Commit Graph

1367 Commits

Author SHA1 Message Date
Rob Winch 1ef738ba34 WebSessionReactiveSecurityRepository Supports Cache 2022-05-03 16:15:22 -05:00
Rob Winch 9a9a43a0c0 ForceEagerSessionCreationFilter
Closes gh-11109
2022-04-15 14:18:25 -05:00
Rob Winch aaf78330b1 ForceEagerSessionCreationFilter
Closes gh-11109
2022-04-15 14:16:35 -05:00
Marcus Da Coregio 5367524030 Change the default of shouldFilterAllDispatchTypes to true
Closes gh-11107
2022-04-14 16:30:42 -03:00
Marcus Da Coregio 84b5c76a7b Add Option to Filter All Dispatcher Types
Closes gh-11092
2022-04-14 16:10:36 -03:00
Marcus Da Coregio 7fea639a43 Add Option to Filter All Dispatcher Types
Closes gh-11092
2022-04-14 15:58:00 -03:00
Rob Winch 3a9b080bbe Deprecate loadContext(RequestResponseHolder)
Fix gh-11032
2022-04-12 16:36:08 -05:00
Rob Winch 0c2b9758fc Deprecate loadContext(RequestResponseHolder)
Fix gh-11032
2022-04-12 16:35:38 -05:00
Marcus Da Coregio 50f8df6f07 Use HttpStatusCode
Closes gh-11091
2022-04-11 09:19:56 -03:00
Marcus Da Coregio bc50146f60 Fix tests in AntPathRequestMatcherTests
Closes gh-11090
2022-04-11 09:19:56 -03:00
Rob Winch 39b0620a84 Add DisableUrlRewritingFilter
Closes gh-11084
2022-04-08 16:13:44 -05:00
Rob Winch 7be32872e9 Add DisableUrlRewritingFilter
Closes gh-11084
2022-04-08 16:13:24 -05:00
Eleftheria Stein c4e88415a5 Remove MessageSourceAware from ExceptionTranslationWebFilter
Closes gh-11057
2022-04-05 16:13:41 +02:00
Eleftheria Stein ae8e77f9ff Remove blocking call from ExceptionTranslationWebFilter
This also means that the exception message is no longer retrieved from a MessageSource. This is consistent with the other WebFilters.

Closes gh-10864
2022-04-05 14:05:56 +02:00
Eleftheria Stein 725a57fccc Remove blocking call from ExceptionTranslationWebFilter
This also means that the exception message is no longer retrieved from a MessageSource. This is consistent with the other WebFilters.

Closes gh-10864
2022-04-05 13:12:17 +02:00
Josh Cummings 1edfa07d27
Use RequestMatcherEntry
Closes gh-11046
2022-03-30 14:40:06 -06:00
Josh Cummings c175118f62
Use RequestMatcherEntry
Closes gh-11046
2022-03-30 14:31:11 -06:00
Josh Cummings bdd5f86526
Polish Authorization Event Support
- Added spring-security-config support
- Renamed classes
- Changed contracts to include the authenticated user and secured
object
- Added method security support

Issue gh-9288
2022-03-29 16:37:21 -06:00
Parikshit Dutta 990831db85
Add authorization events
Closes gh-9288
2022-03-29 16:22:43 -06:00
Josh Cummings 061f69eb70
Polish Authorization Event Support
- Added spring-security-config support
- Renamed classes
- Changed contracts to include the authenticated user and secured
object
- Added method security support

Issue gh-9288
2022-03-29 16:03:19 -06:00
Parikshit Dutta bd9434882f
Add authorization events
Closes gh-9288
2022-03-29 15:44:21 -06:00
Marcus Da Coregio 8c34af711e Use ServletContext in AuthorizationManagerWebInvocationPrivilegeEvaluator
Closes gh-10908
2022-03-28 10:01:51 -03:00
Marcus Da Coregio 6c52c52a68 Use ServletContext in AuthorizationManagerWebInvocationPrivilegeEvaluator
Closes gh-10908
2022-03-28 09:45:23 -03:00
Rob Winch e176d764ba Add SecurityContextRepository.loadContext(HttpServletRequest)
This allows loading the SecurityContext lazily, without the need for the
response, and does not attempt to automatically save the request when
the response is comitted.

Closes gh-11028
2022-03-25 14:38:37 -05:00
Rob Winch 67fd46bfa6 Add SecurityContextRepository.loadContext(HttpServletRequest)
This allows loading the SecurityContext lazily, without the need for the
response, and does not attempt to automatically save the request when
the response is comitted.

Closes gh-11028
2022-03-25 14:21:52 -05:00
Rob Winch 1e3106f3a2 HttpSessionSecurityContextRepository support null HttpServletResponse
Closes gh-11029
2022-03-25 13:03:33 -05:00
Rob Winch 8940719dbb HttpSessionSecurityContextRepository support null HttpServletResponse
Closes gh-11029
2022-03-25 13:01:40 -05:00
Steve Riesenberg 8aa7029d07 Fix checkstyle errors
Issue gh-10989
2022-03-18 22:53:29 -05:00
Steve Riesenberg 987ee2e67a
Polish gh-10911 2022-03-17 12:53:56 -05:00
David Kirstein 1b29c43a11
Use configurable charset in ServerHttpBasicAuthenticationConverter
Closes gh-10903
2022-03-17 12:53:55 -05:00
Steve Riesenberg 946e24e1c2
Polish gh-10911 2022-03-17 12:34:16 -05:00
David Kirstein 2b6bc5dd0b
Use configurable charset in ServerHttpBasicAuthenticationConverter
Closes gh-10903
2022-03-17 12:34:16 -05:00
ShinDongHun1 90fe1b3a69 Polish UsernamePasswordAuthenticationFilter method
Closes gh-10970
2022-03-16 16:41:03 +01:00
ShinDongHun1 7955e5ac52 Polish UsernamePasswordAuthenticationFilter method
Closes gh-10970
2022-03-16 16:29:40 +01:00
Rob Winch 972039e65c Add SecurityContextHolderFilter
Closes gh-9635
2022-03-12 13:31:04 -06:00
Rob Winch cbba7ea4de AbstractAuthenticationProcessingFilter.securityContextRepository
Issue gh-10953
2022-03-12 13:23:47 -06:00
Rob Winch 87ed31a99c Add SecurityContextHolderFilter
Closes gh-9635
2022-03-11 17:22:23 -06:00
Norbert Nowak abd33389be Add UsernamePasswordAuthenticationToken factory methods
- unauthenticated factory method
 - authenticated factory method
 - test for unauthenticated factory method
 - test for authenticated factory method
 - make existing constructor protected
 - use newly factory methods in rest of the project
 - update copyright dates

Closes gh-10790
2022-03-09 15:49:29 -07:00
Norbert Nowak ac9c29b2a0 Add UsernamePasswordAuthenticationToken factory methods
- unauthenticated factory method
 - authenticated factory method
 - test for unauthenticated factory method
 - test for authenticated factory method
 - make existing constructor protected
 - use newly factory methods in rest of the project
 - update copyright dates

Closes gh-10790
2022-03-09 15:23:35 -07:00
Rob Winch 4462b73fd9 AbstractPreAuthenticatedProcessingFilter.securityContextRepository
Issue gh-10953
2022-03-09 15:47:34 -06:00
Rob Winch ba7fb0cb14 DigestAuthenticationFilter.securityContextRepository
Issue gh-10953
2022-03-09 15:47:34 -06:00
Rob Winch 09e730734b BasicAuthenticationFilter.setSecurityContextRepository
Issue gh-10953
2022-03-09 15:47:34 -06:00
Rob Winch d909d3bc40 RememberMeAuthenticationFilter.securityContextRepository
Issue gh-10953
2022-03-09 15:47:34 -06:00
Rob Winch 7c5b939bbd AuthenticationFilter.securityContextRepository
Issue gh-10953
2022-03-09 15:47:34 -06:00
Rob Winch 636f3e1d5d AbstractPreAuthenticatedProcessingFilter.securityContextRepository
Issue gh-10953
2022-03-09 15:33:42 -06:00
Rob Winch e6b6104b52 DigestAuthenticationFilter.securityContextRepository
Issue gh-10953
2022-03-09 15:33:42 -06:00
Rob Winch 9b0cd5a0a8 BasicAuthenticationFilter.setSecurityContextRepository
Issue gh-10953
2022-03-09 15:33:42 -06:00
Rob Winch 120f2a356f RememberMeAuthenticationFilter.securityContextRepository
Issue gh-10953
2022-03-09 15:33:42 -06:00
Rob Winch 014c471ff1 AuthenticationFilter.securityContextRepository
Issue gh-10953
2022-03-09 15:33:42 -06:00
Rob Winch f11cb988a9 AbstractAuthenticationProcessingFilter.securityContextRepository
Issue gh-10953
2022-03-09 15:33:42 -06:00
Marcus Da Coregio 980e0466a7 AuthorizationManagerWebInvocationPrivilegeEvaluator grant access when AuthorizationManager abstains
Closes gh-10950
2022-03-09 15:21:37 -03:00
Marcus Da Coregio 8c94c2e15a AuthorizationManagerWebInvocationPrivilegeEvaluator grant access when AuthorizationManager abstains
Closes gh-10950
2022-03-09 15:21:14 -03:00
Rob Winch 2abeff2089 HttpSessionSecurityContextRepository saves with original response
Previously, the HttpSessionSecurityContextRepository unnecessarily required
the HttpServletResponse from the HttpReqeustResponseHolder passed into
loadContext. This meant code that wanted to save a SecurityContext had to
have a reference to the original HttpRequestResponseHolder. Often that
implied that the code that saves the SecurityContext must also load the
SecurityContext.

This change allows any request / response to be used to save the
SecurityContext which means any code can save the SecurityContext not just
the code that loaded it. This sets up the code to be permit requiring
explicit saves. Using the request/response from the
HttpRequestResponseHolder is only necessary for implicit saves.

Closes gh-10947
2022-03-09 10:21:51 -06:00
Rob Winch 65ec2659c4 HttpSessionSecurityContextRepository saves with original response
Previously, the HttpSessionSecurityContextRepository unnecessarily required
the HttpServletResponse from the HttpReqeustResponseHolder passed into
loadContext. This meant code that wanted to save a SecurityContext had to
have a reference to the original HttpRequestResponseHolder. Often that
implied that the code that saves the SecurityContext must also load the
SecurityContext.

This change allows any request / response to be used to save the
SecurityContext which means any code can save the SecurityContext not just
the code that loaded it. This sets up the code to be permit requiring
explicit saves. Using the request/response from the
HttpRequestResponseHolder is only necessary for implicit saves.

Closes gh-10947
2022-03-09 10:17:15 -06:00
Rob Winch bab5d252a2 Add RequestAttributeSecurityContextRepository
Closes gh-10918
2022-03-08 15:00:22 -06:00
Rob Winch b9f79543c5 Add RequestAttributeSecurityContextRepository
Closes gh-10918
2022-03-07 14:52:24 -06:00
Josh Cummings 20d21f8eeb Invert Log Messages
Closes gh-10909
2022-02-28 13:16:06 -07:00
Josh Cummings efd5fc745c Invert Log Messages
Closes gh-10909
2022-02-28 13:10:06 -07:00
Josh Cummings 371389580b Update JavaDoc
Issue gh-10564
2022-02-15 12:57:32 -07:00
Yuriy Savchenko 0fb6840db3 Make WebAuthenticationDetails constructor public
Closes gh-10564
2022-02-15 12:57:32 -07:00
Josh Cummings a99a04f050 Update JavaDoc
Issue gh-10564
2022-02-15 12:51:09 -07:00
Yuriy Savchenko d6cbacb27a Make WebAuthenticationDetails constructor public
Closes gh-10564
2022-02-15 12:50:48 -07:00
Josh Cummings 84616543a3 Polish ignoring() log messaging
- Public API remains unchanged

Issue gh-9334
2022-02-07 14:58:20 -07:00
Manuel Jordan 6ae651bd67 Print ignore message DefaultSecurityFilterChain
When either `web.ignoring().mvcMatchers(...)` or
`web.ignoring().antMatchers(...)` methods are used, for all their
variations, the DefaultSecurityFilterChain class now indicates
correctly through its ouput what paths are ignored according the
`ignoring()` settings.

Closes gh-9334
2022-02-07 14:58:20 -07:00
Josh Cummings cbd87fac89 Polish ignoring() log messaging
- Public API remains unchanged

Issue gh-9334
2022-02-07 14:50:28 -07:00
Manuel Jordan 01ed617d5f Print ignore message DefaultSecurityFilterChain
When either `web.ignoring().mvcMatchers(...)` or
`web.ignoring().antMatchers(...)` methods are used, for all their
variations, the DefaultSecurityFilterChain class now indicates
correctly through its ouput what paths are ignored according the
`ignoring()` settings.

Closes gh-9334
2022-02-07 14:50:19 -07:00
Rob Winch 70fa8b1fdb Add Support for @Transient SecurityContext
Closes gh-9995
2022-02-03 09:45:51 -06:00
Rob Winch 6f0029fc44 Add Support for @Transient SecurityContext
Closes gh-9995
2022-02-02 17:04:44 -06:00
Marcus Da Coregio 0048805c2a RequestMatcherDelegatingWebInvocationPrivilegeEvaluator doesn't provided access to the ServletContext
Closes gh-10779
2022-01-31 10:17:40 -03:00
Marcus Da Coregio 1c10c10f73 RequestMatcherDelegatingWebInvocationPrivilegeEvaluator doesn't provided access to the ServletContext
Closes gh-10779
2022-01-31 09:43:18 -03:00
Josh Cummings 08821369a3 Add Request-based AuthenticationManagerResolvers
Closes gh-6762
2022-01-26 09:21:07 -07:00
Josh Cummings 9baf1134c7 Add Request-based AuthenticationManagerResolvers
Closes gh-6762
2022-01-26 09:09:02 -07:00
Rob Winch f94090a59b Remove spring-security-openid
Closes gh-10773
2022-01-21 16:55:19 -06:00
Rob Winch 0e8c03401b javax.xml.bind:jaxb-api -> jakarta.xml.bind:jakarta.xml.bind-api
Issue gh-10501
2022-01-19 14:34:16 -06:00
Rob Winch 8f64bb6c8c javax.servlet:javax.servlet-api -> jakarta.servlet:jakarta.servlet-api
Issue gh-10501
2022-01-19 14:33:53 -06:00
Juan Carlos 2624150052 Add serialVersionUID to DefaultSavedRequest and SavedCookie
Closes gh-10594
2022-01-18 09:36:54 -03:00
Juan Carlos 7435da6bbf Add serialVersionUID to DefaultSavedRequest and SavedCookie
Closes gh-10594
2022-01-18 09:26:56 -03:00
Josh Cummings feff747669 Polish multiple RequestRejectedHandlers support
Issue gh-10603
2022-01-14 17:21:04 -07:00
Adam Ostrožlík 27cfb9c89d Support multiple RequestRejectedHandler beans
Closes gh-10603
2022-01-14 17:21:00 -07:00
Josh Cummings 75f25bff82 Polish multiple RequestRejectedHandlers support
Issue gh-10603
2022-01-14 16:49:38 -07:00
Adam Ostrožlík 4ea57f3e3f Support multiple RequestRejectedHandler beans
Closes gh-10603
2022-01-14 16:46:15 -07:00
Josh Cummings aaaf7d3523 Use noNullElements
Collection#contains(null) does not work for all collection types

Closes gh-10703
2022-01-14 15:08:38 -07:00
Josh Cummings b2fe9149cf Use noNullElements
Collection#contains(null) does not work for all collection types

Issue gh-10703
2022-01-14 14:33:17 -07:00
heowc 6c5fd38a3f Fix typo 2022-01-10 16:24:53 +01:00
heowc 1ab0705b47 Fix typo 2022-01-10 16:17:42 +01:00
Marcus Da Coregio 750dcafbd2 Fix @since tag
Issue gh-10590, gh-10554
2022-01-06 13:21:26 -03:00
Marcus Da Coregio f04cd641b0 Fix @since tag
Issue gh-10590, gh-10554
2022-01-06 13:18:25 -03:00
Marcus Da Coregio d884d9a461 Configure WebInvocationPrivilegeEvaluator bean for multiple filter chains
Closes gh-10554
2021-12-13 09:19:41 -03:00
Marcus Da Coregio 51b4bd67c9 Add RequestMatcherEntry 2021-12-13 09:19:28 -03:00
Marcus Da Coregio eda346863d Introduce AuthorizationManagerWebInvocationPrivilegeEvaluator
Closes gh-10590
2021-12-13 09:19:13 -03:00
Marcus Da Coregio 18427b6411 Configure WebInvocationPrivilegeEvaluator bean for multiple filter chains
Closes gh-10554
2021-12-13 08:57:30 -03:00
Marcus Da Coregio 7e17a00197 Add RequestMatcherEntry 2021-12-13 08:57:30 -03:00
Marcus Da Coregio 53b8cff26f Introduce AuthorizationManagerWebInvocationPrivilegeEvaluator
Closes gh-10590
2021-12-13 08:57:30 -03:00
Eleftheria Stein c68a75bcde Correct imports to jakarta
Issue gh-9385, gh-10118
2021-12-08 11:43:13 +01:00
Marcus Da Coregio 0beb725259 Add Cross Origin Policies headers
Add DSL support for Cross-Origin-Opener-Policy, Cross-Origin-Embedder-Policy and Cross-Origin-Resource-Policy headers

Closes gh-9385, gh-10118
2021-12-08 11:07:09 +01:00
Marcus Da Coregio 65426a40ec Add Cross Origin Policies headers
Add DSL support for Cross-Origin-Opener-Policy, Cross-Origin-Embedder-Policy and Cross-Origin-Resource-Policy headers

Closes gh-9385, gh-10118
2021-12-07 17:23:06 +01:00
Steve Riesenberg 62e8799a8d Use BDD in tests 2021-12-02 17:44:47 -06:00
Steve Riesenberg df0f6f83af Polish gh-9597 2021-12-02 17:44:47 -06:00
Karl Tinawi 925d531cbe Set details on authentication token created by HttpServlet3RequestFactory
Currently the login mechanism when triggered by executing HttpServlet3RequestFactory#login does not set any details on the underlying authentication token that is authenticated.

This change adds an AuthenticationDetailsSource on the HttpServlet3RequestFactory, which defaults to a WebAuthenticationDetailsSource.

Closes gh-9579
2021-12-02 17:44:46 -06:00
Steve Riesenberg aa3c883f87 Use BDD in tests 2021-12-02 17:40:25 -06:00
Steve Riesenberg d37ff18b69 Polish gh-9597 2021-12-02 17:24:17 -06:00
Karl Tinawi c57fc309c2 Set details on authentication token created by HttpServlet3RequestFactory
Currently the login mechanism when triggered by executing HttpServlet3RequestFactory#login does not set any details on the underlying authentication token that is authenticated.

This change adds an AuthenticationDetailsSource on the HttpServlet3RequestFactory, which defaults to a WebAuthenticationDetailsSource.

Closes gh-9579
2021-12-02 17:24:17 -06:00
Steve Riesenberg bb2d80fea3 Update copyright year
Issue gh-10557
2021-12-01 17:35:43 -06:00
Steve Riesenberg 5dd2565348 Update copyright year
Issue gh-10557
2021-12-01 17:34:16 -06:00
Steve Riesenberg f49c286050 Fix case sensitive headers comparison
Closes gh-10557
2021-12-01 15:05:13 -06:00
Steve Riesenberg 41c6776455 Fix case sensitive headers comparison
Closes gh-10557
2021-12-01 14:55:50 -06:00
Josh Cummings 1251cde04c Add Missing Since
Issue gh-10482
2021-11-30 15:17:48 -07:00
Igor Pelesic a3a9de1b9b PermitAllSupport supports AuthorizeHttpRequestsConfigurer
PermitAllSupport supports either an ExpressionUrlAuthorizationConfigurer or an AuthorizeHttpRequestsConfigurer. If none or both are configured an error message is thrown.

Closes gh-10482
2021-11-30 15:17:22 -07:00
Josh Cummings 7e55c84cfc Add Missing Since
Issue gh-10482
2021-11-30 15:15:35 -07:00
Igor Pelesic 72109e2921 PermitAllSupport supports AuthorizeHttpRequestsConfigurer
PermitAllSupport supports either an ExpressionUrlAuthorizationConfigurer or an AuthorizeHttpRequestsConfigurer. If none or both are configured an error message is thrown.

Closes gh-10482
2021-11-30 15:00:04 -07:00
Steve Riesenberg 204f0b4599 Polish gh-10007 2021-11-30 15:27:58 -06:00
Guirong Hu 43317c5a61 Support IP whitelist for Spring Security Webflux
Closes gh-7765
2021-11-30 15:27:58 -06:00
Steve Riesenberg 898ba67098 Polish gh-10007 2021-11-30 13:59:55 -06:00
Guirong Hu 9f51240bf1 Support IP whitelist for Spring Security Webflux
Closes gh-7765
2021-11-30 13:59:55 -06:00
Steve Riesenberg 9a9136d96d Fix import spacing 2021-11-30 13:56:46 -06:00
Steve Riesenberg c6a27d44e5 Remove failing test due to HttpMethod changes
Closes gh-10569
2021-11-30 13:31:39 -06:00
Marcus Da Coregio 25feedb870 Fix removal of framework deprecated code
Issue https://github.com/spring-projects/spring-framework/issues/27686
2021-11-19 13:06:13 -03:00
Rob Winch bd34d70f97 Prevent Save @Transient Authentication with existing HttpSession
Previously, @Transient Authentication would get saved if an existing
HttpSession existed but it shouldn't.

This commit always prevents @Transient Authentication from being saved.

Closes gh-9992
2021-11-16 14:45:34 -06:00
Rob Winch 96a6fef820 Prevent Save @Transient Authentication with existing HttpSession
Previously, @Transient Authentication would get saved if an existing
HttpSession existed but it shouldn't.

This commit always prevents @Transient Authentication from being saved.

Closes gh-9992
2021-11-16 14:44:49 -06:00
Marcus Da Coregio db60df2f9c Update to Spring Framework 6.0
Issue gh-10360
2021-11-01 09:02:42 -03:00
Marcus Da Coregio caad3d57e2 Improve log message when no CSRF token found
Closes gh-10436
2021-10-29 14:06:17 -03:00
Emil Sierżęga 04b47c5928 Fixed various broken links in Javadocs 2021-10-21 11:47:04 +02:00
Emil Sierżęga a188138715 Javadocs author tag doesn't work in methods 2021-10-21 11:47:04 +02:00
Rob Winch f836897190 Checkstyle Fixes
- Javadoc tag ordering
- Private constructors before inner classes

Issue gh-10394
2021-10-18 21:03:35 -05:00
Rob Winch e1f4ec1137 Fix Jackson 2021-10-18 21:03:12 -05:00
Marcus Da Coregio faec20bc69 Update DefaultWebInvocationPrivilegeEvaluator to use current ServletContext
Closes gh-10208
2021-10-14 09:27:02 -03:00
Josh Cummings 7b98c2ea95 Restructure SwitchUserFilter Logs
Issue gh-6311
2021-10-12 13:32:29 -06:00
Marcus Da Coregio 02b2fcc6f0 Restore ManagementConfigurationPlugin
Issue gh-9615
2021-10-05 11:23:29 -03:00
Marcus Da Coregio d2e5f2ae0d Update Gradle to 7.2
Closes gh-9615
2021-10-04 15:19:40 -03:00
Eleftheria Stein 7d81a52780 Allow AuthenticationPrincipal argument type to be primitive
Closes gh-10172
2021-10-04 16:22:21 +02:00
heowc 84d173c310 Fix typo 2021-09-27 10:55:18 -03:00
Bogdan Ilchyshyn a4c088a3b3 Introducing WebSessionServerLogoutHandler
Closes gh-4838
2021-08-16 13:08:35 -06:00
Hiroshi Shirosaki 6f3e346b76 Add SecurityContextHolder#addListener
Closes gh-10032
2021-08-11 17:12:13 -06:00
Josh Cummings b8d51725c7 Immutable SecurityContext
Issue gh-10032
2021-08-11 17:12:13 -06:00
Rob Winch f73f213f50 Remove DependencySetPlugin
Closes gh-10070
2021-07-12 15:31:38 -05:00
Rob Winch f800d2c993 Add hamcrest dependency 2021-07-09 15:57:21 -05:00
Rob Winch b6ff4d3674 Fix mockito UnnecessaryStubbingException 2021-07-09 14:35:10 -05:00
Rob Winch 3e93b024d6 openrewrite Junit Migration 2021-07-09 14:32:52 -05:00
Rob Winch 14240b2559 Remove Powermock
Powermock does not support JUnit5 yet, so we need to remove it
to support JUnit 5. Additionally, maintaining additional libraries
adds extra work for the team.

Mockito now supports final classes and static method mocking. This
commit replaces Powermock with mockito-inline.

Closes gh-6025
2021-07-08 12:35:32 -05:00
Evgeniy Cheban d121ab9565 Support A Well-Known URL for Changing Passwords
Closes gh-8657
2021-07-01 16:57:53 -06:00
Alexey Markevich 3219fd554d DigestAuthenticationFilter decodes nonce only once
Closes gh-8455
2021-06-18 15:25:00 -04:00
Steve Riesenberg 3bb8e1d200 Remove redundant translations in spring-security-web 2021-06-15 09:18:13 -05:00
Ruben Suarez Alvarez 7cd344acab
Add spanish translation of insufficient authentication and cookie stolen 2021-06-15 09:11:53 -05:00
Josh Cummings ca76c54471
Polish CsrfWebFilterTests
Issue gh-9113
2021-06-04 16:41:08 -06:00
Tomoki Tsubaki 0c8b6df82a
Cache Mono that generate the CSRF token
Closes gh-9113
2021-06-04 16:41:08 -06:00
AlexeyAnufriev baac9e0cf2 Properly clean cookies with context path after logout
Closes gh-8846
2021-06-04 15:42:33 +02:00
Marcus Hert da Coregio 2a7998d0fc Adjust createNewSessionIfAllowed to prevent NPE
Ensure that isTransientAuthentication reuses the same authentication object from saveContext

Closes gh-8947
2021-05-26 10:36:44 -06:00
César Revert cf74ad3a52 Anonymous in ExceptionTranslationWebFilter
The ExceptionTranslationWebFilter does not support correctly when
anonymous authentication is enabled. With this enabled provoked always
the execution of the access denied handler, and with this fix it
behaves like the ExceptionTranslationFilter (servlet), executing the
access denied handler only if the principal is not empty and neither
anonymous.

Closes gh-9130
2021-05-26 09:17:41 -05:00
Craig Andrews a7fbae8355 Add test for RequestedUrlRedirectInvalidSessionStrategy 2021-05-26 09:11:38 -05:00
Craig Andrews 0e6d47b082 Add guard around debug logging involving string concatenation 2021-05-26 09:11:38 -05:00