1926 Commits

Author SHA1 Message Date
Rob Winch
029e31ebe8
DelegatingAuthenticationEntryPoint.Builder allows just defaultEntryPoint
Previously build threw an Exception when entryPoints was empty and
defaultEntryPoint was specified.

This commit changes build to return the defaultEntryPoint instead.

Closes gh-17955
2025-09-25 09:45:52 -05:00
Rob Winch
b2d76dfe66
Add GrantedAuthorities.FACTOR_*_AUTHORITY
Closes gh-17952
2025-09-24 09:53:56 -05:00
Josh Cummings
d757e6e44e
Response to Additional Feedback
- Moved request attribute to WebAttributes
- Renamed ExceptionHandlingConfigurer methods
- Removed varargs from DelegatingMissingAuthorityAccessDeniedHandler

Issue gh-17901
Issue gh-17934
2025-09-23 18:16:22 -06:00
Josh Cummings
50ebd467c3
Polish Default Login Page
Issue gh-17901
2025-09-23 17:59:23 -06:00
Josh Cummings
42376e2eee
Prepopulate Username When Known
Closes gh-17935
2025-09-23 17:59:22 -06:00
Josh Cummings
e813aad82b
Support Showing One Part of Login Page
Closes gh-17901
2025-09-23 17:59:21 -06:00
Josh Cummings
9f317757c3
Make Public Missing Authority AccessDeniedHandler
Issue gh-17934
2025-09-23 17:59:19 -06:00
Josh Cummings
e66c498d80
Redirect to Appropriate Entry Point Based on Missing Authorities
Issue gh-17934
2025-09-23 17:16:32 -06:00
Josh Cummings
5ca5aca48e
Add Null Guard
Issue gh-17933
2025-09-22 12:23:29 -06:00
Josh Cummings
c61f53ad64
Copy Query to Parameters
Issue gh-17450
2025-09-22 12:17:24 -06:00
Josh Cummings
758b35df9c
Add Factor Tests for Authentication Providers
Issue gh-17933
2025-09-19 11:32:27 -06:00
Josh Cummings
0f4e1f2a2a
Move FACTOR_X509 into PreAuthenticatedAuthenticationProvider
Issue gh-17933
2025-09-19 11:32:27 -06:00
Rob Winch
bce8049815
Web uses AuthorizationManager<? super RequestAuthorizationContext>
This allows AuthorizationManager<Object> to be used instead of just
AuthorizationManager<RequestAuthorizationContext>. In addition, the
code was updated to use
`AuthorizationManagerFactory<? super RequestAuthorizationContext>`

Closes gh-17931
2025-09-18 17:32:09 -05:00
Rob Winch
fdd2a91b68
DelegatingAuthenticationEntryPoint.Builder is final
Make it final and a private constructor

Issue gh-17915
2025-09-16 10:05:40 -05:00
Rob Winch
9a3ae4b867
DelegatingAuthenticationEntryPoint uses RequestMatcherEntry
Closes gh-17915
2025-09-16 09:48:04 -05:00
Josh Cummings
fa4806dbcc
Move Web Access API
Issue gh-17847
2025-09-12 10:32:38 -06:00
DingHao
10935632ee Remove PortResolver
Closes gh-15971

Signed-off-by: DingHao <dh.hiekn@gmail.com>
2025-09-11 22:58:32 -05:00
Rob Winch
f0f272d17b Add new StrictFirewallBuilder.localAddress(InetSocketAddress) 2025-09-11 22:41:15 -05:00
Josh Cummings
5da2121e2b
Merge remote-tracking branch 'origin/6.5.x' 2025-09-09 17:13:18 -06:00
Andrey Litvitski
eca821471f A Root basePath No Longer Creates a Double-Slash
Closes gh-17812

Signed-off-by: Andrey Litvitski <andrey1010102008@gmail.com>
2025-09-09 17:12:58 -06:00
Josh Cummings
e97a335edc Polish Web Authentication Builders
Issue gh-17861
2025-09-09 14:59:14 -06:00
Josh Cummings
dd50dc0c40 Remove Generic Typing From Authentication.Builder
It would be better to introduce parameter types for
principal and credentials into Authentication.Builder
at the same time as doing so for Authentication

Issue gh-17861
2025-09-09 14:49:13 -06:00
Josh Cummings
3f774548d2 Move Authority Propagation Into Filters
Given that the filters are the level at which the
SecurityContextHolder is consulted, this commit moves
the operation that ProviderManager was doing into each
authentication filter.

Issue gh-17862
2025-09-09 14:49:13 -06:00
Josh Cummings
a0fe6a5fee Polish Builders
- Added remaining properties
- Removed apply method since Spring Security isn't using
it right now
- Made builders extensible since the authentications are
extensible

Issue gh-17861
2025-09-09 14:49:13 -06:00
Josh Cummings
a201a2b862 Add Authentication.Builder
This commit adds a new default method to Authentication
for the purposes of creating a Builder based on the current
authentication, allowing other authentications to be
applied to it as a composite.

It also adds Builders for each one of the authentication
result classes.

Issue gh-17861
2025-09-09 14:49:13 -06:00
Steve Riesenberg
eeb4574bb3 Add AuthorizationManagerFactory
Signed-off-by: Steve Riesenberg <5248162+sjohnr@users.noreply.github.com>
2025-09-09 15:36:49 -05:00
Josh Cummings
bd119ac411
Implement Equals and HashCode
Internally, RequestMatcher is sometimes used as a key to a
HashMap. Accordingly, each implementation should implement
equals and hashCode.

Closes gh-17842
2025-09-03 17:48:50 -06:00
Rob Winch
f13d8d5c75
Fix Nullability in WebInvocationPrivilegeEvaluator
Issue gh-17535
2025-08-30 20:38:58 -05:00
Rob Winch
c2ba662b91
Enable Null checking in spring-security-web via JSpecify
Closes gh-17535
2025-08-29 15:06:48 -05:00
Rob Winch
49f308adb0
Use Supplier<? extends @Nullable Authentication>
Previously Supplier<@Nullable Authentication> was used. This prevented
Supplier<Authentication> from being used. The code now uses
Supplier<? extends @Nullable Authentication> which allows for both
Supplier<@Nullable Authentication> and Supplier<Authentication>.

Closes gh-17814
2025-08-29 09:46:58 -05:00
Josh Cummings
d1962201b5 Merge branch '6.5.x' 2025-08-22 11:07:59 -06:00
Josh Cummings
857ca9c412 Merge remote-tracking branch 'origin/6.4.x' into 6.5.x 2025-08-22 11:07:37 -06:00
Nikita Konev
894105aab5 Fix traceId discrepancy in case error in servlet web
Signed-off-by: Nikita Konev <nikit.cpp@yandex.ru>
2025-08-22 11:06:37 -06:00
Jaehwan Lee
806297da23 Fix misleading variable name in authentication filter
Rename DEFAULT_ANT_PATH_REQUEST_MATCHER to DEFAULT_PATH_REQUEST_MATCHER
to reflect PathPatternRequestMatcher usage instead of legacy Ant
pattern terminology.

Signed-off-by: Jaehwan Lee <jhrick0129@gmail.com>
2025-08-19 22:21:35 -05:00
Josh Cummings
eeb383ac46 Fix Checkstyle
Issue gh-17623
2025-08-07 14:32:18 -06:00
Josh Cummings
6d1a886f92 Deprecate SERIAL_VERSION_UID
Closes gh-17623
2025-08-07 11:09:35 -06:00
Andrey Litvitski
2fbe8dd8f6 Make Stricter IP Format Check
Closes gh-17499

Signed-off-by: Andrey Litvitski <andrey1010102008@gmail.com>
2025-07-31 10:30:57 -06:00
Josh Cummings
6873685fd0 Merge remote-tracking branch 'origin/6.5.x' 2025-07-31 10:12:39 -06:00
Tim Boeckstaens
f180a04b74 Use final values in equals and hashCode
Closes gh-17584

Signed-off-by: Tim Boeckstaens <boeckstaenstim@gmail.com>
2025-07-31 10:12:24 -06:00
Rob Winch
f6cb0bd610
Merge Use 2004-present Copyright Header
The original merge into main did not apply the changes. This fixes it.
Closes gh-17635
2025-07-29 10:52:42 -05:00
Rob Winch
2fdca16c1a
Merge branch '6.4.x' into 6.5.x
Closes gh-17634
2025-07-29 09:47:52 -05:00
Rob Winch
392129b616
Use 2004-present Copyright Header
The Spring portfolio is changing to use <inception-year>-present in
the copyright headers to simplify keeping headers up to date. This
commit updates the headers and the checkstyle accordingly.

The commit updated etc/checkstyle/header.txt

It also updated the copyright headers using the following find/replace:

Find: (Copyright \d{4})\s*(\-\d{4})? the original author or authors.
Replace: Copyright 2004-present the original author or authors.

Closes gh-17633
2025-07-29 09:45:23 -05:00
Rob Winch
34742c9743
Reapply "Move webauthn runtimehints to spring-security-webauthn"
This reverts commit 9489ab48abcbd192d87e5535f2459804d9826a80.
2025-07-23 13:32:34 -05:00
Rob Winch
9489ab48ab
Revert "Move webauthn runtimehints to spring-security-webauthn"
This reverts commit fe411896af5ae5d5b50babfa292152335a3bf193.
2025-07-23 09:22:47 -05:00
Rob Winch
fe411896af
Move webauthn runtimehints to spring-security-webauthn
Issue gh-17586
2025-07-23 09:20:39 -05:00
Rob Winch
79cd982341
Extract spring-security-webauthn
Closes gh-17586
2025-07-22 17:18:38 -05:00
Rob Winch
7c887d2da1
Add nullability to spring-security-core
Closes gh-17534
2025-07-22 16:29:13 -05:00
DingHao
dadf4c0b8a Remove shouldFilterAllDispatcherTypes
Closes gh-12139

Signed-off-by: DingHao <dh.hiekn@gmail.com>
2025-07-14 12:34:16 -06:00
Josh Cummings
b7ae9910b5
Remove Deprecated CookieServerCsrfTokenRepository Methods
Closes gh-14132
2025-07-10 11:13:37 -06:00
Josh Cummings
ee2b826362
Use setCookieCustomizer
Issue gh-14132
2025-07-10 11:13:21 -06:00