a6bded86c2
SEC-1990: Polishing code cleanup on BCrypt
...
- Formatting
- Renamed test to be BCryptTests to better align with Spring Security's naming conventions
2012-07-05 14:12:14 -05:00
14a5135ac3
SEC-1990: Clean up jBCrypt and include its tests.
...
Merge in changes from jBCrypt.
- Use a ByteArrayOutputStream to cache bytes.
- Pass a StringBuilder into encode_base64.
- Refactor string comparison into its own method.
- General clean up.
2012-07-05 14:04:39 -05:00
fde9142d8d
SEC-1907: Exclude crypto dependency in core module since classes are bundled in core
2012-07-05 13:56:47 -05:00
f2345fcb21
SEC-1981: Remove dependency on Locale for the build
2012-07-05 13:30:41 -05:00
a2452ab514
SEC-1906: Update to Gradle 1.0
2012-07-05 12:41:56 -05:00
2fba10ab61
Use powermock for testing servlet 3.0 functionality instead of distinct classpaths
2012-07-01 12:37:01 -05:00
18230259b8
SEC-1985: Removed WebSecurityExpessionHandler from reference
2012-06-28 11:35:07 -05:00
f6902471fb
SEC-1965: DefaultWebSecurityExpressionHandler is now passive from 3.0.x releases
...
There were two issues that needed resolved
- Since DefaultWebSecurityExpressionHandler no longer implemented WebSecurityExpressionHandler a bean lookup by
type would not work. This caused failures in the JSF support.
- The method createEvaluationContext needed to be explicitly defined on WebSecurityExpressionHandler since the
parameterized type from the super interface is not preserved at compile time. Without explicitly defining the
method any class compiled against a previous version would cause a NoSuchMethodException.
2012-06-28 10:54:01 -05:00
b6ec700640
SEC-1968: AbstractPreAuthenticatedProcessingFilter clears SecurityContext on null principal change with invalidateSessionOnPrincipalChange = true
2012-06-27 15:49:18 -05:00
e1068b84ea
.gitignore src/*/java/META-INF/
2012-06-26 16:36:41 -05:00
de3dfb5b3f
SEC-1875: ConcurrentSessionControlStrategy no longer adds/removes the session to the SessionRegistry twice
...
This fixes two issues introduced by SEC-1229
* SessionRegistry.registerNewSession is invoked twice
* SessionRegistry.removeSession is invoked twice (once by the
ConcurrentSessionControlStrategy#onSessionChange and once by
SessionRegistryImpl#onApplicationEvent). This is not nearly
as problematic since the interface states that implementations
should be handle removing the session twice. However, as removing
twice requires an unnecessary database hit we should only remove
sessions once.
2012-06-26 16:36:41 -05:00
954ba57cf2
SEC-1970: Cleanup of pre authentication documentation
...
* Removed custom-authentication-provider from documentation
* Rephrased to make the pre authentication documentation a little more concise
* Removed nested () within text (not code)
* Removed user which should have been use
2012-06-15 14:44:16 -05:00
8b05d23832
SEC-1971: Allow injection of ExpressionParser in AbstractSecurityExpressionHandler
2012-06-15 08:21:52 -05:00
6584b65489
SEC-1898: Added test to demonstrate JdbcAclService#readAclById throws NotFoundException when the Acl is missing
2012-06-11 16:29:50 -05:00
520b65e2e3
SEC-1865: Remove invalid OWASP link in TextEscapeUtils
2012-06-11 14:49:28 -05:00
a8b30ed6d9
.gitignore */src/*/java/META-INF
2012-06-11 14:48:24 -05:00
254333ce82
SEC-1957: DefaultFilterChainValidator no longer casts to DefaultFilterInvocationSecurityMetadataSource
2012-04-29 15:59:24 -05:00
b626a63b85
Suppress warnings in AbstractAuthorizeTag and AuthorizeTagCustomGrantedAuthorityTests
2012-04-22 21:54:44 -05:00
d57f1d56d5
SEC-1900: AbstractAuthorizeTag now compares using getAuthority()
...
This avoids backwards compatibility issues with other GrantedAuthority
implementations.
2012-04-22 21:54:43 -05:00
c446697de3
Cleaned up warnings in FilterChainProxyTests
2012-04-11 17:23:07 -05:00
bb8f3bae7c
SEC-1950: Defensively invoke SecurityContextHolder.clearContext() in FilterChainProxy
2012-04-11 17:22:19 -05:00
ca741ab18f
SEC-1943: Corrected namespace doc to state SecurityContextHolderAwareRequestFilter instead of SecurityContextHolderAwareFilter
2012-03-20 19:18:26 -05:00
488efbc97e
SEC-1901: Changed DebugFilter to no longer extend OncePerRequesetFilter so that the FilterChainProxy is invoked on forwards
2012-03-17 11:16:21 -05:00
a4322d70ba
Merge pull request #5 from tburch/setUseSecureCookie-typo
...
fix typo in AbstractRememberMeServices.setUseSecureCookie method documentation
2012-03-13 17:02:43 -07:00
f78c11650f
SEC-1893: Namespace now register PortMapper with custom mappings for all components that use a PortMapper
2012-03-11 20:52:17 -05:00
84141c4c76
SEC-1927: Corrected debug log in SessionManagementFilter to have a space between ID and the session and added guard to log statement
2012-03-11 18:35:38 -05:00
e7f47964ee
fix typo in setUseSecureCookie method documentation
2012-03-09 17:01:17 -07:00
6bde4caa77
Merge pull request #4 from Abdull/master
...
Correct role names in tutorial jsps
2012-02-28 14:15:53 -08:00
dec44811fc
Gave correct role name
2012-02-28 14:41:14 +01:00
0e413cedcb
Gave correct role name
2012-02-28 14:39:30 +01:00
3760d792ea
SEC-1890: Add checks for validity of stored bcrypt hash
...
When checking for a match, the BCryptPasswordEncoder validates
the stored hash against a pattern to check that it actually is
a bcrypt value.
2012-02-22 14:36:13 +00:00
5d71d2a4fa
SEC-1887: Add MethodSecurityOperations interface.
...
This should cater for implementations which want to use
the full filtering capabilities while creating a custom
expression root object.
Also cleaning whitespace.
2012-02-01 15:49:56 +00:00
2434564d6c
SEC-1904: Fixed LDAP object class name in docs.
2012-02-01 14:37:32 +00:00
538e75ce1b
SEC-1903: Use a static CRLF Pattern in FirewalledResponse
...
The Pattern was being recompiled for every request
when a single instance could be shared for performance
reasons.
2012-02-01 13:21:16 +00:00
0f9ee81df1
SEC-1887: Improve extensibility of expression-based security classes
...
Introduces a new SecurityExpressionOperations interface which is
implemented by SecurityExpressionRoot
2012-01-31 19:06:43 +00:00
b493afa18c
SEC-1888: Improving the doc on (not) using multiple annotation types in the same class.
2012-01-31 19:05:43 +00:00
f97463cdb5
Minor comment fixes
2012-01-16 14:49:59 +00:00
2d556c7b4f
SEC-1885: Change SecurityDebugBeanFactoryPostProcessor to only interact with BeanDefinitions rather than instances to prevent premature instatiation of FilterChainProxy and its dependencies
...
This issue occurred because the AutowiredAnnotationBeanPostProcessor had not been registered when the SecurityDebugBeanFactoryPostProcessor tried to obtain the FilterChainProxy. This caused
all of the FilterChainProxy's dependant beans to be resolved and if they used @Autowired they would not get processed properly.
2012-01-07 13:52:50 -06:00
22225effcc
Call SecurityContextHolder.clearContext() in tear down of HttpSessionSecurityContextRepositoryTests
2011-12-30 16:05:35 -06:00
5d94cd5e13
SEC-1735: Do not remove SecurityContext from HttpSession when anonymous Authentication is saved if original SecurityContext was anonymous
2011-12-30 16:04:02 -06:00
1f835fec43
SEC-1867: Perform null check on Authentication.getCredentials() prior to calling toString()
2011-12-30 14:00:13 -06:00
448a42916d
SEC-1880: Corrected error message when using both logout-success-url and success-handler-ref
2011-12-30 11:31:24 -06:00
ea56a98883
SEC-1868: Remove error level logs from SecurityNamespaceHandler when the web classes are not available and not required
...
To get the detailed errors the FilterChainProxy is loaded again in reportMissingWebClasses
and included in the readerContext fatal log.
2011-12-30 10:51:17 -06:00
6fe6e18939
SEC-1870: Updated HttpSessionDestroyedEvent to properly look for SecurityContexts as session attribute values instead of session attribute names
2011-12-29 15:44:49 -06:00
044861eb20
Renamed **/*Spec.groovy to **/*Tests.groovy to better follow conventions
2011-12-29 12:59:24 -06:00
8ca2927761
Renamed **/Test.java to **/Tests.java to better follow conventions
2011-12-28 17:39:29 -06:00
aabb16912f
SEC-1878: DefaultFilterChainValidator properly handles AccessDecisionManager throwing exceptions other than AccessDeniedException
2011-12-28 16:43:19 -06:00
00936c6b49
Switch to post release snapshot version.
2011-12-05 23:44:55 +00:00
9b423a7726
Set 3.1.0 release version.
2011-12-05 23:42:39 +00:00
9fa6e78770
SEC-1857: Use Principal.getName() in ContextPropagatingRemoteInvocation
...
This is a better option than using the toString() method
where the latter doesn't return the username. e.g when the
principal is a UserDetails.
2011-12-05 21:23:42 +00:00
Rob Winch
Joseph Walton
Rob Winch
Christian Hilmersson
Tristan Burch
ltaylor
Abdull
Luke Taylor
Andrei Stefan