1
0
mirror of synced 2026-05-22 13:23:17 +00:00

3304 Commits

Author SHA1 Message Date
Rob Winch 24ffda28d8 Fixes for webauthn tests after JSpecify
Issue gh-17839
2025-09-03 14:44:58 -05:00
Josh Cummings 3dbcf266e9 Merge branch '6.5.x' 2025-09-02 16:45:30 -06:00
Josh Cummings eeb67650ee Deprecate RequiresChannelDsl
Issue gh-16680
2025-09-02 16:41:39 -06:00
Josh Cummings 3534b74945 Replace InteractiveAuthenticationSuccessEvent 7.0.x Sample
Given that 7e3bf9662c changes
the InteractiveAuthenticationSuccessEvent serialization sample,
this commit syncs up the 7.0.x version to match.

Closes gh-16276
2025-09-02 14:18:25 -06:00
Josh Cummings dc0ab4c805 Merge branch '6.5.x' 2025-09-02 14:15:20 -06:00
Josh Cummings c982753d46 Replace InteractiveAuthenticationSuccessEvent 6.5.x Sample
Given that 7e3bf9662c changes
the InteractiveAuthenticationSuccessEvent serialization sample,
this commit syncs up the 6.5.x version to match.

Issue gh-16276
2025-09-02 14:14:13 -06:00
Josh Cummings 0ff9f10696 Merge branch '6.4.x' into 6.5.x 2025-08-30 10:00:45 -06:00
Josh Cummings 7e3bf9662c Polish InteractiveAuthenticationSuccessEvent Sample
The sample better matches a value that would be used in the constructor

Issue gh-16276
2025-08-30 10:00:24 -06:00
Rob Winch a58f3282d9 Fix config/src/test/kotlin nullability for web
Issue gh-17535
2025-08-29 15:46:08 -05:00
Rob Winch c2ba662b91 Enable Null checking in spring-security-web via JSpecify
Closes gh-17535
2025-08-29 15:06:48 -05:00
Rob Winch 49f308adb0 Use Supplier<? extends @Nullable Authentication>
Previously Supplier<@Nullable Authentication> was used. This prevented
Supplier<Authentication> from being used. The code now uses
Supplier<? extends @Nullable Authentication> which allows for both
Supplier<@Nullable Authentication> and Supplier<Authentication>.

Closes gh-17814
2025-08-29 09:46:58 -05:00
Josh Cummings 4cbe8de7ea Polish RSocket Anonymous Support
Changed the DSL method name to anonymous to align with jwt.
Since basicAuthenication is deprecated, we don't need to
align with its naming convention.

Also added a since attribute to the method.

Issue gh-17132
2025-08-26 17:33:40 -06:00
Andrey Litvitski 559b73b39f Add Disabling Anonymous Authentication in RSocketSecurity
Closes: gh-17132

Signed-off-by: Andrey Litvitski <andrey1010102008@gmail.com>

1

Signed-off-by: Andrey Litvitski <andrey1010102008@gmail.com>

1

Signed-off-by: Andrey Litvitski <andrey1010102008@gmail.com>
2025-08-26 17:33:40 -06:00
Josh Cummings 36f1de945f Add OneTimeTokenAuthentication
Closes gh-17799
2025-08-22 15:46:54 -06:00
Josh Cummings 89b2f9cf54 Improve Test Runnability in IDE
In some configurations, Configuration classes with static elements
may cause a test to hang. This commit changes JeeConfigurerTests
test configuration classes to use mock beans instead of referencing
them as static fields.
2025-08-22 15:46:53 -06:00
Rob Winch f496ded4e5 AuthorizationManager allows null Authentication
It is possible to have a null Authentication and so the
AuthorizationManager APIs should allow for passing it in.

Closes gh-17795
2025-08-22 12:03:16 -05:00
Josh Cummings 583e668c6b Remove opensaml5Test Task
Issue gh-17707
2025-08-22 09:19:20 -06:00
Yanming Zhou 41162aa7e3 Polish WebFluxSecurityConfiguration
Signed-off-by: Yanming Zhou <zhouyanming@gmail.com>
2025-08-21 11:16:12 -06:00
Yanming Zhou d86f2c957d Change @Bean method signature to return RsaKeyConversionServicePostProcessor instead of BeanFactoryPostProcessor
It's friendly for Spring Boot's `@ConditionalOnMissingBean`, and:

>> When defining a Spring `@Bean` method, it is generally recommended to declare the most specific type possible as the method's return type. This means returning the concrete class of the bean, or the most specific interface that the bean implements and through which it will be referenced in the application.

Signed-off-by: Yanming Zhou <zhouyanming@gmail.com>
2025-08-21 11:16:12 -06:00
Rob Winch a8f045eb50 Add Modular Spring Security Configuration
Closes gh-16258
2025-08-20 12:16:08 -05:00
Rob Winch 5c5efc9092 SpringTestContext registers WebTestClient Bean
Closes gh-17780
2025-08-20 12:15:58 -05:00
Josh Cummings 3396890d8b Propagate AccessDeniedException Only to ExceptionTranslationFilter
Closes gh-17761
2025-08-18 17:04:19 -06:00
Josh Cummings 714781df78 Isolate AOT Test to Security Components
PR gh-17724
2025-08-18 09:05:03 -05:00
Josh Cummings a04b026000 Disable Test
Issue gh-17747
PR gh-17724
2025-08-18 09:05:03 -05:00
Josh Cummings aeb2dbc2b6 Move PathPatternRequestMatcher.Builder to Shared Object
This commit changes the DSL to look for a shared object
instead of publishing a bean for PathPatternRequestMatcher.Builder.

Closes gh-17746
2025-08-18 06:31:31 -06:00
Josh Cummings 890c11d428 Polish SecurityNamespaceHandler Version Checking
PR gh-17689
2025-08-15 17:26:57 -06:00
seongm1n 01401f1c67 Replace "shameless coverage code" in SecurityNamespaceHandlerTests
Signed-off-by: seongm1n <0411tjdals34@gmail.com>
2025-08-15 16:26:31 -06:00
Josh Cummings 5506c487de Remove OpenSaml4 Components
Issue gh-17707
2025-08-14 18:01:02 -06:00
Josh Cummings 057b7c68fb Add Serializable Sample
Closes gh-17728
2025-08-14 16:39:49 -06:00
Josh Cummings 7b1c917593 Merge branch '6.5.x' 2025-08-14 16:34:48 -06:00
Josh Cummings 9b7e0e10fc Add Serializable Sample
Closes gh-17727
2025-08-14 16:20:06 -06:00
Josh Cummings 4fab90b2b8 Merge branch '6.4.x' into 6.5.x 2025-08-14 15:54:16 -06:00
Josh Cummings 10948b5b7a Make OpenSamlAssertingPartyDetails Serializable
Closes gh-17622
2025-08-14 15:52:58 -06:00
Joe Grandja df3080b0e2 Merge branch '6.5.x' 2025-08-12 14:45:23 -04:00
Joe Grandja 518ae27105 Fix JwtDecoderFactory ClassNotFoundException with DPoP authentication
Closes gh-17249
2025-08-12 14:28:30 -04:00
Josh Cummings 6d1a886f92 Deprecate SERIAL_VERSION_UID
Closes gh-17623
2025-08-07 11:09:35 -06:00
Tran Ngoc Nhan d6e378e9bb Apply Diamond Operator
Signed-off-by: Tran Ngoc Nhan <ngocnhan.tran1996@gmail.com>
2025-07-31 10:59:55 -06:00
Deep Dhamala ca557a9880 Simplify Error Message for Unsupported Security XSD Versions
Closes gh-17153

Signed-off-by: Deep Dhamala <dhamaladeep2@gmail.com>
2025-07-31 10:40:54 -06:00
Tran Ngoc Nhan 1a56023f7f Use Spring Framework Nullability Annotations
Signed-off-by: Tran Ngoc Nhan <ngocnhan.tran1996@gmail.com>
2025-07-31 10:18:51 -06:00
Rob Winch f6cb0bd610 Merge Use 2004-present Copyright Header
The original merge into main did not apply the changes. This fixes it.
Closes gh-17635
2025-07-29 10:52:42 -05:00
Rob Winch 2fdca16c1a Merge branch '6.4.x' into 6.5.x
Closes gh-17634
2025-07-29 09:47:52 -05:00
Rob Winch 392129b616 Use 2004-present Copyright Header
The Spring portfolio is changing to use <inception-year>-present in
the copyright headers to simplify keeping headers up to date. This
commit updates the headers and the checkstyle accordingly.

The commit updated etc/checkstyle/header.txt

It also updated the copyright headers using the following find/replace:

Find: (Copyright \d{4})\s*(\-\d{4})? the original author or authors.
Replace: Copyright 2004-present the original author or authors.

Closes gh-17633
2025-07-29 09:45:23 -05:00
Rob Winch 79cd982341 Extract spring-security-webauthn
Closes gh-17586
2025-07-22 17:18:38 -05:00
Rob Winch 7c887d2da1 Add nullability to spring-security-core
Closes gh-17534
2025-07-22 16:29:13 -05:00
Rob Winch 85dc06bbdf Merge branch '6.5.x'
Closes gh-17581
2025-07-21 09:30:11 -05:00
Rob Winch 80ccb9b3cf Merge branch '6.4.x' into 6.5.x
Closes gh-17580
2025-07-21 09:29:20 -05:00
Rob Winch 829af961f0 Use Meaningful Configurer Names in Test
This just renames the Configurer names used in
AbstractConfiguredSecurityBuilderTests to be more meaningful.

Issue gh-17020 gh-17011

Signed-off-by: Rob Winch <362503+rwinch@users.noreply.github.com>
2025-07-21 09:27:36 -05:00
Rob Winch fca704e61f Fix getConfigurersInInitializing Semantics
A getter should not mutate state. This removes getConfigurersInInitializing
in favor of inline code since this is just used once.

Issue gh-17020 gh-17011

Signed-off-by: Rob Winch <362503+rwinch@users.noreply.github.com>
2025-07-21 09:27:36 -05:00
Rob Winch ea9dd2728e Support add nested security configurers during builder initialization
Closes gh-17011

Signed-off-by: DingHao <dh.hiekn@gmail.com>
2025-07-21 09:27:27 -05:00
Josh Cummings 63e0a56bee Add setBasePath
Originally, it was thought that this feature would be rather uncommon;
however, given some feedback from the Boot team, it makes sense to make
this easier to configure.

Of specific note is migrating from an earlier version were the
servlet path did not need to be specified in authorizeHttpRequests.
Since it does in 7, this will be a significant migration for those
who have a servlet path configured. This setter simplifies that a great
deal, including simplifying Boot's support of it.

Closes gh-17579
2025-07-20 22:57:06 -06:00