Cwikius-Spring
/
spring-security
mirror of https://github.com/spring-projects/spring-security.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
7,151 Commits 33 Branches 333 Tags 109 MiB
Commit Graph

1164 Commits

Author SHA1 Message Date
Rob Winch a3210c96d9 Default Log Out Page 
Fixes: gh-5516
 2018-07-15 19:45:20 -05:00
Rob Winch 05ed028f9d Modernize Default Log In Page 
Fixes: gh-5515
 2018-07-15 19:43:42 -05:00
Rob Winch a66b945ab7 Configuration for ReactiveUserDetailsPasswordService 
Issue: gh-2778
 2018-07-15 15:08:06 -05:00
Rob Winch 3ca5810bc8 Configuration Support for UserDetailsPasswordManager 
Issue: gh-2778
 2018-07-15 14:56:45 -05:00
Rob Winch 02b857d82a Add PasswordEncoder.upgradeEncoding 
Issue: gh-2778
 2018-07-14 22:52:15 -05:00
mhyeon.lee 2af69f08a9 Fix oauth2login loginProcessingUrl NPE for java config 
Java Config http.oauth2Login().loginProcessingUrl("url"); throws NPE.
Override loginProcessingUrl method and cached config url.
Then when the config is initialized,
it calls the super method to complete the configuration.

Fixes gh-5488
 2018-07-13 09:34:17 -04:00
Johnny Lim 522bfe9e05 Polish Javadoc in ServerHttpSecurity 2018-07-11 08:01:49 -05:00
Mahan Hashemizadeh 555512e1f0 HstsSpec methods return this 
HstsSpec methods maxAge and includeSubdomains use to return void
which broke using it as a fluent API.

The methods now return HstsSpec which fixes this issue.

Fixes: gh-5483
 2018-07-05 13:58:45 -05:00
Josh Cummings 1d0bb08398
InterceptUrlConfigTests groovy->java 
Issue: gh-4939
 2018-07-02 10:39:24 -06:00
Joe Grandja ec970c9b8e Improve message for NoUniqueBeanDefinitionException in OAuth2ClientConfigurerUtils 2018-06-25 15:20:02 -04:00
Joe Grandja b3a38fb0f6 OAuth2ClientWebMvcSecurityConfiguration handles multiple OAuth2AuthorizedClientService @Bean 
Fixes gh-5321
 2018-06-25 15:20:02 -04:00
Josh Cummings b437ce03b0
HttpHeadersConfigTests groovy->java 
Also, slightly modified the approach when asserting headers. In the
previous incarnation, the tests would assert an exact match against
the list of headers, which is more brittle than confirming that the
expected headers are there and the unexpected ones are not.

Now, should Spring Security add other headers that are outside the
purview of the secure headers configuration, the assertions won't
break.

Issue: gh-4939
 2018-06-20 07:53:22 -06:00
Joe Grandja 6081451fa3 Polish OAuth2Configurer 2018-06-19 06:10:30 -04:00
Rob Winch 3573167d77 ServerHttpSecurity oauth leverages OidcReactiveAuthenticationManager 
Issue: gh-5330
 2018-06-18 16:08:07 -05:00
Joe Grandja 4fc6d96073 Rename @OAuth2Client to @RegisteredOAuth2AuthorizedClient 
Fixes gh-5360
 2018-06-08 17:33:21 -04:00
Joe Grandja 81a73e1f55 Fix package tangle in OAuth2Configurer 
Fixes gh-5342
 2018-06-08 11:09:16 -04:00
Rob Winch dd1b1b9cc3 Use Spring Framework 5.1.0 SNAPSHOT 
Fixes: gh-5408
 2018-06-05 12:28:51 -05:00
Josh Cummings 3332ccbe50
SecurityContextHolderAwareRequestConfig groovy->java 
Issue: gh-4939
 2018-05-30 17:37:45 -06:00
Rob Winch 73345e7434 Add Cross Site Tracing (XST) & HTTP Method Tampering Protection 
Fixes: gh-5377
 2018-05-24 09:35:40 -05:00
Kazuki Shimizu 2c92496911 Polishing the OidcConfigurationProvider 
See gh-5355
 2018-05-21 12:20:58 -05:00
Rob Winch 9d55a64465 OidcConfigurationProvider validate returned issuer 
Validate the issuer that was returned matches the issuer that was
was requested.

Issue: gh-5355
 2018-05-18 13:15:27 -05:00
Rob Winch db889973a8 OidcConfigurationProvider improve invalid issuer error 
Issue: gh-5355
 2018-05-18 11:21:45 -05:00
Rob Winch 18c8af8f0d Add OidcConfigurationProvider ClientAuthenticationMethod.POST support 
Issue: gh-5355
 2018-05-18 10:35:53 -05:00
Rob Winch 7853c759d9 OidcConfigurationProvider uses OidcScopes.OPENID 
Issue: gh-5355
 2018-05-18 10:03:36 -05:00
Rob Winch cbf9a7b7a2 Polish OidcConfigurationProvider Javadoc 
Issue: gh-5355
 2018-05-18 10:02:07 -05:00
Rob Winch 9862c7bbef Move OidcConfigurationProvider to .oidc package 
Issue: gh-5355
 2018-05-18 09:57:12 -05:00
Rob Winch 0eedfc717a Revert "Revert "Add ClientRegistration from OpenID Connect Discovery"" 
This reverts commit 9fe0f50e3c.

The original commit was accidentally pushed prior to PR. We attempted
to revert the commit hoping the PR would open again. This did not work.
We are going to do a Polish commit instead.

Issue: gh-5355
 2018-05-18 09:40:43 -05:00
Rob Winch 9fe0f50e3c Revert "Add ClientRegistration from OpenID Connect Discovery" 
This reverts commit 0598d47732.
 2018-05-18 09:20:51 -05:00
Rob Winch 0598d47732 Add ClientRegistration from OpenID Connect Discovery 
Fixes: gh-4413
 2018-05-16 12:30:04 -05:00
Josh Cummings 658acf0332
PlaceHolderAndELConfigTests groovy->java 
Issue: gh-4939
 2018-05-15 08:47:33 -06:00
Josh Cummings 428b0e45aa
HttpCorsConfigTests groovy->java 
Issue: gh-4939
 2018-05-15 08:47:33 -06:00
Josh Cummings 306e9ed91c
HttpConfigTests groovy->java 
Issue: gh-4939
 2018-05-15 08:47:33 -06:00
Rob Winch 32e368d9b7 Single ClientRegistration redirects by default 
Fixes: gh-5339
 2018-05-14 16:38:13 -05:00
Rob Winch f29e4cf91f LoginPageGeneratingWebFilter conditionally renders formLogin 
Issue: gh-4807
 2018-05-14 16:38:13 -05:00
Rob Winch 7013c6fd76 Add OAuth2LoginSpec 
Issue: gh-4807
 2018-05-11 04:19:50 -05:00
Johnny Lim b91ebf7090 Fix @since for MockEventListener 2018-05-07 16:53:26 -05:00
Denys Ivano fed15f2b01 Add accessDeniedHandler method to ExceptionHandlingSpec 
This allows to configure accessDeniedHandler in ExceptionTranslationWebFilter through ServerHttpSecurity.

Issue: gh-5257
 2018-05-07 16:22:29 -05:00
Johnny Lim 2a0f529ee4 Use spring-projects for organization in GitHub URLs 2018-05-04 21:01:39 -05:00
Josh Cummings 2273839aad
FormLoginConfigTests groovy->java 
Issue: gh-4939
 2018-05-01 08:11:04 -06:00
Rob Winch 9bb841ac67 ExceptionTranslationFilter does not handle committed responses 
Fixes: gh-5273
 2018-04-30 16:49:51 -05:00
Rob Winch eb067bc3a1 DefaultWebSecurityExpressionHandler uses PermissionEvaluator Bean 
The default instance of DefaultWebSecurityExpressionHandler uses the
PermissionEvaluator Bean by default.

Fixes: gh-5272
 2018-04-30 12:15:50 -05:00
Josh Cummings 359a73eff2
Merge pull request #5260 from jzheaux/gh-4939-FormLoginBeanDefinitionParserTests 
FormLoginBeanDefinitionParserTests groovy->java
 2018-04-27 12:03:55 -06:00
Josh Cummings 3c1231efd3
CsrfConfigTests groovy->java 
Issue: gh-4939
 2018-04-25 11:41:32 -06:00
Josh Cummings 65326b1178
FormLoginBeanDefinitionParserTests groovy->java 
Issue: gh-4939
 2018-04-25 11:12:07 -06:00
Josh Cummings 9c0f2cc281
AccessDeniedConfigTests groovy->java 
Issue: gh-4939
 2018-04-24 08:11:47 -06:00
Joe Grandja 526e0fdd4f Add OAuth2 Client HandlerMethodArgumentResolver 
Fixes gh-4651
 2018-04-02 12:13:52 -04:00
Joe Grandja 982fc360b2 Add support for authorization_code grant 
Fixes gh-4928
 2018-04-02 12:13:06 -04:00
Rob Winch 234c20eb30 Polish XsdDocumentedTests 
- NicerNoce->XmlNode
- NicerXmlSupport->XmlSupport
- NicerXmlParser->XmlParser

Issue: gh-4939
 2018-03-29 16:36:41 -05:00
Josh Cummings 0c0abea3ad XsdDocumentedTests groovy->java 
Groovy has more extensive support for Xml parsing via XmlSlurper.
To replace it, this conversion also introduces a SAX wrapper,
NicerXmlParser, and a companion Node wrapper, NicerNode, that
allowed for less modification of the converted tests.

Issue: gh-4939
 2018-03-29 16:36:41 -05:00
Rob Winch fb7394c1de Polish Javadoc 
Fixes: gh-5186
 2018-03-29 15:33:57 -05:00
Rob Winch 6e1e977778 Polish HeadersSpec 
Fixes: gh-5187
 2018-03-29 15:33:57 -05:00
Rob Winch 7a204a5f58 Fixes for SPR-16624 
Fixes: gh-5164
 2018-03-27 22:35:08 -05:00
Josh Cummings ec46b7dbe1 WebSocketMessageBrokerConfigTests groovy->java 
Of note is that this commit unrolls three Spock @Unroll-parameterized
tests into a separate test for each parameter.

Issue: gh-4939
 2018-03-27 12:38:06 -05:00
Christoph Dreis d07cfe655d Use Supplier variants of Assert methods 2018-03-27 10:58:55 -05:00
Rob Winch b1d013e8f0 Fix JDK 9 
Issue: gh-5160
 2018-03-27 09:30:56 -05:00
Rob Winch 018ab7d92c Fix Javadoc Typo uses->use 
Issue: gh-5113
 2018-03-19 15:36:31 -05:00
Rob Winch 01152ede41 Clarify HttpSecurity.registerFilterAt 
Fixes: gh-5113
 2018-03-19 14:41:03 -05:00
Rob Winch e86becc151 Relax assertions in HeaderSpecTests 
Fixes: gh-5116
 2018-03-15 08:30:37 -05:00
Rob Winch 4f709d47b9 Fix @since on GlobalAuthenticationConfigurerAdapter 
Fixes: gh-5106
 2018-03-13 14:23:36 -05:00
Rob Winch 452d855396 Fix appendix tests 2018-03-09 16:34:49 -06:00
Rob Winch a2073b2b91 Support BeanResolver for Reactive AuthenticationPrincipal 
Fixes: gh-4326
 2018-03-09 12:05:55 -06:00
Josh Cummings 3121f9c000 NamespaceGlobalMethodSecurity groovy->java 
Note that the `WhenUsingAspectJ` tests are still simply verifying structure instead of behavior. This is because the project appearsto be misconfigured in some way such that AspectJ advice isn't getting woven in at runtime. The original Groovy tests also only verified structure and they may be that way for a similar reason.

Either way, I will open up a ticket so we can review why that is the case and if there is a good fix.

Issue: gh-4939
 2018-03-08 16:53:54 -06:00
Josh Cummings c91ca0584c Sec2758Tests groovy->java 
Note that the old groovy test used a configuration of

```
http
    .authorizeRequests()
        .anyRequest().hasAnyAuthority("USER")
```

However, as I read the issue, gh-2984, the problem this issue
identifies is the non-passive change of defaulting to prefix
ROLE_ with all role-based configuration methods. So, the test now
does the following:

```
http
    .authorizeRequests()
        .anyRequest().access("hasAnyRole('USER')")
```

which demonstrates, given the configuration in this test, that
ROLE_ is correctly not prefixed in this expression, even though
it is a role-based configuration.

Issue: gh-4939
 2018-03-08 16:52:20 -06:00
Joe Grandja a5bd76b6ed Revert authorization_code grant support 
This reverts commit eae7afd9aa.
 2018-03-06 16:16:45 -05:00
Joe Grandja c922fe3be1 WebSecurityConfigurationTests groovy->java 
Issue: gh-4939
 2018-03-06 09:24:52 -05:00
Joe Grandja b1f3d495d9 Sec2515Tests groovy->java 
Issue: gh-4939
 2018-03-05 15:16:52 -05:00
Joe Grandja 0aa87e8501 EnableWebSecurityTests groovy->java 
Issue: gh-4939
 2018-03-05 10:23:48 -05:00
Joe Grandja 5af1d1d936 Polish HttpConfigurationTests 2018-03-05 08:36:15 -05:00
Joe Grandja 2a678ebc6e Polish WebSecurityConfigurerAdapterTests 2018-03-05 06:20:27 -05:00
Joe Grandja eae7afd9aa Add support for authorization_code grant 
Fixes gh-4928
 2018-03-02 14:30:49 -05:00
Josh Cummings 1ed51033cc Migrate config-debug groovy->java 
All tests in `org.springframework.security.config.debug` are migrated.

Note that `SecurityDebugBeanFactoryPostProceessorTest` preserves the original structure-verifying strategy used in the Groovy test. Verifying debug behavior turns out to be fairly tricky since being behaviorally invisible is in its nature.

Issue: gh-4939
 2018-03-02 08:55:07 -06:00
Josh Cummings 1b69c62d20 PortMapperConfigurerTests groovy->java 
Issue: gh-4939
 2018-02-27 11:44:21 -05:00
Josh Cummings e08d4cc90c AnonymousConfigurerTests groovy->java 
This test now checks key and principal both, which differs from the original Groovy test

In order to keep from needing to execute logic internal to `AnonymousAuthenticationToken`, this test changed from the original Groovy test. In the Groovy test, `key` is tested; however in this new test, `principal` is tested instead.

A concern was raised that if `AnonymousAuthenticationProvider` were invoked in this test, then testing only `principal` would not confirm that `key` was correctly propagated to `AnonymousAuthenticationProvider`. So, the test now configures both `key` and `principal`. The former to confirm correct wiring of `AnonymousAuthenticationProvider` and the latter to confirm correct wiring of `AnonymousAuthenticationFilter`.

Issue: gh-4939
 2018-02-27 11:30:02 -05:00
Josh Cummings bb59733736 Sec2377Tests groovy->java 
Issue: gh-4939
 2018-02-22 10:48:18 -05:00
Joe Grandja dc9248e73c NamespaceHttpTests groovy->java 
Issue: gh-4939
 2018-02-22 10:29:48 -05:00
Joe Grandja fded710e04 HttpConfigurationTests groovy->java 
Issue: gh-4939
 2018-02-16 14:16:51 -05:00
Rob Winch 210a510bba Use HttpFirewall Bean 
Fixes: gh-5022
 2018-02-15 17:18:28 -06:00
Joe Grandja 52b5423b75 WebSecurityConfigurerAdapterTests groovy->java 
Issue: gh-4939
 2018-02-15 17:50:55 -05:00
Joe Grandja 7fc88a391f SampleWebSecurityConfigurerAdapterTests groovy->java 
Issue: gh-4939
 2018-02-14 15:40:46 -05:00
Joe Grandja c31c1a4616 AbstractConfiguredSecurityBuilderTests -> remove use of reflection 
Issue gh-4939
 2018-02-14 12:47:35 -05:00
Rob Winch 780c9dd455 Fix GlobalMethodSecurityConfigurationTests checkstyle 
Issue: gh-4939
 2018-02-13 09:41:07 -06:00
Rob Winch 8b6e77e5ab Fix SpringTestContext checkstyle 
Issue: gh-5015
 2018-02-13 09:40:47 -06:00
Rob Winch 6af1ac08db GlobalMethodSecurityConfigurationTests groovy->java 
Issue: gh-4939
 2018-02-13 09:37:05 -06:00
Rob Winch 6c52eb6ee1 MethodSecurityService add additional methods 
Fixes: gh-5016
 2018-02-13 09:36:57 -06:00
Rob Winch ca5fb78ee1 Authz check(boolean result) 
Issue: gh-5016
 2018-02-13 09:36:48 -06:00
Rob Winch 1ad57adccc SpringTestContext allow setting Context 
Fixes: gh-5015
 2018-02-13 09:36:39 -06:00
Rob Winch 49e5b15ce2 Extract MockEventListener 
Fixes: gh-5014
 2018-02-13 09:36:27 -06:00
Rob Winch ce5fb51b20 Remove Mono.defer in ReactorContextWebFilter 
Fixes: gh-5010
 2018-02-08 16:19:10 -06:00
Rob Winch 964a14b224 Document Reactive Method security requires Publisher return types 
Fixes: gh-4988
 2018-02-07 16:43:18 -06:00
Rob Winch ea3dd336aa Cache headers only if no cache headers set 
Fixes: gh-5004
 2018-02-07 14:56:34 -06:00
Rob Winch 2165cc72ef BaseAuthenticationConfig groovy->java 
Issue: gh-4939
 2018-02-07 14:40:55 -06:00
Rob Winch 2c519b7e74 NamespaceGlobalMethodSecurityTests groovy->java 
Issue: gh-4939
 2018-02-06 15:23:41 -06:00
Rob Winch 9587f3280e MethodSecurityServiceImpl groovy->java 
Issue: gh-4939
 2018-02-06 14:09:58 -06:00
Rob Winch 751130ba04 MethodSecurityService groovy->java 
Issue: gh-4939
 2018-02-06 14:08:43 -06:00
Rob Winch 9e23d684e7 Polish Imports in SpringTestRule 
Fixes: gh-5001
 2018-02-06 13:48:36 -06:00
Rob Winch 73f5e89e4c SpringTestRule clears SecurityContext 
Fixes: gh-5001
 2018-02-06 11:54:26 -06:00
Rob Winch 1efc7ef5d7 Issue50Tests groovy->java 
Issue: gh-4939
 2018-02-06 11:53:19 -06:00
Rob Winch d12d9ba538 SecurityConfig groovy->java 
Issue: gh-4939
 2018-02-06 11:53:07 -06:00
Rob Winch 9e3e7e9e29 ApplicationConfig groovy->java 
Issue: gh-4939
 2018-02-06 11:52:29 -06:00
Rob Winch 11c8d5ddfb UserRepository groovy->java 
Issue: gh-4939
 2018-02-06 11:51:58 -06:00