Cwikius-Spring/spring-security
1
0
Fork 0
mirror of https://github.com/spring-projects/spring-security.git synced 2025-05-31 01:02:14 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch '5.7.x' into 5.8.x

Browse Source
This commit is contained in:
Josh Cummings 2023-05-10 15:53:22 -06:00
commit b969179b5c
No known key found for this signature in database
GPG Key ID: A306A51F43B8E5A5
3 changed files with 12 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
docs/modules/ROOT/pages/reactive/oauth2/login/advanced.adoc
View File

@ -207,7 +207,7 @@ The Redirection Endpoint is used by the Authorization Server for returning the A
OAuth 2.0 Login leverages the Authorization Code Grant. OAuth 2.0 Login leverages the Authorization Code Grant.
Therefore, the authorization credential is the authorization code. Therefore, the authorization credential is the authorization code.
The default Authorization Response redirection endpoint is `/login/oauth2/code/{registrationId}`. The default Authorization Response redirection endpoint is `+/login/oauth2/code/{registrationId}+`.
If you would like to customize the Authorization Response redirection endpoint, configure it as shown in the following example: If you would like to customize the Authorization Response redirection endpoint, configure it as shown in the following example:
@ -739,5 +739,5 @@ class OAuth2LoginSecurityConfig {
---- ----
==== ====
NOTE: `OidcClientInitiatedServerLogoutSuccessHandler` supports the `{baseUrl}` placeholder. NOTE: `OidcClientInitiatedServerLogoutSuccessHandler` supports the `+{baseUrl}+` placeholder.
If used, the application's base URL, like `https://app.example.org`, will replace it at request time. If used, the application's base URL, like `https://app.example.org`, will replace it at request time.

15
docs/modules/ROOT/pages/servlet/authentication/persistence.adoc
View File

@ -188,9 +188,11 @@ The {security-api-url}org/springframework/security/web/context/SecurityContextPe
image::{figures}/securitycontextpersistencefilter.png[] image::{figures}/securitycontextpersistencefilter.png[]
<1> Before running the rest of the application, `SecurityContextPersistenceFilter` loads the `SecurityContext` from the `SecurityContextRepository` and sets it on the `SecurityContextHolder`. image:{icondir}/number_1.png[] Before running the rest of the application, `SecurityContextPersistenceFilter` loads the `SecurityContext` from the `SecurityContextRepository` and sets it on the `SecurityContextHolder`.
<2> Next, the application is ran.
<3> Finally, if the `SecurityContext` has changed, we save the `SecurityContext` using the `SecurityContextPersistenceRepository`. image:{icondir}/number_2.png[] Next, the application is ran.
image:{icondir}/number_3.png[] Finally, if the `SecurityContext` has changed, we save the `SecurityContext` using the `SecurityContextPersistenceRepository`.
This means that when using `SecurityContextPersistenceFilter`, just setting the `SecurityContextHolder` will ensure that the `SecurityContext` is persisted using `SecurityContextRepository`. This means that when using `SecurityContextPersistenceFilter`, just setting the `SecurityContextHolder` will ensure that the `SecurityContext` is persisted using `SecurityContextRepository`.
In some cases a response is committed and written to the client before the `SecurityContextPersisteneFilter` method completes. In some cases a response is committed and written to the client before the `SecurityContextPersisteneFilter` method completes.
@ -207,11 +209,12 @@ The {security-api-url}org/springframework/security/web/context/SecurityContextHo
image::{figures}/securitycontextholderfilter.png[] image::{figures}/securitycontextholderfilter.png[]
<1> Before running the rest of the application, `SecurityContextHolderFilter` loads the `SecurityContext` from the `SecurityContextRepository` and sets it on the `SecurityContextHolder`. image:{icondir}/number_1.png[] Before running the rest of the application, `SecurityContextHolderFilter` loads the `SecurityContext` from the `SecurityContextRepository` and sets it on the `SecurityContextHolder`.
<2> Next, the application is ran.
image:{icondir}/number_2.png[] Next, the application is ran.
Unlike, xref:servlet/authentication/persistence.adoc#securitycontextpersistencefilter[`SecurityContextPersistenceFilter`], `SecurityContextHolderFilter` only loads the `SecurityContext` it does not save the `SecurityContext`. Unlike, xref:servlet/authentication/persistence.adoc#securitycontextpersistencefilter[`SecurityContextPersistenceFilter`], `SecurityContextHolderFilter` only loads the `SecurityContext` it does not save the `SecurityContext`.
This means that when using `SecurityContextHolderFilter`, it is required that the `SecurityContext` is explicitly saved. This means that when using `SecurityContextHolderFilter`, it is required that the `SecurityContext` is explicitly saved.
include::partial$servlet/architecture/security-context-explicit.adoc[] include::partial$servlet/architecture/security-context-explicit.adoc[]

2
docs/modules/ROOT/pages/servlet/oauth2/login/advanced.adoc
View File

@ -958,5 +958,5 @@ class OAuth2LoginSecurityConfig {
---- ----
==== ====
NOTE: `OidcClientInitiatedLogoutSuccessHandler` supports the `{baseUrl}` placeholder. NOTE: `OidcClientInitiatedLogoutSuccessHandler` supports the `+{baseUrl}+` placeholder.
If used, the application's base URL, like `https://app.example.org`, will replace it at request time. If used, the application's base URL, like `https://app.example.org`, will replace it at request time.