2036 Commits

Author SHA1 Message Date
Rob Winch
9a3ae4b867
DelegatingAuthenticationEntryPoint uses RequestMatcherEntry
Closes gh-17915
2025-09-16 09:48:04 -05:00
Josh Cummings
fa4806dbcc
Move Web Access API
Issue gh-17847
2025-09-12 10:32:38 -06:00
Josh Cummings
eedcec9d5c
Move Core Access API
Issue gh-17847
2025-09-12 10:32:38 -06:00
DingHao
10935632ee Remove PortResolver
Closes gh-15971

Signed-off-by: DingHao <dh.hiekn@gmail.com>
2025-09-11 22:58:32 -05:00
Rob Winch
f0f272d17b Add new StrictFirewallBuilder.localAddress(InetSocketAddress) 2025-09-11 22:41:15 -05:00
Josh Cummings
5da2121e2b
Merge remote-tracking branch 'origin/6.5.x' 2025-09-09 17:13:18 -06:00
Andrey Litvitski
eca821471f A Root basePath No Longer Creates a Double-Slash
Closes gh-17812

Signed-off-by: Andrey Litvitski <andrey1010102008@gmail.com>
2025-09-09 17:12:58 -06:00
Josh Cummings
e97a335edc Polish Web Authentication Builders
Issue gh-17861
2025-09-09 14:59:14 -06:00
Josh Cummings
dd50dc0c40 Remove Generic Typing From Authentication.Builder
It would be better to introduce parameter types for
principal and credentials into Authentication.Builder
at the same time as doing so for Authentication

Issue gh-17861
2025-09-09 14:49:13 -06:00
Josh Cummings
3f774548d2 Move Authority Propagation Into Filters
Given that the filters are the level at which the
SecurityContextHolder is consulted, this commit moves
the operation that ProviderManager was doing into each
authentication filter.

Issue gh-17862
2025-09-09 14:49:13 -06:00
Josh Cummings
a0fe6a5fee Polish Builders
- Added remaining properties
- Removed apply method since Spring Security isn't using
it right now
- Made builders extensible since the authentications are
extensible

Issue gh-17861
2025-09-09 14:49:13 -06:00
Josh Cummings
a201a2b862 Add Authentication.Builder
This commit adds a new default method to Authentication
for the purposes of creating a Builder based on the current
authentication, allowing other authentications to be
applied to it as a composite.

It also adds Builders for each one of the authentication
result classes.

Issue gh-17861
2025-09-09 14:49:13 -06:00
Steve Riesenberg
eeb4574bb3 Add AuthorizationManagerFactory
Signed-off-by: Steve Riesenberg <5248162+sjohnr@users.noreply.github.com>
2025-09-09 15:36:49 -05:00
Josh Cummings
bd119ac411
Implement Equals and HashCode
Internally, RequestMatcher is sometimes used as a key to a
HashMap. Accordingly, each implementation should implement
equals and hashCode.

Closes gh-17842
2025-09-03 17:48:50 -06:00
Rob Winch
f13d8d5c75
Fix Nullability in WebInvocationPrivilegeEvaluator
Issue gh-17535
2025-08-30 20:38:58 -05:00
Rob Winch
c2ba662b91
Enable Null checking in spring-security-web via JSpecify
Closes gh-17535
2025-08-29 15:06:48 -05:00
Rob Winch
49f308adb0
Use Supplier<? extends @Nullable Authentication>
Previously Supplier<@Nullable Authentication> was used. This prevented
Supplier<Authentication> from being used. The code now uses
Supplier<? extends @Nullable Authentication> which allows for both
Supplier<@Nullable Authentication> and Supplier<Authentication>.

Closes gh-17814
2025-08-29 09:46:58 -05:00
Josh Cummings
d1962201b5 Merge branch '6.5.x' 2025-08-22 11:07:59 -06:00
Josh Cummings
857ca9c412 Merge remote-tracking branch 'origin/6.4.x' into 6.5.x 2025-08-22 11:07:37 -06:00
Nikita Konev
894105aab5 Fix traceId discrepancy in case error in servlet web
Signed-off-by: Nikita Konev <nikit.cpp@yandex.ru>
2025-08-22 11:06:37 -06:00
Jaehwan Lee
806297da23 Fix misleading variable name in authentication filter
Rename DEFAULT_ANT_PATH_REQUEST_MATCHER to DEFAULT_PATH_REQUEST_MATCHER
to reflect PathPatternRequestMatcher usage instead of legacy Ant
pattern terminology.

Signed-off-by: Jaehwan Lee <jhrick0129@gmail.com>
2025-08-19 22:21:35 -05:00
Josh Cummings
eeb383ac46 Fix Checkstyle
Issue gh-17623
2025-08-07 14:32:18 -06:00
Josh Cummings
6d1a886f92 Deprecate SERIAL_VERSION_UID
Closes gh-17623
2025-08-07 11:09:35 -06:00
Andrey Litvitski
2fbe8dd8f6 Make Stricter IP Format Check
Closes gh-17499

Signed-off-by: Andrey Litvitski <andrey1010102008@gmail.com>
2025-07-31 10:30:57 -06:00
Josh Cummings
6873685fd0 Merge remote-tracking branch 'origin/6.5.x' 2025-07-31 10:12:39 -06:00
Tim Boeckstaens
f180a04b74 Use final values in equals and hashCode
Closes gh-17584

Signed-off-by: Tim Boeckstaens <boeckstaenstim@gmail.com>
2025-07-31 10:12:24 -06:00
Rob Winch
f6cb0bd610
Merge Use 2004-present Copyright Header
The original merge into main did not apply the changes. This fixes it.
Closes gh-17635
2025-07-29 10:52:42 -05:00
Rob Winch
2fdca16c1a
Merge branch '6.4.x' into 6.5.x
Closes gh-17634
2025-07-29 09:47:52 -05:00
Rob Winch
392129b616
Use 2004-present Copyright Header
The Spring portfolio is changing to use <inception-year>-present in
the copyright headers to simplify keeping headers up to date. This
commit updates the headers and the checkstyle accordingly.

The commit updated etc/checkstyle/header.txt

It also updated the copyright headers using the following find/replace:

Find: (Copyright \d{4})\s*(\-\d{4})? the original author or authors.
Replace: Copyright 2004-present the original author or authors.

Closes gh-17633
2025-07-29 09:45:23 -05:00
Rob Winch
34742c9743
Reapply "Move webauthn runtimehints to spring-security-webauthn"
This reverts commit 9489ab48abcbd192d87e5535f2459804d9826a80.
2025-07-23 13:32:34 -05:00
Rob Winch
9489ab48ab
Revert "Move webauthn runtimehints to spring-security-webauthn"
This reverts commit fe411896af5ae5d5b50babfa292152335a3bf193.
2025-07-23 09:22:47 -05:00
Rob Winch
fe411896af
Move webauthn runtimehints to spring-security-webauthn
Issue gh-17586
2025-07-23 09:20:39 -05:00
Rob Winch
79cd982341
Extract spring-security-webauthn
Closes gh-17586
2025-07-22 17:18:38 -05:00
Rob Winch
7c887d2da1
Add nullability to spring-security-core
Closes gh-17534
2025-07-22 16:29:13 -05:00
DingHao
dadf4c0b8a Remove shouldFilterAllDispatcherTypes
Closes gh-12139

Signed-off-by: DingHao <dh.hiekn@gmail.com>
2025-07-14 12:34:16 -06:00
Josh Cummings
b7ae9910b5
Remove Deprecated CookieServerCsrfTokenRepository Methods
Closes gh-14132
2025-07-10 11:13:37 -06:00
Josh Cummings
ee2b826362
Use setCookieCustomizer
Issue gh-14132
2025-07-10 11:13:21 -06:00
Josh Cummings
dadf10899c
Add WebExpressionAuthorizationManager.Builder
Closes gh-17504
2025-07-09 17:33:10 -06:00
Josh Cummings
c06b1f4916
Remove LazyCsrfTokenRepository
Closes gh-13196
2025-07-09 13:47:06 -06:00
Rob Winch
e48fdd5ed4
Use UserWebTestClientConfigurer
Closes gh-17496
2025-07-07 15:15:51 -05:00
Josh Cummings
74771a3d42
Merge branch '6.5.x' 2025-07-07 11:43:25 -06:00
Josh Cummings
ea3ba62022
Correct Servlet Path JavaDoc
Initially PathPatternRequestMatcher was designed to match relative
to the servlet path. However, this was changed to be relative to
the context path. This commit updates the documentation and removes
references to the servlet path other than in the context of setting
a basePath to remove boilerplate.

Issue gh-16430
2025-07-07 11:34:29 -06:00
Andrey Litvitski
596d44757a Remove RequestVariablesExtractor
Closes gh-17308

Signed-off-by: Andrey Litvitski <andrey1010102008@gmail.com>
2025-07-03 14:41:12 -06:00
Tran Ngoc Nhan
9312fb7004 Remove Deprecated AuthorizationDecision Elements
Closes gh-17299

Signed-off-by: Tran Ngoc Nhan <ngocnhan.tran1996@gmail.com>
2025-07-03 14:32:49 -06:00
Josh Cummings
d3e9e3138d
Remove AntPath and MvcRequestMatcher
Closes gh-16886
Closes gh-16887
2025-07-03 13:37:50 -06:00
Josh Cummings
e8ed0f1b03
Use PathPatternRequestMatcher in web
Issue gh-16887
2025-07-03 13:37:48 -06:00
Josh Cummings
3e53cc2c4a
Use PathPatternRequestMatcher in config
This commit changes the config module to use
PathPatternRequestMatcher in favor of
MvcRequestMatcher and AntPathRequestMatcher.

This allows removing several HandlerMappingIntrospector
support classes as well which were in place to
support MvcRequestMatcher.

Issue gh-16886
Issue gh-16887
2025-07-03 13:37:47 -06:00
Josh Cummings
f709a9efef
Add pathPattern Factory Methods
Closes gh-17476
2025-07-03 13:37:47 -06:00
Josh Cummings
98686a5139
Standardize Mock Request Paths
Closes gh-17449
2025-07-03 13:37:47 -06:00
Josh Cummings
d869686d09
Add TestMockHttpServleRequests
Closes gh-17450
2025-07-03 13:37:46 -06:00