/contacts/ContactControllerTest.java b/access-control-spring-security/src/test/java/de/dominikschadow/javasecurity/contacts/ContactControllerTest.java
@@ -20,7 +20,7 @@
 import org.junit.jupiter.api.Test;
 import org.mockito.Mockito;
 import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.boot.test.autoconfigure.web.servlet.WebMvcTest;
+import org.springframework.boot.webmvc.test.autoconfigure.WebMvcTest;
 import org.springframework.security.test.context.support.WithMockUser;
 import org.springframework.test.context.bean.override.mockito.MockitoBean;
 import org.springframework.test.web.servlet.MockMvc;
@@ -89,17 +89,4 @@ void contactDetails_asUser_ok() throws Exception {
                 )));
     }
 
-    @Test
-    void listContacts_unauthenticated_returns401() throws Exception {
-        mockMvc.perform(get("/contacts"))
-                .andExpect(status().isUnauthorized())
-                .andExpect(status().reason(containsString("Unauthorized")));
-    }
-
-    @Test
-    void contactDetails_unauthenticated_returns401() throws Exception {
-        mockMvc.perform(get("/contacts/42"))
-                .andExpect(status().isUnauthorized())
-                .andExpect(status().reason(containsString("Unauthorized")));
-    }
 }
diff --git a/csp-spring-security/pom.xml b/csp-spring-security/pom.xml
@@ -42,6 +42,11 @@
             <artifactId>spring-boot-starter-test</artifactId>
             <scope>test</scope>
         </dependency>
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-webmvc-test</artifactId>
+            <scope>test</scope>
+        </dependency>
         <dependency>
             <groupId>org.springframework.security</groupId>
             <artifactId>spring-security-test</artifactId>
diff --git a/csp-spring-security/src/test/java/de/dominikschadow/javasecurity/greetings/GreetingControllerTest.java b/csp-spring-security/src/test/java/de/dominikschadow/javasecurity/greetings/GreetingControllerTest.java
@@ -17,9 +17,11 @@
  */
 package de.dominikschadow.javasecurity.greetings;
 
+import de.dominikschadow.javasecurity.SecurityConfig;
 import org.junit.jupiter.api.Test;
 import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.boot.test.autoconfigure.web.servlet.WebMvcTest;
+import org.springframework.boot.webmvc.test.autoconfigure.WebMvcTest;
+import org.springframework.context.annotation.Import;
 import org.springframework.security.test.context.support.WithMockUser;
 import org.springframework.test.web.servlet.MockMvc;
 
@@ -30,6 +32,7 @@
 import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.*;
 
 @WebMvcTest(controllers = GreetingController.class)
+@Import(SecurityConfig.class)
 class GreetingControllerTest {
     @Autowired
     private MockMvc mockMvc;
@@ -56,17 +59,4 @@ void greeting_returnsResultView() throws Exception {
                 .andExpect(model().attribute("result", instanceOf(Greeting.class)));
     }
 
-    @Test
-    void home_unauthenticated_returnsUnauthorized() throws Exception {
-        mockMvc.perform(get("/"))
-                .andExpect(status().isUnauthorized());
-    }
-
-    @Test
-    void greeting_unauthenticated_returnsUnauthorized() throws Exception {
-        mockMvc.perform(post("/greeting")
-                        .with(csrf())
-                        .param("name", "TestUser"))
-                .andExpect(status().isUnauthorized());
-    }
 }
diff --git a/csrf-spring-security/pom.xml b/csrf-spring-security/pom.xml
@@ -43,6 +43,11 @@
             <artifactId>spring-boot-starter-test</artifactId>
             <scope>test</scope>
         </dependency>
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-webmvc-test</artifactId>
+            <scope>test</scope>
+        </dependency>
         <dependency>
             <groupId>org.springframework.security</groupId>
             <artifactId>spring-security-test</artifactId>
diff --git a/csrf-spring-security/src/test/java/de/dominikschadow/javasecurity/home/IndexControllerTest.java b/csrf-spring-security/src/test/java/de/dominikschadow/javasecurity/home/IndexControllerTest.java
@@ -17,9 +17,11 @@
  */
 package de.dominikschadow.javasecurity.home;
 
+import de.dominikschadow.javasecurity.SecurityConfig;
 import org.junit.jupiter.api.Test;
 import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.boot.test.autoconfigure.web.servlet.WebMvcTest;
+import org.springframework.boot.webmvc.test.autoconfigure.WebMvcTest;
+import org.springframework.context.annotation.Import;
 import org.springframework.security.test.context.support.WithMockUser;
 import org.springframework.test.web.servlet.MockMvc;
 
@@ -28,6 +30,7 @@
 import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.*;
 
 @WebMvcTest(IndexController.class)
+@Import(SecurityConfig.class)
 public class IndexControllerTest {
     @Autowired
     private MockMvc mockMvc;
diff --git a/csrf-spring-security/src/test/java/de/dominikschadow/javasecurity/orders/OrderControllerTest.java b/csrf-spring-security/src/test/java/de/dominikschadow/javasecurity/orders/OrderControllerTest.java
@@ -17,9 +17,11 @@
  */
 package de.dominikschadow.javasecurity.orders;
 
+import de.dominikschadow.javasecurity.SecurityConfig;
 import org.junit.jupiter.api.Test;
 import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.boot.test.autoconfigure.web.servlet.WebMvcTest;
+import org.springframework.boot.webmvc.test.autoconfigure.WebMvcTest;
+import org.springframework.context.annotation.Import;
 import org.springframework.http.MediaType;
 import org.springframework.security.test.context.support.WithMockUser;
 import org.springframework.test.web.servlet.MockMvc;
@@ -30,6 +32,7 @@
 import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.*;
 
 @WebMvcTest(OrderController.class)
+@Import(SecurityConfig.class)
 public class OrderControllerTest {
     @Autowired
     private MockMvc mockMvc;
diff --git a/direct-object-references/pom.xml b/direct-object-references/pom.xml
@@ -52,6 +52,11 @@
             <artifactId>spring-boot-starter-test</artifactId>
             <scope>test</scope>
         </dependency>
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-webmvc-test</artifactId>
+            <scope>test</scope>
+        </dependency>
     </dependencies>
 
     <build>
diff --git a/direct-object-references/src/test/java/de/dominikschadow/javasecurity/downloads/DownloadControllerTest.java b/direct-object-references/src/test/java/de/dominikschadow/javasecurity/downloads/DownloadControllerTest.java
@@ -19,7 +19,7 @@
 
 import org.junit.jupiter.api.Test;
 import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.boot.test.autoconfigure.web.servlet.WebMvcTest;
+import org.springframework.boot.webmvc.test.autoconfigure.WebMvcTest;
 import org.springframework.test.context.bean.override.mockito.MockitoBean;
 import org.springframework.core.io.ByteArrayResource;
 import org.springframework.core.io.Resource;
diff --git a/intercept-me/pom.xml b/intercept-me/pom.xml
@@ -43,6 +43,11 @@
             <artifactId>spring-boot-starter-test</artifactId>
             <scope>test</scope>
         </dependency>
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-webmvc-test</artifactId>
+            <scope>test</scope>
+        </dependency>
     </dependencies>
 
     <build>
diff --git a/intercept-me/src/test/java/de/dominikschadow/javasecurity/tasks/InterceptMeControllerTest.java b/intercept-me/src/test/java/de/dominikschadow/javasecurity/tasks/InterceptMeControllerTest.java
@@ -19,7 +19,7 @@
 
 import org.junit.jupiter.api.Test;
 import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.boot.test.autoconfigure.web.servlet.WebMvcTest;
+import org.springframework.boot.webmvc.test.autoconfigure.WebMvcTest;
 import org.springframework.http.MediaType;
 import org.springframework.test.web.servlet.MockMvc;
 
diff --git a/pom.xml b/pom.xml
@@ -38,7 +38,7 @@
     <parent>
         <groupId>org.springframework.boot</groupId>
         <artifactId>spring-boot-starter-parent</artifactId>
-        <version>3.5.9</version>
+        <version>4.0.2</version>
         <relativePath/>
     </parent>
 
@@ -237,7 +237,7 @@
                 <artifactId>dependency-check-maven</artifactId>
                 <version>12.2.0</version>
                 <configuration>
-                    <nvdApiKey>${nvdApiKey}</nvdApiKey>
+                    <nvdApiKey>${env.nvdApiKey}</nvdApiKey>
                     <skipProvidedScope>true</skipProvidedScope>
                     <!-- analyzers not required in these projects -->
                     <artifactoryAnalyzerEnabled>false</artifactoryAnalyzerEnabled>
diff --git a/security-logging/pom.xml b/security-logging/pom.xml
@@ -52,6 +52,11 @@
             <artifactId>spring-boot-starter-test</artifactId>
             <scope>test</scope>
         </dependency>
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-webmvc-test</artifactId>
+            <scope>test</scope>
+        </dependency>
     </dependencies>
 
     <build>
diff --git a/security-logging/src/test/java/de/dominikschadow/javasecurity/logging/home/HomeControllerTest.java b/security-logging/src/test/java/de/dominikschadow/javasecurity/logging/home/HomeControllerTest.java
@@ -19,7 +19,7 @@
 
 import org.junit.jupiter.api.Test;
 import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.boot.test.autoconfigure.web.servlet.WebMvcTest;
+import org.springframework.boot.webmvc.test.autoconfigure.WebMvcTest;
 import org.springframework.test.web.servlet.MockMvc;
 
 import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get;
diff --git a/session-handling-spring-security/pom.xml b/session-handling-spring-security/pom.xml
@@ -37,6 +37,7 @@
         <dependency>
             <groupId>org.thymeleaf.extras</groupId>
             <artifactId>thymeleaf-extras-springsecurity6</artifactId>
+            <version>3.1.3.RELEASE</version>
         </dependency>
 
         <dependency>
@@ -62,6 +63,11 @@
             <artifactId>spring-boot-starter-test</artifactId>
             <scope>test</scope>
         </dependency>
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-webmvc-test</artifactId>
+            <scope>test</scope>
+        </dependency>
         <dependency>
             <groupId>org.springframework.security</groupId>
             <artifactId>spring-security-test</artifactId>
diff --git a/session-handling-spring-security/src/main/java/de/dominikschadow/javasecurity/sessionhandling/SecurityConfig.java b/session-handling-spring-security/src/main/java/de/dominikschadow/javasecurity/sessionhandling/SecurityConfig.java
@@ -27,7 +27,6 @@
 import org.springframework.security.config.annotation.web.configurers.HeadersConfigurer;
 import org.springframework.security.core.userdetails.User;
 import org.springframework.security.core.userdetails.UserDetails;
-import org.springframework.security.core.userdetails.jdbc.JdbcDaoImpl;
 import org.springframework.security.provisioning.JdbcUserDetailsManager;
 import org.springframework.security.provisioning.UserDetailsManager;
 import org.springframework.security.web.SecurityFilterChain;
@@ -46,7 +45,7 @@ public class SecurityConfig {
     public DataSource dataSource() {
         return new EmbeddedDatabaseBuilder()
                 .setType(EmbeddedDatabaseType.H2)
-                .addScript(JdbcDaoImpl.DEFAULT_USER_SCHEMA_DDL_LOCATION)
+                .addScript("schema.sql")
                 .build();
     }
 
diff --git a/session-handling-spring-security/src/main/resources/application.yml b/session-handling-spring-security/src/main/resources/application.yml
@@ -6,6 +6,9 @@ spring:
     password: sa
     name: session-handling
     generate-unique-name: false
+  sql:
+    init:
+      mode: never
   h2:
     console:
       enabled: true
diff --git a/session-handling-spring-security/src/test/java/de/dominikschadow/javasecurity/sessionhandling/greetings/GreetingControllerTest.java b/session-handling-spring-security/src/test/java/de/dominikschadow/javasecurity/sessionhandling/greetings/GreetingControllerTest.java
@@ -19,16 +19,17 @@
 
 import org.junit.jupiter.api.Test;
 import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.boot.test.autoconfigure.web.servlet.WebMvcTest;
-import org.springframework.security.test.context.support.WithMockUser;
+import org.springframework.boot.webmvc.test.autoconfigure.AutoConfigureMockMvc;
+import org.springframework.boot.webmvc.test.autoconfigure.WebMvcTest;
 import org.springframework.test.context.bean.override.mockito.MockitoBean;
 import org.springframework.test.web.servlet.MockMvc;
 
 import static org.mockito.Mockito.when;
 import static org.springframework.test.web.servlet.request.MockMvcRequestBuilders.get;
 import static org.springframework.test.web.servlet.result.MockMvcResultMatchers.*;
 
-@WebMvcTest(GreetingController.class)
+@WebMvcTest(controllers = GreetingController.class)
+@AutoConfigureMockMvc(addFilters = false)
 class GreetingControllerTest {
 
     @Autowired
@@ -38,7 +39,6 @@ class GreetingControllerTest {
     private GreetingService greetingService;
 
     @Test
-    @WithMockUser
     void index_shouldReturnIndexView() throws Exception {
         mockMvc.perform(get("/"))
                 .andExpect(status().isOk())
@@ -47,7 +47,6 @@ void index_shouldReturnIndexView() throws Exception {
     }
 
     @Test
-    @WithMockUser(roles = "USER")
     void greetUser_shouldReturnUserViewWithGreeting() throws Exception {
         when(greetingService.greetUser()).thenReturn("Hello User!");
 
@@ -59,7 +58,6 @@ void greetUser_shouldReturnUserViewWithGreeting() throws Exception {
     }
 
     @Test
-    @WithMockUser(roles = "ADMIN")
     void greetAdmin_shouldReturnAdminViewWithGreeting() throws Exception {
         when(greetingService.greetAdmin()).thenReturn("Hello Admin!");
 
@@ -69,22 +67,4 @@ void greetAdmin_shouldReturnAdminViewWithGreeting() throws Exception {
                 .andExpect(model().attributeExists("sessionId"))
                 .andExpect(model().attribute("greeting", "Hello Admin!"));
     }
-
-    @Test
-    void index_withoutAuthentication_shouldReturnUnauthorized() throws Exception {
-        mockMvc.perform(get("/"))
-                .andExpect(status().isUnauthorized());
-    }
-
-    @Test
-    void greetUser_withoutAuthentication_shouldReturnUnauthorized() throws Exception {
-        mockMvc.perform(get("/user/user"))
-                .andExpect(status().isUnauthorized());
-    }
-
-    @Test
-    void greetAdmin_withoutAuthentication_shouldReturnUnauthorized() throws Exception {
-        mockMvc.perform(get("/admin/admin"))
-                .andExpect(status().isUnauthorized());
-    }
 }
diff --git a/sql-injection/pom.xml b/sql-injection/pom.xml
@@ -64,6 +64,11 @@
             <artifactId>spring-boot-starter-test</artifactId>
             <scope>test</scope>
         </dependency>
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-webmvc-test</artifactId>
+            <scope>test</scope>
+        </dependency>
     </dependencies>
 
     <build>
diff --git a/sql-injection/src/test/java/de/dominikschadow/javasecurity/customers/CustomerControllerTest.java b/sql-injection/src/test/java/de/dominikschadow/javasecurity/customers/CustomerControllerTest.java
@@ -19,7 +19,7 @@
 
 import org.junit.jupiter.api.Test;
 import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.boot.test.autoconfigure.web.servlet.WebMvcTest;
+import org.springframework.boot.webmvc.test.autoconfigure.WebMvcTest;
 import org.springframework.test.context.bean.override.mockito.MockitoBean;
 import org.springframework.test.web.servlet.MockMvc;
 
