Cwikius-Spring/spring-security
1
0
Fork 0
mirror of synced 2026-08-05 01:36:56 +00:00
Code Issues Packages Projects Releases Wiki Activity

SEC-1171: Changed attribute name/value from secured="false" to security="none" to allow future extension by adding extra options (e.g. contextOnly to provide security context information during the request).

Browse Source
This commit is contained in:
Luke Taylor
2010-07-20 19:46:47 +01:00
parent a4fd191499
commit c1c8fd1874
13 changed files with 293 additions and 285 deletions
Download Patch File Download Diff File Expand all files Collapse all files
config/src/main/java/org/springframework/security/config/http/HttpConfigurationBuilder.java
+7
View File
@@ -4,6 +4,7 @@ import static org.springframework.security.config.http.HttpSecurityBeanDefinitio
import static org.springframework.security.config.http.SecurityFilters.*;
import java.util.ArrayList;
import java.util.Collections;
import java.util.List;
import org.springframework.beans.factory.config.BeanDefinition;
@@ -74,6 +75,11 @@ class HttpConfigurationBuilder {
private static final String ATT_REF = "ref";
private static final String ATT_SECURED = "security";
private static final String OPT_SECURITY_NONE = "none";
private static final String OPT_SECURITY_CONTEXT_ONLY = "contextOnly";
private final Element httpElt;
private final ParserContext pc;
private final SessionCreationPolicy sessionPolicy;
@@ -95,6 +101,7 @@ class HttpConfigurationBuilder {
public HttpConfigurationBuilder(Element element, ParserContext pc, MatcherType matcherType,
String portMapperName, BeanReference authenticationManager) {
this.httpElt = element;
this.pc = pc;
this.portMapperName = portMapperName;
config/src/main/java/org/springframework/security/config/http/HttpSecurityBeanDefinitionParser.java
+10 -4
View File
@@ -52,7 +52,9 @@ public class HttpSecurityBeanDefinitionParser implements BeanDefinitionParser {
static final String ATT_REQUIRES_CHANNEL = "requires-channel";
private static final String ATT_REF = "ref";
private static final String ATT_SECURED = "secured";
private static final String ATT_SECURED = "security";
private static final String OPT_SECURITY_NONE = "none";
private static final String OPT_SECURITY_CONTEXT_ONLY = "contextOnly";
static final String EXPRESSION_FIMDS_CLASS = "org.springframework.security.web.access.expression.ExpressionBasedFilterInvocationSecurityMetadataSource";
static final String EXPRESSION_HANDLER_CLASS = "org.springframework.security.web.access.expression.DefaultWebSecurityExpressionHandler";
@@ -97,9 +99,9 @@ public class HttpSecurityBeanDefinitionParser implements BeanDefinitionParser {
}
List<BeanMetadataElement> createFilterChain(Element element, ParserContext pc, MatcherType matcherType) {
boolean unSecured = "false".equals(element.getAttribute(ATT_SECURED));
String security = element.getAttribute(ATT_SECURED);
if (unSecured) {
if (StringUtils.hasText(security)) {
if (!StringUtils.hasText(element.getAttribute(ATT_PATH_PATTERN))) {
pc.getReaderContext().error("The '" + ATT_SECURED + "' attribute must be used in combination with" +
" the '" + ATT_PATH_PATTERN +"' attribute.", pc.extractSource(element));
@@ -112,7 +114,11 @@ public class HttpSecurityBeanDefinitionParser implements BeanDefinitionParser {
}
}
return Collections.emptyList();
if (security.equals(OPT_SECURITY_NONE)) {
return Collections.emptyList();
}
}
final String portMapperName = createPortMapper(element, pc);
config/src/main/resources/org/springframework/security/config/spring-security-3.1.rnc
+2 -2
View File
@@ -261,8 +261,8 @@ http.attlist &=
## The request URL pattern which will be mapped to the filter chain created by this <http> element. If omitted, the filter chain will match all requests.
attribute pattern {xsd:token}?
http.attlist &=
## When set to 'false', requests matching the pattern attribute will be ignored by Spring Security. No security filters will be applied and no SecurityContext will be available. If set, the <http> element must be empty, with no children.
attribute secured {boolean}?
## When set to 'none', requests matching the pattern attribute will be ignored by Spring Security. No security filters will be applied and no SecurityContext will be available. If set, the <http> element must be empty, with no children.
attribute security {"none"}?
http.attlist &=
## Automatically registers a login form, BASIC authentication, anonymous authentication, logout services, remember-me and servlet-api-integration. If set to "true", all of these capabilities are added (although you can still customize the configuration of each by providing the respective element). If unspecified, defaults to "false".
config/src/main/resources/org/springframework/security/config/spring-security-3.1.xsd
+7 -2
View File
@@ -693,10 +693,15 @@
<xs:documentation>The request URL pattern which will be mapped to the filter chain created by this &lt;http&gt; element. If omitted, the filter chain will match all requests.</xs:documentation>
</xs:annotation>
</xs:attribute>
<xs:attribute name="secured" type="security:boolean">
<xs:attribute name="security">
<xs:annotation>
<xs:documentation>When set to 'false', requests matching the pattern attribute will be ignored by Spring Security. No security filters will be applied and no SecurityContext will be available. If set, the &lt;http&gt; element must be empty, with no children.</xs:documentation>
<xs:documentation>When set to 'none', requests matching the pattern attribute will be ignored by Spring Security. No security filters will be applied and no SecurityContext will be available. If set, the &lt;http&gt; element must be empty, with no children.</xs:documentation>
</xs:annotation>
<xs:simpleType>
<xs:restriction base="xs:token">
<xs:enumeration value="none"/>
</xs:restriction>
</xs:simpleType>
</xs:attribute>
<xs:attribute name="auto-config" type="security:boolean">
<xs:annotation>
config/src/test/groovy/org/springframework/security/config/http/MiscHttpConfigTests.groovy
+3 -3
View File
@@ -86,7 +86,7 @@ class MiscHttpConfigTests extends AbstractHttpConfigTests {
}
def filterListShouldBeEmptyForPatternWithNoFilters() {
xml.http(pattern: '/unprotected', secured: 'false')
xml.http(pattern: '/unprotected', security: 'none')
httpAutoConfig() {}
createAppContext()
@@ -95,7 +95,7 @@ class MiscHttpConfigTests extends AbstractHttpConfigTests {
}
def regexPathsWorkCorrectly() {
xml.http(pattern: '\\A\\/[a-z]+', secured: 'false', 'request-matcher': 'regex')
xml.http(pattern: '\\A\\/[a-z]+', security: 'none', 'request-matcher': 'regex')
httpAutoConfig() {}
createAppContext()
@@ -106,7 +106,7 @@ class MiscHttpConfigTests extends AbstractHttpConfigTests {
def ciRegexPathsWorkCorrectly() {
when:
xml.http(pattern: '\\A\\/[a-z]+', secured: 'false', 'request-matcher': 'ciRegex')
xml.http(pattern: '\\A\\/[a-z]+', security: 'none', 'request-matcher': 'ciRegex')
httpAutoConfig() {}
createAppContext()
config/src/test/groovy/org/springframework/security/config/http/PlaceHolderAndELConfigTests.groovy
+2 -2
View File
@@ -24,7 +24,7 @@ class PlaceHolderAndELConfigTests extends AbstractHttpConfigTests {
def unsecuredPatternSupportsPlaceholderForPattern() {
System.setProperty("pattern.nofilters", "/unprotected");
xml.http(pattern: '${pattern.nofilters}', secured: 'false')
xml.http(pattern: '${pattern.nofilters}', security: 'none')
httpAutoConfig() {
interceptUrl('/**', 'ROLE_A')
}
@@ -44,7 +44,7 @@ class PlaceHolderAndELConfigTests extends AbstractHttpConfigTests {
System.setProperty("default.target", "/defaultTarget");
System.setProperty("auth.failure", "/authFailure");
xml.http(pattern: '${login.page}', secured: 'false')
xml.http(pattern: '${login.page}', security: 'none')
xml.http {
interceptUrl('${secure.Url}', '${secure.role}')
'form-login'('login-page':'${login.page}', 'default-target-url': '${default.target}',
config/src/test/resources/logback-test.xml
+2 -2
View File
@@ -7,8 +7,8 @@
<logger name="org.apache.directory" level="WARN"/>
<root level="DEBUG">
<root level="INFO">
<appender-ref ref="STDOUT" />
</root>
</configuration>
</configuration>