f94090a59b
Remove spring-security-openid
...
Closes gh-10773
2022-01-21 16:55:19 -06:00
2624150052
Add serialVersionUID to DefaultSavedRequest and SavedCookie
...
Closes gh-10594
2022-01-18 09:36:54 -03:00
feff747669
Polish multiple RequestRejectedHandlers support
...
Issue gh-10603
2022-01-14 17:21:04 -07:00
27cfb9c89d
Support multiple RequestRejectedHandler beans
...
Closes gh-10603
2022-01-14 17:21:00 -07:00
b2fe9149cf
Use noNullElements
...
Collection#contains(null) does not work for all collection types
Issue gh-10703
2022-01-14 14:33:17 -07:00
6c5fd38a3f
Fix typo
2022-01-10 16:24:53 +01:00
750dcafbd2
Fix @since tag
...
Issue gh-10590, gh-10554
2022-01-06 13:21:26 -03:00
d884d9a461
Configure WebInvocationPrivilegeEvaluator bean for multiple filter chains
...
Closes gh-10554
2021-12-13 09:19:41 -03:00
51b4bd67c9
Add RequestMatcherEntry
2021-12-13 09:19:28 -03:00
eda346863d
Introduce AuthorizationManagerWebInvocationPrivilegeEvaluator
...
Closes gh-10590
2021-12-13 09:19:13 -03:00
c68a75bcde
Correct imports to jakarta
...
Issue gh-9385, gh-10118
2021-12-08 11:43:13 +01:00
0beb725259
Add Cross Origin Policies headers
...
Add DSL support for Cross-Origin-Opener-Policy, Cross-Origin-Embedder-Policy and Cross-Origin-Resource-Policy headers
Closes gh-9385, gh-10118
2021-12-08 11:07:09 +01:00
aa3c883f87
Use BDD in tests
2021-12-02 17:40:25 -06:00
d37ff18b69
Polish gh-9597
2021-12-02 17:24:17 -06:00
c57fc309c2
Set details on authentication token created by HttpServlet3RequestFactory
...
Currently the login mechanism when triggered by executing HttpServlet3RequestFactory#login does not set any details on the underlying authentication token that is authenticated.
This change adds an AuthenticationDetailsSource on the HttpServlet3RequestFactory, which defaults to a WebAuthenticationDetailsSource.
Closes gh-9579
2021-12-02 17:24:17 -06:00
5dd2565348
Update copyright year
...
Issue gh-10557
2021-12-01 17:34:16 -06:00
41c6776455
Fix case sensitive headers comparison
...
Closes gh-10557
2021-12-01 14:55:50 -06:00
7e55c84cfc
Add Missing Since
...
Issue gh-10482
2021-11-30 15:15:35 -07:00
72109e2921
PermitAllSupport supports AuthorizeHttpRequestsConfigurer
...
PermitAllSupport supports either an ExpressionUrlAuthorizationConfigurer or an AuthorizeHttpRequestsConfigurer. If none or both are configured an error message is thrown.
Closes gh-10482
2021-11-30 15:00:04 -07:00
898ba67098
Polish gh-10007
2021-11-30 13:59:55 -06:00
9f51240bf1
Support IP whitelist for Spring Security Webflux
...
Closes gh-7765
2021-11-30 13:59:55 -06:00
9a9136d96d
Fix import spacing
2021-11-30 13:56:46 -06:00
c6a27d44e5
Remove failing test due to HttpMethod changes
...
Closes gh-10569
2021-11-30 13:31:39 -06:00
25feedb870
Fix removal of framework deprecated code
...
Issue https://github.com/spring-projects/spring-framework/issues/27686
2021-11-19 13:06:13 -03:00
bd34d70f97
Prevent Save @Transient Authentication with existing HttpSession
...
Previously, @Transient Authentication would get saved if an existing
HttpSession existed but it shouldn't.
This commit always prevents @Transient Authentication from being saved.
Closes gh-9992
2021-11-16 14:45:34 -06:00
db60df2f9c
Update to Spring Framework 6.0
...
Issue gh-10360
2021-11-01 09:02:42 -03:00
caad3d57e2
Improve log message when no CSRF token found
...
Closes gh-10436
2021-10-29 14:06:17 -03:00
04b47c5928
Fixed various broken links in Javadocs
2021-10-21 11:47:04 +02:00
a188138715
Javadocs author tag doesn't work in methods
2021-10-21 11:47:04 +02:00
f836897190
Checkstyle Fixes
...
- Javadoc tag ordering
- Private constructors before inner classes
Issue gh-10394
2021-10-18 21:03:35 -05:00
e1f4ec1137
Fix Jackson
2021-10-18 21:03:12 -05:00
faec20bc69
Update DefaultWebInvocationPrivilegeEvaluator to use current ServletContext
...
Closes gh-10208
2021-10-14 09:27:02 -03:00
7b98c2ea95
Restructure SwitchUserFilter Logs
...
Issue gh-6311
2021-10-12 13:32:29 -06:00
02b2fcc6f0
Restore ManagementConfigurationPlugin
...
Issue gh-9615
2021-10-05 11:23:29 -03:00
d2e5f2ae0d
Update Gradle to 7.2
...
Closes gh-9615
2021-10-04 15:19:40 -03:00
7d81a52780
Allow AuthenticationPrincipal argument type to be primitive
...
Closes gh-10172
2021-10-04 16:22:21 +02:00
84d173c310
Fix typo
2021-09-27 10:55:18 -03:00
a4c088a3b3
Introducing WebSessionServerLogoutHandler
...
Closes gh-4838
2021-08-16 13:08:35 -06:00
6f3e346b76
Add SecurityContextHolder#addListener
...
Closes gh-10032
2021-08-11 17:12:13 -06:00
b8d51725c7
Immutable SecurityContext
...
Issue gh-10032
2021-08-11 17:12:13 -06:00
f73f213f50
Remove DependencySetPlugin
...
Closes gh-10070
2021-07-12 15:31:38 -05:00
f800d2c993
Add hamcrest dependency
2021-07-09 15:57:21 -05:00
b6ff4d3674
Fix mockito UnnecessaryStubbingException
2021-07-09 14:35:10 -05:00
3e93b024d6
openrewrite Junit Migration
2021-07-09 14:32:52 -05:00
14240b2559
Remove Powermock
...
Powermock does not support JUnit5 yet, so we need to remove it
to support JUnit 5. Additionally, maintaining additional libraries
adds extra work for the team.
Mockito now supports final classes and static method mocking. This
commit replaces Powermock with mockito-inline.
Closes gh-6025
2021-07-08 12:35:32 -05:00
d121ab9565
Support A Well-Known URL for Changing Passwords
...
Closes gh-8657
2021-07-01 16:57:53 -06:00
3219fd554d
DigestAuthenticationFilter decodes nonce only once
...
Closes gh-8455
2021-06-18 15:25:00 -04:00
3bb8e1d200
Remove redundant translations in spring-security-web
2021-06-15 09:18:13 -05:00
7cd344acab
Add spanish translation of insufficient authentication and cookie stolen
2021-06-15 09:11:53 -05:00
ca76c54471
Polish CsrfWebFilterTests
...
Issue gh-9113
2021-06-04 16:41:08 -06:00
0c8b6df82a
Cache Mono that generate the CSRF token
...
Closes gh-9113
2021-06-04 16:41:08 -06:00
baac9e0cf2
Properly clean cookies with context path after logout
...
Closes gh-8846
2021-06-04 15:42:33 +02:00
2a7998d0fc
Adjust createNewSessionIfAllowed to prevent NPE
...
Ensure that isTransientAuthentication reuses the same authentication object from saveContext
Closes gh-8947
2021-05-26 10:36:44 -06:00
cf74ad3a52
Anonymous in ExceptionTranslationWebFilter
...
The ExceptionTranslationWebFilter does not support correctly when
anonymous authentication is enabled. With this enabled provoked always
the execution of the access denied handler, and with this fix it
behaves like the ExceptionTranslationFilter (servlet), executing the
access denied handler only if the principal is not empty and neither
anonymous.
Closes gh-9130
2021-05-26 09:17:41 -05:00
a7fbae8355
Add test for RequestedUrlRedirectInvalidSessionStrategy
2021-05-26 09:11:38 -05:00
0e6d47b082
Add guard around debug logging involving string concatenation
2021-05-26 09:11:38 -05:00
0af74ce134
Use ServletUriComponentsBuilder instead of UrlPathHelper
2021-05-26 09:11:38 -05:00
2bcd4627fa
Eliminate use of Optional
2021-05-26 09:11:38 -05:00
10a264c144
Add RequestedUrlRedirectInvalidSessionStrategy implemention of InvalidSessionStrategy
...
Performs a redirect to the original request URL when an invalid requested session is detected.
In effect, when a user's session times out, the user is redirected to URL they originally requested instead of some fixed URL.
2021-05-26 09:11:38 -05:00
df6ebc7051
Rename DelegatingAuthorizationManager
...
Closes gh-9692
2021-04-28 09:53:25 -06:00
e2993d93e1
Make Csrf cookie secure flag configurable (WebFlux)
...
Make the XSRF-TOKEN cookie secure flag configurable in CookieServerCsrfTokenRepository.
Closes gh-9678
2021-04-27 09:34:12 +02:00
cb6e4f4a11
Add NPE Guards
...
- Like values, names are only validated if they are not null
Closes gh-9598
2021-04-22 11:22:19 -06:00
7dc4de05b1
Add guard around logger.debug statement
...
The log message involves string concatenation, the cost of which should only be incurred if debug logging is enabled
2021-04-16 10:32:58 -06:00
4f7d529c5d
Polish Csrf Tests
...
Issue gh-9561
2021-04-09 22:47:31 -06:00
87ed527023
Add null check in CsrfFilter and CsrfWebFilter
...
Solve the problem that CsrfFilter and CsrfWebFilter
throws NPE exception when comparing two byte array
is equal in low JDK version.
When JDK version is lower than 1.8.0_45, method
java.security.MessageDigest#isEqual does not verify
whether the two arrays are null. And the above two
class call this method without null judgment.
ZiQiang Zhao<1694392889@qq.com>
2021-04-09 21:43:19 -06:00
f3f1106624
Update io.spring.javaformat to 0.0.27
...
Closes gh-9553
2021-04-05 22:23:59 -05:00
60d3db5798
add management platform(project(":spring-security-dependencies"))
...
Closes gh-9540
2021-04-05 10:36:36 -05:00
1a76ee7442
Update Gradle configuration names
...
Closes gh-9540
2021-04-05 10:36:36 -05:00
4a492846f1
Revert "Lock dependencies for 2.5.0-M3"
...
This reverts commit f05cc6269c
2021-03-15 23:18:45 +01:00
f05cc6269c
Lock dependencies for 2.5.0-M3
2021-03-15 11:00:19 +01:00
95da12110b
Additional Test for HttpSessionSecurityContextRepository
...
Issue gh-9387
2021-02-11 15:58:29 -07:00
3116369f02
Optimize HttpSessionSecurityContextRepository
...
Closes gh-9387
2021-02-11 15:58:28 -07:00
c4be1c6a56
Revert "Lock Dependencies"
...
This reverts commit a85caa4098
2021-02-11 15:49:59 -07:00
a85caa4098
Lock Dependencies
2021-02-11 15:00:38 -07:00
107f38fff9
Polish Tests
...
Issue gh-9331
2021-02-03 09:05:31 -07:00
873b9bdbca
Configure CurrentSecurityContextArgumentResolver BeanResolver
...
Closes gh-9331
2021-02-03 09:05:31 -07:00
77484018bb
Reconsider AntPathRequestMatcher matching logic
...
Closes gh-9285
2021-01-19 12:02:06 -07:00
0201c31deb
Fix Checkstyle for CsrfWebFilter
...
Issue gh-9337
2021-01-12 11:37:12 -06:00
a1083d9a5c
Fix CsrfWebFilter error message when expected CSRF not found
...
Closes gh-9337
2021-01-12 11:18:29 -06:00
160a4a3676
Reformat MvcRequestMatcher
...
- Moved related private methods together
Issue gh-9284
2021-01-11 08:28:59 -07:00
8449df9fd2
Consider Aligning MvcRequestMatcher's matching methods
...
Closes gh-9284
2021-01-09 21:42:16 +03:00
848bd44837
Remove unused code
...
Issue gh-9203
2020-12-18 11:49:52 -07:00
40e027c56d
Constant Time Comparison for CSRF tokens
...
Closes gh-9291
2020-12-17 15:01:43 -06:00
c066e23a86
Add @since attributes
...
Issue gh-8900
2020-12-16 15:58:53 -07:00
34b4b1054f
Add AuthorizationManager
...
Closes gh-8900
2020-12-16 15:58:36 -07:00
5306d4c4d5
Minor cleanup on Ant / Regex Request Matchers
...
- Removed duplicative code for transforming String into HttpMethod
- Removed an unnecessary array initialization
2020-12-14 14:19:23 +01:00
6be25df1db
Introduced DispatcherType request matcher
...
Created a DispatcherTypeRequestMatcher and corresponding methods
for configuring an HttpSecurity object. This enables filtering of
security rules based on the dispatcher type of the incoming servlet
request.
Closes gh-9205
2020-12-14 14:19:23 +01:00
54d3839f63
Add permissionsPolicy http header
2020-12-11 12:32:18 +01:00
48ef27b80a
Make assertion messages in CookieCsrfTokenRepository clearer
...
Changes assertion message format from 'X is not null' to
'X cannot be null' since this is more meaningful when the error
occurs and the message is printed in the logs.
Closes gh-9195
2020-12-09 10:45:22 -06:00
76e117a67a
Allow maximum age of csrf cookie to be configured
...
Allows maxAge of the generated cookie by CookieCsrfTokenRepository
to be configurable.
Prior to this commit, maximum age was set with a value of -1.
After this commit, it will be configured by the user with an either
positive or negative value. If the user does not provide a value,
it will be set -1.
An IllegalArgumentException will be thrown when
this value is set to zero.
Closes gh-9195
2020-12-09 10:45:22 -06:00
f614a8230c
Polish getRemoteUser
...
- Corrected instanceof check
Issue gh-3357
2020-12-03 13:08:40 -07:00
9c373ef4f8
getRemoteUser() returns principal name
...
Closes gh-3357
2020-12-03 13:08:40 -07:00
7f482eda7d
Fix CookieRequestCache for URL encoded query parameters
...
Avoid populating the saved request parameters with encoded values. Since the query strings of the request and saved URL are compared and must be equal, we can just use the parameters from the incoming request.
Closes gh-9203
2020-11-26 18:16:42 +01:00
4cc3c25a0e
removed whitespace formatting
2020-11-13 15:01:17 -06:00
a26975f780
cleanup compatibility method based on spring-projects#8868
2020-11-13 15:01:17 -06:00
ff58ac836e
Decode cookie once in AbstractRememberMeServices
...
Issue gh-9192
2020-11-09 08:14:20 -05:00
34a21cd80c
Fix formatting
2020-11-09 13:46:09 +01:00
5661e06e9c
Fix typo UserDetailService -> UserDetailsService
2020-11-09 13:13:32 +01:00
2b9efccc50
Implement MessageSourceAware where missing
...
Closes gh-8951
2020-11-05 10:57:33 -07:00
b95e1aa209
Revert "Lock dependencies for 5.5.0-M1"
...
This reverts commit 25a7482c8c
2020-11-03 19:53:28 -05:00
Rob Winch
Juan Carlos
Josh Cummings
Adam Ostrožlík
heowc
Marcus Da Coregio
Eleftheria Stein
Steve Riesenberg
Karl Tinawi
Igor Pelesic
Guirong Hu
Emil Sierżęga
Bogdan Ilchyshyn
Hiroshi Shirosaki
Evgeniy Cheban
Alexey Markevich
Ruben Suarez Alvarez
Tomoki Tsubaki
AlexeyAnufriev
César Revert
Craig Andrews
Thomas Vitale
佚名
Eleftheria Stein
happier233
Zeeshan Adnan
Rob Winch
Nick McKinney
Christophe Gilles
Serdar Kuzucu
Stephen Joyner
Aditya Sekhar
zhuang
Arnaud Mergey
Joe Grandja