Snippet

Injecting Mock JWT Claims into WebMvc Slice Tests Using SecurityMockMvcRequestPostProcessors

In Spring Security with OAuth2 resource servers, controller methods often rely on claims embedded in a `JwtAuthenticationToken`. The `SecurityMockMvcRequestPostProcessors.jwt()` utility simulates authenticated HTTP requests in lightweight `@WebMvcTest` slice tests without needing a running authorization server or real cryptographic token generation.

snippet.java

java

@WebMvcTest(AuditReportController.class)
class AuditReportControllerTest {
 
    @Autowired
    private MockMvc mockMvc;
 
    @Test
    void shouldAllowAccessWhenAuditorRolePresentInJwt() throws Exception {
        mockMvc.perform(get("/api/v1/audit/financials")
                .with(jwt().jwt(builder -> builder
                        .subject("auditor-101")
                        .claim("roles", List.of("ROLE_AUDITOR"))
                        .claim("department", "Finance"))))
                .andExpect(status().isOk())
                .andExpect(header().string("Content-Type", "application/json"));
    }
}

spring

Breakdown

@WebMvcTest(AuditReportController.class)

Bootstraps a focused MVC test slice containing only web layer beans, including Spring Security filters.

.with(jwt().jwt(builder -> builder

Injects a customized Mock SecurityContext populated with a mock JWT into the request execution.

.claim("roles", List.of("ROLE_AUDITOR"))

Configures specific JWT claim attributes to satisfy @PreAuthorize role-checking expressions on the controller.

.andExpect(status().isOk())

Asserts that authorization passed successfully and the endpoint returned HTTP status 200.

Previous snippet Next snippet

More Intermediate Java exercises →

Injecting Mock JWT Claims into WebMvc Slice Tests Using SecurityMockMvcRequestPostProcessors

Related