Commit Graph

893 Commits

Author SHA1 Message Date
Jan Marten 6b19728c54 Fix legacy-websocket-configuration cross-reference
Closes gh-12969
2023-05-22 14:44:34 -06:00
Josh Cummings 0e3ee89902
Merge branch '6.0.x' 2023-05-18 11:08:11 -06:00
Josh Cummings cdac708051
Merge branch '5.8.x' into 6.0.x 2023-05-18 11:08:00 -06:00
Josh Cummings 219faf29d4
Merge branch '5.7.x' into 5.8.x 2023-05-18 11:07:42 -06:00
moli b6f3cb71e6
Add Missing AuthorizationRequestRepository in Snippet
Closes PR-13099
2023-05-18 10:54:19 -06:00
daisuzz 734dc98e50 Fix typo in authorization.adoc 2023-05-18 09:59:23 -06:00
Steve Riesenberg f54c344989
Move imports to code section
Issue gh-13089
2023-05-15 09:22:57 -05:00
Steve Riesenberg ab519a9667
Update What's New 2023-05-15 09:21:22 -05:00
Josh Cummings 66c792769b
Update What's New 2023-05-12 17:30:38 -06:00
Steve Riesenberg 491041dc60
Merge branch '6.0.x' 2023-05-12 15:44:33 -05:00
Steve Riesenberg e234f85b2f
Fix hard-coded link in remote build
Issue gh-13156
2023-05-12 15:43:14 -05:00
Steve Riesenberg 0c3bafb505
Fix hard-coded link in remote build
Issue gh-12675
2023-05-12 15:41:51 -05:00
Steve Riesenberg e96a5e9bd1
Merge branch '6.0.x'
Closes gh-13157
2023-05-12 13:54:56 -05:00
Steve Riesenberg 72d86f1cbc
Update links to 5.8 migration guide
Closes gh-13156
2023-05-12 13:46:54 -05:00
Steve Riesenberg 6a42d5c17b
Update link to 6.0 migration guide
Closes gh-12675
2023-05-12 13:43:02 -05:00
Steve Riesenberg e7fa34008b
Revisit CSRF page
Closes gh-13089
2023-05-12 12:29:32 -05:00
Josh Cummings 97a42ba190
Update SpEL Documentation
Closes gh-12974
2023-05-12 08:37:26 -06:00
Josh Cummings eea3b7734f
Address Antora Warnings 2023-05-10 15:57:25 -06:00
Josh Cummings 810e57686e
Merge branch '6.0.x' 2023-05-10 15:56:49 -06:00
Josh Cummings 1b4b91a35c
Merge branch '5.8.x' into 6.0.x 2023-05-10 15:56:18 -06:00
Josh Cummings b969179b5c
Merge branch '5.7.x' into 5.8.x 2023-05-10 15:53:22 -06:00
Josh Cummings 3469bcb822
Address Antora Warnings 2023-05-10 15:51:49 -06:00
Josh Cummings d194e2a725
Revisit Getting Started Page
Closes gh-12213
Closes gh-12551
2023-05-10 15:26:41 -06:00
1993heqiang 1631cac150 Fix typo cas.adoc 2023-05-03 11:26:04 -03:00
Marcus Da Coregio 9078730c5b Merge branch '6.0.x' 2023-05-03 11:13:38 -03:00
Glenn Adams dfbfa9199d X-XSS-Protection is now disabled 2023-05-03 11:13:08 -03:00
Marcus Da Coregio b6dcb29a11 Merge branch '5.8.x' into 6.0.x
Closes gh-13125
2023-05-02 16:08:48 -03:00
Marcus Da Coregio 6d37ca1808 Fix code snippets in Authorize HttpServletRequest
Closes gh-11522
2023-05-02 16:06:27 -03:00
Josh Cummings e5fcf1ebcf
Revisit Request and Method Security Docs
Issue gh-13088
2023-05-01 14:09:22 -06:00
Marcus Da Coregio 42cd19fcee Merge branch '6.0.x'
Closes gh-13103
2023-04-26 15:59:20 -03:00
Marcus Da Coregio 8c5f13657e Merge branch '5.8.x' into 6.0.x
Closes gh-13102
2023-04-26 15:58:25 -03:00
Marcus Da Coregio 5632469a90 Merge branch '5.7.x' into 5.8.x
Closes gh-13101
2023-04-26 15:57:32 -03:00
Marcus Da Coregio e61adcb0cd Clarify that Kotlin DSL needs an import
Closes gh-13092
2023-04-26 15:56:47 -03:00
Marcus Da Coregio 8481374ce7 Explain the rational about deprecating .and() and non-lambda DSL methods
Closes gh-13094
2023-04-26 14:49:57 -03:00
Nikita Eshkeev bb402a706f Update acls.adoc
Fix the spring security samples link
2023-04-24 16:38:24 -06:00
Nikita Eshkeev 9edbac7233 Update architecture.adoc
`RoleHierarchy` doesn't have the `setHierarchy` method, so the snippet doesn't work as is. The method is declared inside `RoleHierarchyImpl`
2023-04-24 16:37:47 -06:00
Josh Cummings 9244989b2e
Fix allOf/anyOf Abstain Logic
Closes gh-13069
2023-04-24 15:36:17 -06:00
Marcus Da Coregio e57e8b3722 Merge branch '6.0.x' 2023-04-19 11:31:47 -03:00
Marcus Da Coregio e3cc8d13e8 Merge branch '5.8.x' into 6.0.x 2023-04-19 11:29:49 -03:00
Marcus Da Coregio 744b74f4c9 Merge branch '5.7.x' into 5.8.x 2023-04-19 11:27:08 -03:00
SeasonPan 556ae316ba fix typo of modules.adoc 2023-04-19 11:25:55 -03:00
Josh Cummings 33b266e8fa
Add Boot Link
Issue gh-13062
2023-04-18 11:33:48 -06:00
Josh Cummings 3f6f01ce20
Add Spring MVC Links
Issue gh-13062
2023-04-18 11:23:57 -06:00
Josh Cummings 62fec2f969
Revisit Logout Docs
Closes gh-13062
2023-04-17 16:58:43 -06:00
Marcus Da Coregio 04b3d07319 Merge branch '6.0.x' 2023-04-17 07:30:54 -03:00
Marcus Da Coregio a484044591 Merge branch '5.8.x' into 6.0.x 2023-04-17 07:29:42 -03:00
Marcus Da Coregio 6cf8c53aaa Merge branch '5.7.x' into 5.8.x 2023-04-17 07:16:47 -03:00
Marcus Da Coregio 2d52fb8e4b Clear Repository on Logout 2023-04-17 06:47:57 -03:00
Marcus Da Coregio 2b05d5dece Document in the reference how to migrate to lambda
Closes gh-12628
2023-04-14 15:50:58 -03:00
Josh Cummings 76eba9bd0c
Add withIssuerLocation
Closes gh-10309
2023-04-12 16:36:15 -06:00
Marcus Da Coregio 5db3e54647 Merge branch '6.0.x'
Closes gh-12993
2023-04-11 09:58:20 -03:00
Marcus Da Coregio 34015944f2 Merge branch '5.8.x' into 6.0.x
Closes gh-12992
2023-04-11 09:57:52 -03:00
Marcus Da Coregio 68fd755abc Merge branch '5.7.x' into 5.8.x
Closes gh-12991
2023-04-11 09:57:15 -03:00
Marcus Da Coregio e25117856e Add static imports to code snippets
Closes gh-6597
2023-04-11 09:56:19 -03:00
Rob Winch fb3ed7288c Merge branch '6.0.x'
Closes gh-12981
2023-04-10 11:15:33 -05:00
1993heqiang 54de5c9537 Fix documentation code block bug.
Closes gh-12980
2023-04-10 11:11:10 -05:00
Brummolix a513fc0f38 Fix SecurityWebApplicationInitializer.getSecurityDispatcherTypes example in doc #12939 2023-03-30 09:38:17 -03:00
Marcus Da Coregio ff4e926111 Merge branch '6.0.x'
Closes gh-12942
2023-03-28 15:23:51 -03:00
Marcus Da Coregio b4b4cd0ffa Merge branch '5.8.x' into 6.0.x
Closes gh-12941
2023-03-28 15:23:21 -03:00
Marcus Da Coregio eb58655fa9 Improve Docs by mentioning that Empty SecurityContext should be saved
Closes gh-12906
2023-03-28 15:21:30 -03:00
Josh Cummings dfdadc90cf
Merge branch '6.0.x'
Closes gh-12933
2023-03-27 14:43:00 -06:00
Josh Cummings 834e361898
Merge branch '5.8.x' into 6.0.x
Closes gh-12932
2023-03-27 14:41:07 -06:00
Josh Cummings 6bda1d2bf3
Document WebExpressionAuthorizationManager
Closes gh-12928
2023-03-27 14:38:09 -06:00
Marcus Da Coregio 13f707a6d5 Merge branch '6.0.x' 2023-03-22 10:34:19 -03:00
Marcus Da Coregio 9ec9e77c6b Merge branch '5.8.x' into 6.0.x 2023-03-22 10:34:02 -03:00
slauth a708007536 fix ID of WebSocket Authorization section
Throughout this document there are 3 references to `<<websocket-authorization>>` but the section ID was actually named `[[websocket-configuration]]`
2023-03-22 10:33:10 -03:00
Marcus Da Coregio 57e134cc5f Merge branch '6.0.x' 2023-03-22 10:12:28 -03:00
Jesper Rønn-Jensen ed42dc4a09 chore: typo, removed extra "s" in word implementationss 2023-03-22 10:11:16 -03:00
Gabriel Maciel 2fa1bbc9d1 Fix typo architecture.adoc 2023-03-22 10:10:28 -03:00
Marcus Da Coregio 1730efd130 Merge branch '6.0.x' 2023-03-22 09:22:12 -03:00
Marcus Da Coregio 8a2b96795e Merge branch '5.8.x' into 6.0.x 2023-03-22 09:21:50 -03:00
Bishakh Ghosh c75ee25a6d Fix documentation code block bug
Fixes #12850
2023-03-22 09:21:09 -03:00
Josh Cummings 6f5172d388
Merge branch '6.0.x' 2023-03-20 16:18:45 -06:00
zks cfeb1ce303
Fix docs typo 2023-03-20 16:18:10 -06:00
Josh Cummings 2b6a2c22db
Merge branch '6.0.x' 2023-03-20 15:24:45 -06:00
Josh Cummings b22dd9a3e9
Merge branch '5.8.x' into 6.0.x 2023-03-20 15:24:19 -06:00
el-hopaness-romtic 4154ed543a
Fix .access(...) parameter 2023-03-20 15:23:40 -06:00
Logan Kulinski 8ad91287d9 Fix Broken Link
Closes gh-12824
2023-03-20 15:13:10 -06:00
Josh Cummings 3ad6c6ce06 Use EntityId-lookup Components
Closes gh-12880
2023-03-17 18:00:02 -06:00
Josh Cummings dbdf04f151 SAML Response Reads EntityId
Closes gh-10243
2023-03-17 18:00:02 -06:00
Josh Cummings 3f2816f745 Logout Request Reads EntityId
Closes gh-12843
Closes gh-12845
2023-03-17 18:00:02 -06:00
Josh Cummings 46452c0cae Add saml2Metadata
Closes gh-11828
2023-03-17 18:00:02 -06:00
Josh Cummings ac1d269e73
Merge branch '6.0.x'
Closes gh-12839
2023-03-07 11:53:01 -07:00
rai-sandeep ffe029d5bd Fix broken links in form login section
Closes gh-12822
2023-03-07 11:52:19 -07:00
Wyfrel 3b447b938c fix missing semi-colon java example in observability documentation 2023-03-03 15:04:16 -07:00
hdeadman e0284a4503 Fix CAS packages for 4.0.1 and Jasig references
Issue gh-11674
2023-03-01 17:21:24 -03:00
hdeadman b4d3ac6665 Revert "Remove CAS module"
This reverts commit caf4c471
2023-03-01 17:21:23 -03:00
Steve Riesenberg 7c89bd8c90
Merge branch '6.0.x'
Closes gh-12809
2023-02-28 17:28:37 -06:00
Qie 8b2ce79341
Correct deprecated description in docs
Remove deprecated SecurityContextPersistenceFilter from docs.

Closes gh-12690
2023-02-28 17:01:47 -06:00
Josh Cummings 41fadaecd3
Merge branch '6.0.x'
Closes gh-12800
2023-02-28 13:08:47 -07:00
Josh Cummings e28ea6dbad
Preserve OpenSamlAssertingPartyDetails Instance
Closes gh-12667
2023-02-28 13:08:13 -07:00
Josh Cummings aedabf5504
Merge branch '6.0.x' 2023-02-28 12:49:33 -07:00
Josh Cummings ddad623abf
Merge branch '5.8.x' into 6.0.x 2023-02-28 12:49:04 -07:00
Josh Cummings 383e0c2cf0
Merge branch '5.7.x' into 5.8.x 2023-02-28 12:47:06 -07:00
Josh Cummings 0421e25cba
Document Common SAML URI Endpoints
Issue gh-12764
2023-02-28 12:45:48 -07:00
Josh Cummings 1c885cf3a3
Document Federation Usecase
Closes gh-12764
2023-02-28 12:35:04 -07:00
Josh Cummings be2958ed13
Merge branch '6.0.x'
Closes gh-12784
2023-02-24 13:51:34 -07:00
Josh Cummings 109f6e7028
Add Note about RoleHierarchy
Closes gh-12766
2023-02-24 13:43:43 -07:00
Josh Cummings eac1f846b3
Update RoleHierarchy Docs
Closes gh-12766
2023-02-24 12:00:35 -07:00
Josh Cummings 35cf52d3bd
Add DefaultMethodSecurityExpressionHandler
Closes gh-12356
2023-02-21 16:58:08 -07:00
Josh Cummings 6bf11181ef
Adjust AfterInvocationManager Migration Docs
The original documentation only addresses the post-authorize case.
Some implementations want also to modify the return type.

Issue gh-12620
2023-02-21 15:07:17 -07:00
Steve Riesenberg 82642dc9ba
Merge branch '6.0.x'
Closes gh-12730
2023-02-17 15:52:43 -06:00
Byeonggon Lee f2c4656abd
Fix typo in form.adoc
Closes gh-12678
2023-02-17 15:52:26 -06:00
Josh Cummings a1b282ff03
Merge branch '5.7.x' into 5.8.x
Closes gh-12693
2023-02-17 10:09:32 -07:00
Josh Cummings 2db4430dcd Preserve OpenSamlAssertingPartyDetails Instance
Closes gh-12667
2023-02-17 10:02:17 -07:00
Steve Riesenberg 5286b78308
Merge branch '6.0.x'
Closes gh-12684
2023-02-16 13:27:17 -06:00
Steve Riesenberg c4f68d83bf
Document default CsrfTokenRequestHandler in 6.0
Closes gh-12651
2023-02-16 13:26:23 -06:00
Marcus Da Coregio 4bb944e7e5 Merge branch '6.0.x' 2023-02-16 10:58:02 -03:00
Marcus Da Coregio 5ccf414f02 Merge branch '5.8.x' into 6.0.x 2023-02-16 10:57:33 -03:00
Marcus Da Coregio 82c86b822f Polish session-management.adoc
Remove unresolved anchor

Issue gh-12519
2023-02-16 10:57:02 -03:00
Marcus Da Coregio 78c70d8c9b Merge branch '6.0.x' 2023-02-16 10:53:27 -03:00
Marcus Da Coregio e59f71f036 Polish session-management.adoc
Remove default values from configuration

Issue gh-12519
2023-02-16 10:52:55 -03:00
Marcus Da Coregio 5d8df25b10 Merge branch '6.0.x'
Closes gh-12681
2023-02-16 10:44:12 -03:00
Marcus Da Coregio ce222de7e6 Merge branch '5.8.x' into 6.0.x
Closes gh-12680
2023-02-16 10:42:56 -03:00
Marcus Da Coregio 4f3faa78f7 Revisit Session Management docs
Closes gh-12519
2023-02-16 10:39:59 -03:00
Steve Riesenberg b0fcc1f0fa
Merge branch '6.0.x' 2023-02-15 17:20:48 -06:00
Steve Riesenberg 2876605324
Polish migration doc
Issue gh-12675
2023-02-15 17:18:09 -06:00
Steve Riesenberg bf2951b5af
Add sections for migrating exploit protection in 6.0
Issue gh-12462
2023-02-15 17:18:09 -06:00
Steve Riesenberg ca1961d35e
Link to the latest 6.0.x release
Issue gh-12675
2023-02-15 17:01:28 -06:00
Steve Riesenberg 821db0a1ea
Polish migration doc
Issue gh-12675
2023-02-15 17:00:49 -06:00
Tao Sun 6f5c633241
Fix typo in Authentication Migrations page 2023-02-15 15:14:09 -07:00
Tao Sun 26fc15a8b3 Fix typo in Authentication Migrations page 2023-02-15 15:13:41 -07:00
Steve Riesenberg 45b81b194b
Expand migration docs regarding CSRF
Closes gh-12462
2023-02-15 14:53:28 -06:00
Josh Cummings c4485a8909
Merge branch '6.0.x' 2023-02-07 14:15:26 -07:00
Dmitriy Grushin 2b36499700 Update expression-based.adoc
Removed a duplicate paragraph that was phrased a bit differently.
2023-02-07 13:00:59 -07:00
Pavel Anisimov 53a273ed54 Fix image in servlet architecture docs section 2023-02-07 12:57:36 -07:00
Steve Riesenberg 6abbdd3654
Merge branch '6.0.x' 2023-01-26 15:55:41 -06:00
Steve Riesenberg 179428f7da
Add section for migrating WebSocket support
Issue gh-12378
2023-01-26 15:45:09 -06:00
Steve Riesenberg 33e72b35f9
Add section for migrating WebSocket support
Issue gh-12378
2023-01-23 16:00:36 -06:00
Dan Allen c47fbf7cfd move code comment to callout 2023-01-18 14:41:57 -06:00
Rob Winch 5beabbe357 Merge branch '5.7.x' into 5.8.x
Closes gh-12553
2023-01-17 15:03:14 -06:00
Dan Allen f5bc6ce665 fix unclosed block in docs 2023-01-17 15:02:30 -06:00
Josh Cummings 7456c47568
Merge branch '6.0.x'
Closes gh-12528
2023-01-11 12:48:48 -07:00
Josh Cummings e0697de7b2
Merge branch '5.8.x' into 6.0.x
Closes gh-12527
2023-01-11 12:48:27 -07:00
Josh Cummings 090c5f96ce
Merge branch '5.7.x' into 5.8.x
Closes gh-12526
2023-01-11 12:47:55 -07:00
Josh Cummings f41b77a4db
Fix Diagram to Say SecurityContextHolderFilter
Closes gh-11800
2023-01-11 12:47:07 -07:00
Josh Cummings ce11015e53
Merge branch '6.0.x'
Closes gh-12518
2023-01-10 10:44:21 -07:00
Josh Cummings 21ceb333a8
Merge branch '5.8.x' into 6.0.x
Closes gh-12517
2023-01-10 10:43:25 -07:00
Josh Cummings 6f43104eb3
Merge branch '5.7.x' into 5.8.x
Closes gh-12516
2023-01-10 10:42:45 -07:00
Josh Cummings 2028507bf8
Fix Typo in Sample
Closes gh-11095
2023-01-10 10:38:28 -07:00
Josh Cummings 88a8ef647b
Add Details about @Configuration
Closes gh-12486
2023-01-06 13:56:56 -07:00
Junichi Sakaeda 930cc68768
Duplicate words. 2023-01-05 10:36:17 -07:00
Junichi Sakaeda 393365232b Duplicate words. 2023-01-05 10:35:28 -07:00
Josh Cummings cb18e34b76
Merge branch '6.0.x' 2023-01-05 10:33:38 -07:00
Olivier Délèze 9535566f84 Update multitenancy.adoc
The Java example at line 421 should use the injected `jwtValidator` and not from the current class referenced by `this. jwtValidator`.
2023-01-05 10:32:57 -07:00
Joe Grandja e139f1c2ba Polish gh-12438 2022-12-22 11:16:19 -05:00
Marcus Da Coregio 892bbcfe0f Add EnableWebFluxSecurity migration step
Closes gh-12434
2022-12-21 10:24:25 -03:00
Marcus Da Coregio 73c12f9aa8 Merge branch '6.0.x' 2022-12-19 16:53:35 -03:00
Marcus Da Coregio b9f9139f5e Merge branch '5.8.x' into 6.0.x 2022-12-19 16:53:22 -03:00
Marcus Da Coregio 5406fed5dc Merge branch '5.7.x' into 5.8.x 2022-12-19 16:53:05 -03:00
Eleftheria Stein-Kousathana fbfa13bd47 Fix OAuth 2.0 testing docs 2022-12-19 16:52:25 -03:00
Steve Riesenberg 00019c1fb9
Merge branch '6.0.x'
Closes gh-12406
2022-12-15 14:41:27 -06:00
Steve Riesenberg ed657a8fac
Polish gh-12280
Apply editing changes from gh-9668
2022-12-15 14:18:24 -06:00
Wilson-Emmanuel edd1915d1b
Corrected errors on the ACLS document
Closes gh-12270
2022-12-15 14:16:55 -06:00
Marcus Da Coregio 88d50a531b Add EnableWebSecurity migration steps to 5.8 guide
Closes gh-12334
2022-12-07 10:22:54 -08:00
Marcus Da Coregio 0fdcde2d6f Merge branch '6.0.x' 2022-12-05 14:42:42 -08:00
Marcus Da Coregio 2fdf762726 Merge branch '5.8.x' into 6.0.x 2022-12-05 14:41:59 -08:00
Marcus Da Coregio 7aaa25b88e Merge branch '5.7.x' into 5.8.x 2022-12-05 14:40:54 -08:00
Marcus Da Coregio fc25b87967 Merge branch '5.6.x' into 5.7.x 2022-12-05 14:40:38 -08:00
Sellami 626e53d121 Fix: Replace tenantRepository with tenants 2022-12-05 14:31:24 -08:00
Marcus Da Coregio 7439d5d2de Revert "Fix typo"
This reverts commit 707f8286f8.
2022-12-05 14:13:14 -08:00
heowc 707f8286f8 Fix typo 2022-12-05 14:09:41 -08:00
Marcus Da Coregio 547a1a11d1 Merge branch '6.0.x'
Closes gh-12342
2022-12-05 12:26:39 -08:00
Marcus Da Coregio 42a00e2003 Merge branch '5.8.x' into 6.0.x
Closes gh-12341
2022-12-05 12:26:00 -08:00
Marcus Da Coregio d2b33a2583 Fix docs
Closes gh-11396
2022-12-05 12:25:26 -08:00
Michael Schneider 74e8fa10a2 Fix password encoder migration guide 2022-12-02 14:12:47 -07:00
Josh Cummings eb57d9e5c1
Merge branch '6.0.x' 2022-11-29 16:26:13 -07:00
Josh Cummings c60c10792c
Fix Observability Opt-out Documentation Typo
Issue gh-12268
2022-11-29 16:24:57 -07:00
Marcus Da Coregio e6173f9e5b Prepare for Spring Security 6.1 2022-11-28 15:47:10 -03:00
Marc Becker 50da5b6498 Fix securityMatchers code sample
Closes gh-12296
2022-11-25 10:18:40 -03:00
Marcus Da Coregio 3e0e532ed7 Merge branch '5.8.x' into 6.0.x
Closes gh-12287
2022-11-24 08:48:27 -03:00
Marcus Da Coregio 5db7ac4ce3 Merge branch '5.7.x' into 5.8.x
Closes gh-12286
2022-11-24 08:48:05 -03:00
Marcus Da Coregio 9b3f834bff Merge branch '5.6.x' into 5.7.x
Closes gh-12285
2022-11-24 08:47:46 -03:00
Marcus Da Coregio 70bfc39418 Fix AuthorizationFilter diagram in docs
Closes gh-12274
2022-11-24 08:46:16 -03:00
Josh Cummings 01117b11fe
Polish Kotlin snippet
- to match the comments in the related Java snippet

Issue gh-11959
2022-11-20 12:28:45 -07:00
Josh Cummings 7804e3283b
Fix Migration 6.0 Link
Issue gh-12242
2022-11-20 12:26:42 -07:00
Steve Riesenberg e60eb87441
Fix additional typos
Issue gh-11959
2022-11-19 23:22:29 -06:00
Steve Riesenberg 3d2be56249
Fix reference to CookieServerCsrfTokenRepository
Issue gh-11959
2022-11-19 23:12:59 -06:00
Steve Riesenberg 4442a618ea
Add reactive opt out steps for CSRF BREACH
Issue gh-11959
2022-11-19 23:00:38 -06:00
Steve Riesenberg 4994e67eda
Add servlet opt out steps for CSRF BREACH
Issue gh-12107
2022-11-19 22:11:18 -06:00
Josh Cummings 3f5d8b39ce
Restructure Migration Guide
Closes gh-12242
2022-11-18 16:57:32 -07:00
Steve Riesenberg 34102a6531
Document default SecurityContextRepository
Issue gh-12049
2022-11-18 16:14:22 -06:00
Marcus Da Coregio 1919b4e38b Migration guide for CAS support removal
Issue gh-12163
2022-11-18 15:35:39 -03:00
Josh Cummings f17f9f98bd
Fix Broken Link
Issue gh-12224
2022-11-18 10:06:16 -07:00
Josh Cummings f6fb138363
Change to Preparation Guide 2022-11-18 10:04:20 -07:00
Steve Riesenberg a61fffc209
Document reactive support for CSRF BREACH
Issue gh-11959
2022-11-17 09:33:13 -06:00
Steve Riesenberg 3cb2b0606e
Document deprecation of tokenFromMultipartDataEnabled
Issue gh-12020
2022-11-17 09:33:13 -06:00
Josh Cummings 17123a3b0f
Polish JwtAuthenticationConverter Preparation Steps
Issue gh-12022
2022-11-16 12:00:10 -07:00
Josh Cummings 63aec87c61
Use Imperative in Headers
Issue gh-12224
2022-11-16 11:58:25 -07:00
Josh Cummings 7675874137
Restructure Migration Steps
CLoses gh-12224
2022-11-16 11:35:47 -07:00
Marcus Da Coregio 063f06e7bf Register FilterChainProxy for all dispatcher types
Closes gh-12180
2022-11-16 09:55:21 -03:00
Steve Riesenberg 754fe7f457
Document deprecations in oauth2 modules
* oauth2-client
* oauth2-resource-server

Issue gh-12022
2022-11-15 14:06:34 -06:00
Marcus Da Coregio 9bc38ed318 Register FilterChainProxy for All Dispatcher Types Migration Steps
Closes gh-12186
2022-11-15 11:55:03 -07:00
Josh Cummings f3d704a27d
Add PasswordEncoder Preparation Steps
Issue gh-10506
2022-11-14 15:25:49 -07:00
Josh Cummings 60e573de26
Add WebSecurityConfigurerAdapter Preparation Steps
Issue gh-10902
2022-11-14 10:53:13 -07:00
Steve Riesenberg 4ec10a2bca
Document new oauth2Login() authority defaults
Issue gh-11887
2022-11-14 10:37:02 -06:00
Steve Riesenberg 03b407a49a
Polish migration doc
Issue gh-12023
2022-11-14 10:27:19 -06:00
Steve Riesenberg 2a6123a456
Document new oauth2Login() authority defaults
Issue gh-11887
2022-11-14 09:39:37 -06:00
Marcus Da Coregio 001452d249 Document CAS support removal
Closes gh-12163
2022-11-11 13:29:52 -03:00
Rob Winch 1a6a295a07 Document Update to 5.8 in Migration
Closes gh-12196
2022-11-10 21:45:41 -06:00
Rob Winch ef8c4d85bc Document Configure Default SessionAuthenticationStrategy
Closes gh-12192
2022-11-10 14:11:10 -06:00
Steve Riesenberg 7b28df8ebe
Document deprecation in SecurityContextRepository
Issue gh-12023
2022-11-09 14:49:45 -06:00
Steve Riesenberg 63cf954e07
Document SecurityContextRepository default
Closes gh-12049
2022-11-09 14:49:15 -06:00
Steve Riesenberg aefc157953
Add important note for SecurityContextRepository
Issue gh-12049
2022-11-09 14:47:50 -06:00
Steve Riesenberg 1a3be83084
Merge branch '5.8.x'
Closes gh-12185
2022-11-09 12:28:37 -06:00
Steve Riesenberg ea8fb1f159
Document SecurityContextRepository default
Issue gh-12049
2022-11-09 12:19:44 -06:00
Steve Riesenberg 2e41e1cbac
Document deprecation in SecurityContextRepository
Issue gh-12023
2022-11-09 12:19:44 -06:00
Steve Riesenberg 9071f10759
Document DelegatingSecurityContextRepository
Closes gh-12069
2022-11-09 12:19:43 -06:00
Josh Cummings 3366792d3b
Adjust SAML What's New
Issue gh-11077
2022-11-08 14:15:38 -07:00
Josh Cummings 079bb45d94
Add Encryptors Preparation Steps
Issue gh-8980
2022-11-08 14:13:44 -07:00
Johannes Graf 8af3b5afe4 Fix documentation part of Multiple HttpSecurity Instances
`http.antMatcher()` is not longer available and was replaced with
`http.securityMatcher()`, so use this in the Java Config Multiple
HttpSecurity Instances example, too
2022-11-08 13:51:05 -03:00
Marcus Da Coregio 1103e68fc9 Polish Use new requestMatchers method migration
Issue gh-12100
2022-11-08 10:31:49 -03:00
Marcus Da Coregio 89423b38b6 Add requestMatchers and securityMatchers migration steps
Issue gh-12100
2022-11-08 08:31:03 -03:00
Marcus Da Coregio 693bfb66b2 Document how to use the new requestMatchers and securityMatchers
Closes gh-12100
2022-11-08 08:27:31 -03:00
Josh Cummings 6043cee699
Add OpenSaml4AuthenticationProvider Preparation Steps
Issue gh-11077
2022-11-07 17:40:19 -07:00
Josh Cummings 095faffd70
Add RelyingPartyRegistration Preparation Steps
Issue gh-11077
2022-11-07 13:37:44 -07:00
Josh Cummings 33ce3b59b8
Add Saml2AuthenticationToken Preparation Steps
Issue gh-11077
2022-11-03 13:57:54 -06:00
Josh Cummings 2f87309cda
Fix Typo
Closes gh-11077
2022-11-03 13:37:13 -06:00
Marcus Da Coregio c7b9b33cd1 Merge branch '5.8.x' 2022-11-03 08:23:50 -03:00
Marcus Da Coregio 4d646a2978 Merge branch '5.7.x' into 5.8.x 2022-11-03 08:23:26 -03:00
Marcus Da Coregio 067fc1678c Merge branch '5.6.x' into 5.7.x 2022-11-03 08:22:09 -03:00
Rivaldi 01a37dd678 Fix typo
(cherry picked from commit 20e89e3eca0823bfa329b5de80448bac1f5e0f30)
2022-11-03 08:21:48 -03:00
Márk Kővári aad01447c3 docs: fix realm typo 2022-11-03 08:21:26 -03:00
Josh Cummings bb43293469
Expand SAML Deprecations What's New
Issue gh-11077
2022-11-02 18:03:13 -06:00
Josh Cummings 5760b6dedf
Add AuthenticationServiceException Reactive Migration Steps
Issue gh-9429
Issue gh-12132
2022-11-02 18:02:53 -06:00
Josh Cummings 953c9294d0
Initial SAML Deprecation Preparation Steps
- Stop using Converter constructors
- Replace Saml2AuthenticationRequestContextResolver and
Saml2AuthenticationRequestFactory with
Saml2AuthenticationRequestResolver

Issue gh-11077
2022-11-02 18:01:03 -06:00
Josh Cummings ba8f344ccb
Add AuthenticationServiceException Reactive Preparation Steps
Issue gh-9429
Issue gh-12132
2022-11-02 15:48:04 -06:00
Josh Cummings cca999c57d
Merge remote-tracking branch 'origin/5.8.x' 2022-11-01 13:46:08 -06:00
Josh Cummings d29ab8bcae
Merge branch '5.7.x' into 5.8.x 2022-11-01 13:43:40 -06:00
Josh Cummings c94e33b6c8
Merge branch '5.6.x' into 5.7.x 2022-11-01 13:42:35 -06:00
Marcus Da Coregio 63fb14f8c8 Add Remember Me SHA-256 migration steps
Issue gh-12097
2022-11-01 15:42:21 -03:00
Ger Roza 8315545144 Update RP-Initiated Logout target URLs.
The URLs we're using are not actually pointing to the OIDC RP-Initiated Logout Specs.

Fixes: gh-12081
2022-11-01 12:35:39 -06:00
Marcus Da Coregio 990ee8b8a5 Merge branch '5.8.x'
Closes gh-12119
2022-11-01 15:35:12 -03:00
Marcus Da Coregio 7cbb9e82f9 Document how to opt-in for SHA256 in RememberMe
Closes gh-12097
2022-11-01 15:33:45 -03:00
Josh Cummings 2a2f7a197c
Add AuthenticationEntryPointFailureHandler Migration Steps
Issue gh-9429
2022-10-31 16:40:21 -06:00
Josh Cummings 39f4fcd5f2
Add AuthenticationEntryPointFailureHandler Preparation Steps
Issue gh-9429
2022-10-31 16:33:25 -06:00
Josh Cummings ac7f726a24
Add RunAsManager Preparation Steps
Closes gh-11337
2022-10-31 15:46:19 -06:00
Josh Cummings c5badbc631
Add AccessDecisionManager Preparation Steps
Issue gh-11337
2022-10-31 15:25:05 -06:00
Josh Cummings 86c9d5cfbe
Remove Stray Horizontal Rules
Issue gh-11337
2022-10-31 15:24:59 -06:00
Rob Winch 4112adf6a0 Document Configure Default CsrfTOken BREACH Protection
Closes gh-12107
2022-10-28 15:57:25 -05:00
Rob Winch 96d7c78b67 Polish Document Defer load CsrfToken
Issue gh-12105
2022-10-28 15:51:28 -05:00
Rob Winch d860775b45 Document Defer load CsrfToken
Closes gh-12105
2022-10-28 15:41:25 -05:00
Josh Cummings 4938c394e4
Move Opt-out Steps
Closes gh-12104
2022-10-28 13:52:02 -06:00
Josh Cummings 4f5372a3a7
Add Request Security Migration Steps
Issue gh-11337
2022-10-28 12:25:44 -06:00
Josh Cummings 8da916fa1c
Add Request Security Preparation Steps
Issue gh-11337
2022-10-28 11:48:21 -06:00
Josh Cummings 56482e25de
Polish Method Security Migration Steps
- Revert steps removed since implicitly included in preparation guide

Issue gh-11337
2022-10-28 09:51:02 -06:00
Josh Cummings e900ca3a86
Polish Method Security Preparation Steps
- Add instruction to declare 5.8 defaults

Issue gh-11337
2022-10-28 09:46:48 -06:00
Josh Cummings b4974bbce9
Polish Message Security Preparation Steps
- Added step to declare the 5.8 default in case later preparation steps
cannot be taken yet

Issue gh-11337
2022-10-28 09:26:04 -06:00
Josh Cummings f2fc2f9a2b
Add Message Security Cleanup Steps
Issue gh-11337
2022-10-28 09:17:58 -06:00
Josh Cummings 31a1486b88
Add Message Security Preparation Steps
Issue gh-11337
2022-10-27 20:08:13 -06:00
Rob Winch 855d6b6326 Merge branch '5.8.x' 2022-10-27 15:39:23 -05:00
Rob Winch 3da0d1bf27 Merge branch '5.8.x' 2022-10-27 15:39:03 -05:00
Rob Winch 5721b0351e Polish RequestCache continue Kolin Configuration
Issue gh-12089
2022-10-27 15:13:50 -05:00
Rob Winch aac1261f0c Document Migration to SecurityContextHolderFilter
Closes gh-12098
2022-10-27 15:12:45 -05:00
Josh Cummings 1dd13e69a4
Standardize Preparation Guide Layout
Closes gh-12096
2022-10-27 10:34:20 -06:00
Josh Cummings cc8a93e5ec
Restore Missing Links to Migration Guide 2022-10-26 16:19:44 -06:00
Josh Cummings f29d1da0a5
Add Link to 5.8 Preparation Guide
Closes gh-12093
2022-10-26 16:19:31 -06:00
Josh Cummings 2a95a24390
Add Link to 6.0 Migration Guide
Issue gh-12093
2022-10-26 16:15:36 -06:00
Rob Winch d40ed58118 Merge branch '5.8.x'
Closes gh-12091
Closes gh-12092
2022-10-26 14:56:02 -05:00
Josh Cummings 2b50aa3ae0
Polish Method Security Migration Steps
Removed checkboxes when there is only one step
2022-10-26 13:47:16 -06:00
Rob Winch 24cc7ff178 Document Saved Requests Migration
Closes gh-12089
2022-10-26 14:24:00 -05:00
Rob Winch c17e258a6f Document Saved Requests
Closes gh-12088
2022-10-26 14:22:30 -05:00
Josh Cummings d076ddb26c
Polish Method Security Migration Steps 2022-10-26 13:18:07 -06:00
Josh Cummings f6731e89db
Polish Method Security Preparation Steps 2022-10-26 12:37:54 -06:00
Josh Cummings 4528561326
Add Method Security Migration Steps 2022-10-25 15:04:59 -06:00
Josh Cummings 7adc000c6b
Merge remote-tracking branch 'origin/5.8.x' 2022-10-25 14:42:32 -06:00
Josh Cummings 04fa5af794
Add Missing Doc Header
The EnableMethodSecurity section
2022-10-25 14:41:11 -06:00
Josh Cummings e505bc3af4
Add Method Security Preparation Steps 2022-10-25 14:41:10 -06:00
Josh Cummings 4ba8f8bfe0
Update What's New
Closes gh-12024
2022-10-13 20:08:31 -06:00
Josh Cummings f4cc27c375
Change Default for (Server)AuthenticationEntryPointFailureHandler
Closes gh-9429
2022-10-13 20:03:03 -06:00
Steve Riesenberg d6356415f9
Polish whats-new.adoc 2022-10-13 13:42:04 -05:00
Steve Riesenberg 74e0616451
Update What's New for 6.0 2022-10-13 13:42:04 -05:00
Steve Riesenberg 5a55987d6e
Add links to reference in What's New for 5.8
Issue gh-4001
Issue gh-11959
2022-10-13 12:52:01 -05:00
Josh Cummings 59c4538798
Update What's New
Closes gh-12021
2022-10-13 10:13:20 -06:00
Josh Cummings fe96a62dfc
Document Observability Support
Issue gh-10964
2022-10-12 20:32:25 -06:00
Joe Grandja bf1e622751 Update What's New in 6.0 for PasswordEncoders
Issue gh-11985
2022-10-12 08:27:46 -04:00
Joe Grandja 716aa6df5c Merge branch '5.8.x' 2022-10-12 07:43:26 -04:00
Joe Grandja ffbcaca24a Update reference for PasswordEncoders
Issue gh-10506
2022-10-12 07:32:30 -04:00
Marcus Da Coregio c5e35bf32e Merge branch '5.8.x'
Closes gh-11978
2022-10-10 09:24:50 -03:00
Marcus Da Coregio 4b6fed0667 Add static factory method to AntPathRequestMather and RegexRequestMatcher
Closes gh-11938
2022-10-10 09:24:15 -03:00
Daniel Garnier-Moiroux 27059ced87
Default X-Xss-Protection header value to "0"
Closes gh-9631
2022-10-07 17:42:55 -05:00
Steve Riesenberg 6753f9745e
Merge branch '5.8.x'
# Conflicts:
#	config/src/test/kotlin/org/springframework/security/config/web/server/ServerCsrfDslTests.kt
#	docs/modules/ROOT/pages/reactive/exploits/csrf.adoc
2022-10-07 17:29:07 -05:00
Steve Riesenberg f462134e87
Add reactive support for BREACH
Closes gh-11959
2022-10-07 16:34:17 -05:00
Marcus Da Coregio 398f5dee7f Remove deprecated RequestMatcher methods from Java Configuration
Closes gh-11939
2022-10-07 15:26:46 -03:00
Marcus Da Coregio 9fd195d419 Default to shouldFilterAllDispatcherTypes=true in XML
Closes gh-11970
2022-10-07 11:46:20 -03:00
Marcus Da Coregio 146d3269bc Merge branch '5.8.x'
Closes gh-11971
2022-10-07 10:28:14 -03:00
Marcus Da Coregio f3321c256c Add XML support for shouldFilterAllDispatcherTypes
Closes gh-11492
2022-10-07 10:20:32 -03:00
Josh Cummings 12b9f2e196
use-authorization-manager defaults to true
Closes gh-11929
2022-10-06 08:12:46 -06:00
Marcus Da Coregio c4d23f2b49 Use MvcRequestMatcher by default if Spring MVC is present
Closes gh-11899
2022-10-06 09:12:04 -03:00
Steve Riesenberg 8b490de08d
Merge branch '5.8.x'
# Conflicts:
#	docs/modules/ROOT/pages/servlet/exploits/csrf.adoc
2022-10-05 14:46:15 -05:00
Steve Riesenberg dce1c30522
Add support for BREACH
Closes gh-4001
2022-10-05 14:21:13 -05:00
Steve Riesenberg c1fcf275d9
Update What's New for 5.8
Issue gh-11952
2022-10-05 13:48:18 -05:00
Marcus Da Coregio 38a7bbd2eb Merge branch '5.8.x' 2022-10-05 13:20:12 -03:00
Marcus Da Coregio ace8caa182 Remove mvcMatchers usage from docs
Issue gh-11347
2022-10-05 13:19:37 -03:00
Marcus Da Coregio 35f7e46d05 Remove WebSecurityConfigurerAdapter
Closes gh-10902
2022-10-04 15:13:04 -03:00
Steve Riesenberg 5de6da890b
Merge branch '5.8.x'
Closes gh-dry-run
2022-10-04 11:18:00 -05:00
Steve Riesenberg 475b3bb6bb
Add deferred CsrfTokenRepository.loadDeferredToken
* Move DeferredCsrfToken to top-level and implement Supplier<CsrfToken>
* Move RepositoryDeferredCsrfToken to top-level and make package-private
* Add CsrfTokenRepository.loadToken(HttpServletRequest, HttpServletResponse)
* Update CsrfFilter
* Rename CsrfTokenRepositoryRequestHandler to CsrfTokenRequestAttributeHandler

Issue gh-11892
Closes gh-11918
2022-10-03 17:10:54 -05:00
Steve Riesenberg 7c3cc1e386
Merge branch '5.8.x' 2022-10-03 14:29:51 -05:00
Daniel Garnier-Moiroux 0e215a21ad
Add X-Xss-Protection headerValue to XML config
Issue gh-9631
2022-10-03 14:29:34 -05:00
Marcus Da Coregio ad2abd39dc Merge branch '5.8.x'
Closes gh-11347 in 6.0.x
Closes gh-11945
2022-10-03 16:02:18 -03:00
Marcus Da Coregio 039e0328e1 Simplify Java Configuration RequestMatcher Usage
If Spring MVC is present in the classpath, use MvcRequestMatcher by default. This commit also adds a new securityMatcher method in HttpSecurity

Closes gh-11347
Closes gh-9159
2022-10-03 15:55:20 -03:00
Daniel Garnier-Moiroux bf59d7c374
Update What's New for 5.8 2022-10-03 10:05:25 -05:00
Steve Riesenberg 43a1f8249c
Update What's New for 6.0 2022-09-29 15:57:48 -05:00
Steve Riesenberg 6c6aedf772
Update What's New for 6.0 2022-09-26 10:07:50 -05:00
Steve Riesenberg 181ee7410b
Change default authority for oauth2Login()
Previously, the default authority was ROLE_USER when using
oauth2Login() for both OAuth2 and OIDC providers.

* Default authority for OAuth2UserAuthority is now OAUTH2_USER
* Default authority for OidcUserAuthority is now OIDC_USER

Documentation has been updated to include this implementation detail.

Closes gh-7856
2022-09-26 10:06:31 -05:00
Steve Riesenberg c0e784b16d
Update What's New for 6.0 2022-09-26 09:48:52 -05:00
Steve Riesenberg bcb21c9384
Merge branch '5.8.x'
# Conflicts:
#	config/src/test/java/org/springframework/security/config/annotation/web/configuration/DeferHttpSessionJavaConfigTests.java
2022-09-23 15:39:43 -05:00
Steve Riesenberg 46696a9226
CsrfTokenRequestHandler extends CsrfTokenRequestResolver
Closes gh-11896
2022-09-23 15:09:00 -05:00
Rob Winch 0efe26c1fd Merge branch '5.8.x'
Closes gh-11894
2022-09-22 13:47:04 -05:00
Rob Winch d94677f87e CsrfTokenRequestAttributeHandler -> CsrfTokenRequestHandler
This renames CsrfTokenRequestAttributeHandler to CsrfTokenRequestHandler and
moves usage from CsrfFilter into CsrfTokenRequestHandler.

Closes gh-11892
2022-09-22 11:09:44 -05:00
Josh Cummings 70460ca009
Adjust OAuth2 Resource Server packaging
Closes gh-7349
2022-09-20 17:44:05 -06:00
Josh Cummings 61c80bcac5
Move Saml2 Authentication Filters
Closes gh-8819
2022-09-20 17:18:05 -06:00
Rob Winch 48e31f87e4 Remove Deprecated OpenSAML 3 Support
Closes gh-10556
2022-09-20 16:57:38 -06:00
Marcus Da Coregio 983ca6ea27 Update What's New for 5.8 2022-09-20 08:33:38 -03:00
Marcus Da Coregio 2b4a3a85f9 Update What's New for 6.0 2022-09-20 08:33:11 -03:00
Steve Riesenberg 8f44f74d44
Update What's New for 5.8 2022-09-14 15:13:41 -05:00
Steve Riesenberg 70eea8dc67
Update What's New for 5.8 2022-09-14 14:58:48 -05:00
Steve Riesenberg 2431dd1103
Merge branch '5.8.x' 2022-09-13 17:38:10 -05:00
Steve Riesenberg 355ef21117
Polish gh-11665 2022-09-13 16:45:39 -05:00
ch4mpy 1efb63387f
Add authentication converter for introspected tokens
Adds configurable authentication converter for resource-servers with
token introspection (something very similar to what
JwtAuthenticationConverter does for resource-servers with JWT decoder).

The new (Reactive)OpaqueTokenAuthenticationConverter is given
responsibility for converting successful token introspection result
into an Authentication instance (which is currently done by a private
methods of OpaqueTokenAuthenticationProvider and
OpaqueTokenReactiveAuthenticationManager).

The default (Reactive)OpaqueTokenAuthenticationConverter, behave the
same as current private convert(OAuth2AuthenticatedPrincipal principal,
String token) methods: map authorities from scope attribute and build a
BearerTokenAuthentication.

Closes gh-11661
2022-09-13 16:45:36 -05:00
Rob Winch 5ae492b1c1 Add What's New @WithMockUser Supported as Merged Annotation 2022-09-08 09:49:00 -05:00
Rob Winch d996c2a2c6 Remove unsafe/deprecated `Encryptors.querableText(CharSequence,CharSequence)`
This method is insecure. Users should instead encrypt with their database.

Closes gh-8980
2022-09-07 13:51:58 -05:00
Steve Riesenberg ed41a60aae
Merge branch '5.8.x'
# Conflicts:
#	config/src/test/java/org/springframework/security/config/annotation/web/configuration/DeferHttpSessionJavaConfigTests.java
#	config/src/test/resources/org/springframework/security/config/http/DeferHttpSessionTests-Explicit.xml
#	web/src/main/java/org/springframework/security/web/csrf/CsrfFilter.java
2022-09-06 11:51:55 -05:00
Steve Riesenberg 86fbb8db07 Add new interfaces for CSRF request processing
Issue gh-4001
Issue gh-11456
2022-09-06 11:43:33 -05:00
Marcus Da Coregio e17989d92d Merge branch '5.8.x' 2022-09-01 09:39:33 -03:00
Marcus Da Coregio ff6fd78d64 Merge branch '5.7.x' into 5.8.x 2022-09-01 09:39:10 -03:00
Marcus Da Coregio 0a08a23423 Merge branch '5.6.x' into 5.7.x 2022-09-01 09:38:33 -03:00
Underground Hill 8b74bf9742 Updated reference to architecture page
In the context of Servlet Authentication page, "Architecture" should probably link to "Servlet Authentication Architecture" page
2022-09-01 09:38:10 -03:00
Steve Riesenberg 8474acebf2
Merge branch '5.8.x' 2022-08-29 15:12:48 -05:00
he1ex-tG 568277f8bc
Mistake in Kotlin code representation is fixed 2022-08-29 15:11:10 -05:00
Josh Cummings b1fd9af723
Merge remote-tracking branch 'origin/5.8.x' into main 2022-08-26 16:01:40 -06:00
Josh Cummings 0f58620643 Add AspectJ AuthorizationManager Support
Closes gh-11326
2022-08-26 15:59:08 -06:00
Josh Cummings 84f765a89c
Merge remote-tracking branch 'origin/5.8.x' into main 2022-08-25 14:46:48 -06:00
Josh Cummings 070dce1baf
Document ReactiveMethodSecurity improvements
Issue gh-9401
2022-08-25 14:36:03 -06:00
Josh Cummings 27ce5936cf
Add Caveat about Spring Security's co-routine support
Closes gh-10920
2022-08-25 14:36:02 -06:00
Rob Winch 81d6b6df6c Add Explicit SessionAuthenticationStrategy Option
SessionAuthenticationFilter requires accessing the HttpSession to do its
job. Previously, there was no way to just disable the
SessionAuthenticationFilter despite the fact that
SessionAuthenticationStrategy is invoked by the authentication filters
directly.

This commit adds an option to disable SessionManagmentFilter in favor of
requiring explicit SessionAuthenticationStrategy invocation already
performed by the authentication filters.

Closes gh-11455
2022-08-18 17:38:03 -05:00
Rob Winch 89f8310d6c Add Explicit SessionAuthenticationStrategy Option
SessionAuthenticationFilter requires accessing the HttpSession to do its
job. Previously, there was no way to just disable the
SessionAuthenticationFilter despite the fact that
SessionAuthenticationStrategy is invoked by the authentication filters
directly.

This commit adds an option to disable SessionManagmentFilter in favor of
requiring explicit SessionAuthenticationStrategy invocation already
performed by the authentication filters.

Closes gh-11455
2022-08-18 17:00:47 -05:00
jujunChen 13feb87171
Modify words
- <dependencyManagement> to dependencyManagement
- pom.xml to build.gradle
2022-08-16 14:51:36 -06:00
jujunChen d93bde7465
Modify words
- <dependencyManagement> to dependencyManagement
- pom.xml to build.gradle
2022-08-16 14:51:06 -06:00
jujunChen e3d85881e9
Modify words
- <dependencyManagement> to dependencyManagement
- pom.xml to build.gradle
2022-08-16 14:48:14 -06:00
jujunChen 9f6d9c2b84 Modify words
- <dependencyManagement> to dependencyManagement
- pom.xml to build.gradle
2022-08-16 14:44:34 -06:00
Rob Winch 8ad20b1768 Add CsrfFilter.csrfRequestAttributeName
Previously the CsrfToken was set on the request attribute with the name
equal to CsrfToken.getParameterName(). This didn't really make a lot of
sense because the CsrfToken.getParameterName() is intended to be used as
the HTTP parameter that the CSRF token was provided. What's more is it
meant that the CsrfToken needed to be read for every request to place it
as an HttpServletRequestAttribute. This causes unnecessary HttpSession
access which can decrease performance for applications.

This commit allows setting CsrfFilter.csrfReqeustAttributeName to
remove the dual purposing of CsrfToken.parameterName and to allow deferal
of reading the CsrfToken to prevent unnecessary HttpSession access.

Issue gh-11699
2022-08-16 13:47:31 -05:00
Rob Winch 5b64526ba9 Add CsrfFilter.csrfRequestAttributeName
Previously the CsrfToken was set on the request attribute with the name
equal to CsrfToken.getParameterName(). This didn't really make a lot of
sense because the CsrfToken.getParameterName() is intended to be used as
the HTTP parameter that the CSRF token was provided. What's more is it
meant that the CsrfToken needed to be read for every request to place it
as an HttpServletRequestAttribute. This causes unnecessary HttpSession
access which can decrease performance for applications.

This commit allows setting CsrfFilter.csrfReqeustAttributeName to
remove the dual purposing of CsrfToken.parameterName and to allow deferal
of reading the CsrfToken to prevent unnecessary HttpSession access.

Issue gh-11699
2022-08-15 17:07:02 -05:00
Rob Winch 425b3501b7 Remove `@Configuration` from `@Enable*` Annotations
This removes `@Configuration` from all `@Enable` Annotations and explicitly
adds `@Configuration` to wherever the `@Enable*` Annotations are used.

Closes gh-11653
2022-08-09 17:00:24 -05:00
Rob Winch a5069d7e35 Fix Add @Configuration to @Enable*Security Usage
Issue gh-6613
2022-08-09 17:00:16 -05:00
Igor Bolic 2e66b9f6cc Allow customization of redirect strategy
The default redirect strategy will provide authorization redirect
URI within HTTP 302 response Location header.
Allowing the configuration of custom redirect strategy will provide
an option for the clients to obtain the authorization URI from e.g.
HTTP response body as JSON payload, without a need to handle
automatic redirection initiated by the HTTP Location header.

Closes gh-11373
2022-08-08 15:44:01 -05:00
Igor Bolic efaee4e56b Allow customization of redirect strategy
The default redirect strategy will provide authorization redirect
URI within HTTP 302 response Location header.
Allowing the configuration of custom redirect strategy will provide
an option for the clients to obtain the authorization URI from e.g.
HTTP response body as JSON payload, without a need to handle
automatic redirection initiated by the HTTP Location header.

Closes gh-11373
2022-08-08 15:35:49 -05:00
Joshua Sattler 040111ae9e Remove Configuration meta-annotation from Enable* annotations
Before, Spring Security's @Enable* annotations were meta-annotated with @Configuration.
While convenient, this is not consistent with the rest of the Spring projects and most notably
Spring Framework's @Enable annotations. Additionally, the introduction of support for
@Configuration(proxyBeanMethods=false) in Spring Framework provides a compelling reason to
remove @Configuration meta-annotation from Spring Security's @Enable annotations and allow
users to opt into their preferred configuration mode.

Closes gh-6613

Signed-off-by: Joshua Sattler <joshua.sattler@mailbox.org>
2022-07-30 03:48:42 +02:00
Steve Riesenberg a72c5a55db
Revert "Remove @Configuration from webflux config examples"
This reverts commit aec9effb88.
2022-07-26 16:46:01 -05:00
Joshua Sattler aec9effb88 Remove @Configuration from webflux config examples 2022-07-26 16:34:10 -05:00