Cwikius-Spring/spring-security
1
0
Fork 0
mirror of https://github.com/spring-projects/spring-security.git synced 2025-10-30 22:28:46 +00:00
Code Issues Packages Projects Releases Wiki Activity

Remove Redundant ConcurrentSessionFilter Refs

Browse Source 
Fixes gh-8105
This commit is contained in:
Josh Cummings 2020-03-13 16:20:59 -06:00
parent 7411f25474
commit bfd36d9a54
No known key found for this signature in database
GPG Key ID: 49EF60DD7FF83443
3 changed files with 5 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
config/src/main/java/org/springframework/security/config/annotation/web/HttpSecurityBuilder.java
View File

@ -1,5 +1,5 @@
/* /*
* Copyright 2002-2013 the original author or authors. * Copyright 2002-2020 the original author or authors.
* *
* Licensed under the Apache License, Version 2.0 (the "License"); * Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License. * you may not use this file except in compliance with the License.
@ -136,14 +136,12 @@ public interface HttpSecurityBuilder<H extends HttpSecurityBuilder<H>> extends
* *
* <ul> * <ul>
* <li>{@link ChannelProcessingFilter}</li> * <li>{@link ChannelProcessingFilter}</li>
* <li>{@link ConcurrentSessionFilter}</li>
* <li>{@link SecurityContextPersistenceFilter}</li> * <li>{@link SecurityContextPersistenceFilter}</li>
* <li>{@link LogoutFilter}</li> * <li>{@link LogoutFilter}</li>
* <li>{@link X509AuthenticationFilter}</li> * <li>{@link X509AuthenticationFilter}</li>
* <li>{@link AbstractPreAuthenticatedProcessingFilter}</li> * <li>{@link AbstractPreAuthenticatedProcessingFilter}</li>
* <li><a href="{@docRoot}/org/springframework/security/cas/web/CasAuthenticationFilter.html">CasAuthenticationFilter</a></li> * <li><a href="{@docRoot}/org/springframework/security/cas/web/CasAuthenticationFilter.html">CasAuthenticationFilter</a></li>
* <li>{@link UsernamePasswordAuthenticationFilter}</li> * <li>{@link UsernamePasswordAuthenticationFilter}</li>
* <li>{@link ConcurrentSessionFilter}</li>
* <li>{@link OpenIDAuthenticationFilter}</li> * <li>{@link OpenIDAuthenticationFilter}</li>
* <li>{@link org.springframework.security.web.authentication.ui.DefaultLoginPageGeneratingFilter}</li> * <li>{@link org.springframework.security.web.authentication.ui.DefaultLoginPageGeneratingFilter}</li>
* <li>{@link org.springframework.security.web.authentication.ui.DefaultLogoutPageGeneratingFilter}</li> * <li>{@link org.springframework.security.web.authentication.ui.DefaultLogoutPageGeneratingFilter}</li>

6
config/src/main/java/org/springframework/security/config/annotation/web/builders/FilterComparator.java
View File

@ -1,5 +1,5 @@
/* /*
* Copyright 2002-2013 the original author or authors. * Copyright 2002-2020 the original author or authors.
* *
* Licensed under the Apache License, Version 2.0 (the "License"); * Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License. * you may not use this file except in compliance with the License.
@ -63,7 +63,7 @@ final class FilterComparator implements Comparator<Filter>, Serializable {
FilterComparator() { FilterComparator() {
Step order = new Step(INITIAL_ORDER, ORDER_STEP); Step order = new Step(INITIAL_ORDER, ORDER_STEP);
put(ChannelProcessingFilter.class, order.next()); put(ChannelProcessingFilter.class, order.next());
put(ConcurrentSessionFilter.class, order.next()); order.next(); // gh-8105
put(WebAsyncManagerIntegrationFilter.class, order.next()); put(WebAsyncManagerIntegrationFilter.class, order.next());
put(SecurityContextPersistenceFilter.class, order.next()); put(SecurityContextPersistenceFilter.class, order.next());
put(HeaderWriterFilter.class, order.next()); put(HeaderWriterFilter.class, order.next());
@ -87,7 +87,7 @@ final class FilterComparator implements Comparator<Filter>, Serializable {
"org.springframework.security.saml2.provider.service.servlet.filter.Saml2WebSsoAuthenticationFilter", "org.springframework.security.saml2.provider.service.servlet.filter.Saml2WebSsoAuthenticationFilter",
order.next()); order.next());
put(UsernamePasswordAuthenticationFilter.class, order.next()); put(UsernamePasswordAuthenticationFilter.class, order.next());
put(ConcurrentSessionFilter.class, order.next()); order.next(); // gh-8105
filterToOrder.put( filterToOrder.put(
"org.springframework.security.openid.OpenIDAuthenticationFilter", order.next()); "org.springframework.security.openid.OpenIDAuthenticationFilter", order.next());
put(DefaultLoginPageGeneratingFilter.class, order.next()); put(DefaultLoginPageGeneratingFilter.class, order.next());

3
docs/manual/src/docs/asciidoc/_includes/servlet/architecture/security-filters.adoc
View File

@ -9,7 +9,6 @@ However, there are times that it is beneficial to know the ordering
Below is a comprehensive list of Spring Security Filter ordering: Below is a comprehensive list of Spring Security Filter ordering:
* ChannelProcessingFilter * ChannelProcessingFilter
* ConcurrentSessionFilter
* WebAsyncManagerIntegrationFilter * WebAsyncManagerIntegrationFilter
* SecurityContextPersistenceFilter * SecurityContextPersistenceFilter
* HeaderWriterFilter * HeaderWriterFilter
@ -24,10 +23,10 @@ Below is a comprehensive list of Spring Security Filter ordering:
* OAuth2LoginAuthenticationFilter * OAuth2LoginAuthenticationFilter
* Saml2WebSsoAuthenticationFilter * Saml2WebSsoAuthenticationFilter
* <<servlet-authentication-usernamepasswordauthenticationfilter,`UsernamePasswordAuthenticationFilter`>> * <<servlet-authentication-usernamepasswordauthenticationfilter,`UsernamePasswordAuthenticationFilter`>>
* ConcurrentSessionFilter
* OpenIDAuthenticationFilter * OpenIDAuthenticationFilter
* DefaultLoginPageGeneratingFilter * DefaultLoginPageGeneratingFilter
* DefaultLogoutPageGeneratingFilter * DefaultLogoutPageGeneratingFilter
* ConcurrentSessionFilter
* <<servlet-authentication-digest,`DigestAuthenticationFilter`>> * <<servlet-authentication-digest,`DigestAuthenticationFilter`>>
* BearerTokenAuthenticationFilter * BearerTokenAuthenticationFilter
* <<servlet-authentication-basic,`BasicAuthenticationFilter`>> * <<servlet-authentication-basic,`BasicAuthenticationFilter`>>