Cwikius-Spring/spring-security
1
0
Fork 0
mirror of synced 2026-09-12 12:15:13 +00:00
Code Issues Packages Projects Releases Wiki Activity
20,470 Commits 50 Branches 385 Tags
3dff446d189c0700d3bd06a2117134bc748cd7dd
Commit Graph

20470 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
dependabot[bot] 3dff446d18 Bump spring-io/spring-release-actions/get-todays-release-version 
Bumps [spring-io/spring-release-actions/get-todays-release-version](https://github.com/spring-io/spring-release-actions) from 0.0.5 to 0.0.6.
- [Release notes](https://github.com/spring-io/spring-release-actions/releases)
- [Commits](https://github.com/spring-io/spring-release-actions/compare/a1f321783a0769dd2aea4fad6c2ae2f95a52b885...1b8671612c3eb3d9b9763e2d7b66f1a80d00ee95)

---
updated-dependencies:
- dependency-name: spring-io/spring-release-actions/get-todays-release-version
  dependency-version: 0.0.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-09-03 14:39:30 -07:00
dependabot[bot] cc89707b03 Bump antora from 3.2.0-rc.2 to 3.2.0-rc.3 in /docs 
Bumps [antora](https://gitlab.com/antora/antora) from 3.2.0-rc.2 to 3.2.0-rc.3.
- [Changelog](https://gitlab.com/antora/antora/blob/main/CHANGELOG.adoc)
- [Commits](https://gitlab.com/antora/antora/compare/v3.2.0-rc.2...v3.2.0-rc.3)

---
updated-dependencies:
- dependency-name: antora
  dependency-version: 3.2.0-rc.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-09-03 14:38:41 -07:00
dependabot[bot] 812ad9c547 Bump spring-io/spring-security-release-tools/.github/workflows/build.yml 
Bumps [spring-io/spring-security-release-tools/.github/workflows/build.yml](https://github.com/spring-io/spring-security-release-tools) from 1.0.15 to 1.0.17.
- [Release notes](https://github.com/spring-io/spring-security-release-tools/releases)
- [Changelog](https://github.com/spring-io/spring-security-release-tools/blob/main/RELEASE.adoc)
- [Commits](https://github.com/spring-io/spring-security-release-tools/compare/b92832ecbc7cbe969201e6beafbde0ee400cf095...3f6cc7ffc137ca160061749d5f34dc30d5f36986)

---
updated-dependencies:
- dependency-name: spring-io/spring-security-release-tools/.github/workflows/build.yml
  dependency-version: 1.0.17
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-09-03 14:38:08 -07:00
dependabot[bot] 364c153e17 Bump spring-io/spring-release-actions/compute-next-version 
Bumps [spring-io/spring-release-actions/compute-next-version](https://github.com/spring-io/spring-release-actions) from 0.0.5 to 0.0.6.
- [Release notes](https://github.com/spring-io/spring-release-actions/releases)
- [Commits](https://github.com/spring-io/spring-release-actions/compare/a1f321783a0769dd2aea4fad6c2ae2f95a52b885...1b8671612c3eb3d9b9763e2d7b66f1a80d00ee95)

---
updated-dependencies:
- dependency-name: spring-io/spring-release-actions/compute-next-version
  dependency-version: 0.0.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-09-03 14:37:16 -07:00
dependabot[bot] 39383ab970 Bump spring-io/spring-security-release-tools/.github/workflows/test.yml 
Bumps [spring-io/spring-security-release-tools/.github/workflows/test.yml](https://github.com/spring-io/spring-security-release-tools) from ed473b4dafba053c63a453d2d88a89df3b3e18b3 to 9ca0acea761aa79d71c78cc462048c49ed5c4230.
- [Release notes](https://github.com/spring-io/spring-security-release-tools/releases)
- [Changelog](https://github.com/spring-io/spring-security-release-tools/blob/main/RELEASE.adoc)
- [Commits](https://github.com/spring-io/spring-security-release-tools/compare/ed473b4dafba053c63a453d2d88a89df3b3e18b3...9ca0acea761aa79d71c78cc462048c49ed5c4230)

---
updated-dependencies:
- dependency-name: spring-io/spring-security-release-tools/.github/workflows/test.yml
  dependency-version: 9ca0acea761aa79d71c78cc462048c49ed5c4230
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-09-03 14:35:20 -07:00
Tran Ngoc Nhan 8ef5bcd003 Fix typos in Javadocs 
- Remove duplicate words
- Remove unnecessary parentheses
- Fix grammar

Signed-off-by: Tran Ngoc Nhan <ngocnhan.tran1996@gmail.com>
 2026-09-03 14:34:29 -07:00
dependabot[bot] 4193b73d47 Bump actions/setup-java from 5.7.0 to 6.0.0 
Bumps [actions/setup-java](https://github.com/actions/setup-java) from 5.7.0 to 6.0.0.
- [Release notes](https://github.com/actions/setup-java/releases)
- [Commits](https://github.com/actions/setup-java/compare/b6effb05e454b25005698d916606bdc6ffcbf961...dd06d9cba3e5552c54d9f8ea23572deb30010f7c)

---
updated-dependencies:
- dependency-name: actions/setup-java
  dependency-version: 6.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-09-03 14:33:13 -07:00
dependabot[bot] 4ce48297f6 Bump io.spring.gradle:spring-security-release-plugin 
Bumps [io.spring.gradle:spring-security-release-plugin](https://github.com/spring-io/spring-security-release-tools) from 1.0.15 to 1.0.17.
- [Release notes](https://github.com/spring-io/spring-security-release-tools/releases)
- [Changelog](https://github.com/spring-io/spring-security-release-tools/blob/main/RELEASE.adoc)
- [Commits](https://github.com/spring-io/spring-security-release-tools/compare/v1.0.15...v1.0.17)

---
updated-dependencies:
- dependency-name: io.spring.gradle:spring-security-release-plugin
  dependency-version: 1.0.17
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-09-03 14:32:07 -07:00
Tran Ngoc Nhan 02cc2e9d14 Fix TokenType Comparison Logic 
Compare OAuth2AccessToken.TokenType using equals() instead of == in
BearerTokenAuthentication, since TokenType instances are not
guaranteed to be singletons and reference comparison can incorrectly
reject an otherwise-equal bearer token.

Closes gh-19377

Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
 2026-09-03 14:06:08 -07:00
Tran Ngoc Nhan 27a76a67ae Include code example for reactive onetimetoken 
Signed-off-by: Tran Ngoc Nhan <ngocnhan.tran1996@gmail.com>
 2026-09-03 14:00:44 -07:00
Tran Ngoc Nhan ff6cef0cd2 Include code example for servlet onetimetoken 
Signed-off-by: Tran Ngoc Nhan <ngocnhan.tran1996@gmail.com>
 2026-09-03 14:00:44 -07:00
Josh Cummings 1a7769be28 Fix Checkstyle 
Issue gh-9175

Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
 2026-09-03 11:18:58 -07:00
Dmitrii Bocharov bdf501fe87 Fix HeaderWriterFilter Race Condition 
Closes gh-9175

Signed-off-by: Dmitrii Bocharov <bdshadow@gmail.com>
 2026-09-03 11:18:58 -07:00
Josh Cummings 461ccd817d Next Development Version 
Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
 2026-08-21 09:14:09 -06:00
Josh Cummings 381c556f78 Add Release Announcement Workflows 
Closes gh-19571

Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
 2026-08-20 16:57:48 -06:00
Josh Cummings 3b276e6c0d Update to Spring Data 2025.1.7 
Closes gh-19485

Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
 2026-08-20 11:24:08 -06:00
Josh Cummings f2115fbef8 Update to Spring LDAP 4.0.5 
Closes gh-19486

Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
 2026-08-20 11:24:01 -06:00
Josh Cummings 298335a57e Update to Micrometer 1.16.7 
Closes gh-19484

Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
 2026-08-20 11:23:55 -06:00
Josh Cummings c6566ee772 Update to Reactor 2025.0.7 
Closes gh-19483

Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
 2026-08-20 11:23:50 -06:00
Josh Cummings 7442214225 Update to Spring Framework 7.0.9 
Closes gh-19482

Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
 2026-08-20 11:23:44 -06:00
Josh Cummings 0123ae0981 Deprecate AesBytesEncryptor 
This commit separates AesBytesEncryptor into two separate
implememtations, allowing for a migration away from default
arrangements that used a null IV

Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
 2026-08-20 11:23:36 -06:00
Josh Cummings 11a648d106 Improve Equivalence Tests 
This commit adds equals and hashCode implementations as well
as a readResolve implementation to ensure that deserialization
mechanisms can correctly assess the equality of a constnat
and a corresponding deserialized instance. For defense-in-depth
reasons, this commit also favors .equals over == for these
constants.

Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
 2026-08-20 11:23:29 -06:00
Joe Grandja 536e09756c Bind UnboundIdContainer to loopback address 2026-08-20 11:23:22 -06:00
Joe Grandja ac15cdbea3 Apply html encoding in DefaultConsentPage 2026-08-20 11:23:14 -06:00
Joe Grandja ad812aefc4 Provide ability to configure DPoP proof replay 2026-08-20 11:23:08 -06:00
Josh Cummings d8769fb183 Use Constant-Time Comparison 
This commit updates password encoders to use a
constant-time comparison method to defend against
timing attacks

Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
 2026-08-20 11:23:02 -06:00
Josh Cummings ae997a4f46 Use Utf8#isEqual 
Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
 2026-08-20 11:22:55 -06:00
Josh Cummings bbc6273abf Use Constant-Time Equals 
This commit updates the filter to use constant-time
equals for sensitive material

Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
 2026-08-20 11:22:49 -06:00
Josh Cummings 475af0d3db Use Constant-Time Equals 
This commit updates the filter to use constant-time
equals for sensitive material

Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
 2026-08-20 11:22:43 -06:00
Josh Cummings f8a61e66d1 Add Utf8#isEqual 
This commit adds a constant-time equals method,
useful for comparing password hashes or other
sensitive material

Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
 2026-08-20 11:22:36 -06:00
Josh Cummings 8830e39073 Use MessageDigest#isEqual 
This commit favors constant-time comparison
to mitigate timing attacks

Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
 2026-08-20 11:22:31 -06:00
Josh Cummings 304cc21523 Add Tests for User and Device Code 
Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
 2026-08-20 11:22:25 -06:00
Tadaya Tsuyukubo d111029078 Prevent sharing SecurityContext across threads 
`SecurityContextHolderThreadLocalAccessor` currently propagates the
same `SecurityContext` to other threads when Micrometer
Context Propagation is used. This leads to unintended sharing of
mutable state and can cause authentication to leak between threads.

This change updates the accessor to create a new
`SecurityContext` for the target thread while reusing only the
`Authentication` value. Each thread now receives its own
`SecurityContext` instance, preventing cross-thread interference and
aligning with recommended `SecurityContext` usage.

Signed-off-by: Tadaya Tsuyukubo <tadaya@ttddyy.net>
 2026-08-19 16:54:43 -06:00
dae won 5b923c78ea Validate Parameter in setPostAuthenticationChecks 
The null check in setPostAuthenticationChecks of
AbstractUserDetailsReactiveAuthenticationManager asserted the current
field value, which is initialized to a default and can never be null,
instead of the method parameter. As a result, null was silently
accepted and the next authenticate call failed with a raw
NullPointerException instead of failing fast with a clear message.

Closes gh-19276

Signed-off-by: dae won <eodnjs01477@gmail.com>
 2026-08-13 15:58:01 -06:00
Tran Ngoc Nhan 65a1099ccb Correct validation logic in CasAuthenticationToken 
Closes gh-19368

Signed-off-by: Tran Ngoc Nhan <ngocnhan.tran1996@gmail.com>
 2026-08-13 15:19:26 -06:00
junhyeong9812 9fdd2dc675 Lowercase username in changePassword lookup 
InMemoryUserDetailsManager keys its user map on the lower-cased
username everywhere except changePassword, which looked the current
user up with the raw name. A user whose username contains uppercase
letters could therefore not change its password. Lower-case the
lookup key to match the rest of the class.

Closes gh-19336

Signed-off-by: junhyeong9812 <pickjog@gmail.com>
 2026-08-13 11:35:59 -06:00
Josh Cummings 2aa3c1ab2e Remove NullAway 
Issue gh-17816

Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
 2026-08-11 19:40:18 -06:00
Kim Tae Eun 17c58ef088 Remove BeanResolver Null Checks 
StandardEvaluationContext.setBeanResolver now accepts a nullable
BeanResolver, so the workarounds added for the original limitation
are no longer needed. This removes the explicit null guards (and
equivalent Optional.ofNullable idiom) as well as the
@SuppressWarnings("NullAway") annotations introduced to silence
the false positives.

In addition to the seven sites that explicitly referenced
spring-projects/spring-framework#35371, two sites in
spring-security-core followed the same workaround pattern without
the comment marker (AbstractSecurityExpressionHandler and
DefaultMethodSecurityExpressionHandler) and have also been
simplified.

Closes gh-17816

Signed-off-by: Kim Tae Eun <snowykte0426@naver.com>
 2026-08-11 18:37:09 -07:00
Arz Meow 63306ad8ee Update One-Time Token Docs for Renamed APIs 
Replace deprecated `UriComponentsBuilder` usage and renamed
`oneTimeTokenLogin` DSL method references in the docs with their
current equivalents.

Closes gh-18367

Signed-off-by: Arz Meow <arthur37231@gmail.com>
 2026-08-11 14:47:25 -07:00
Tran Ngoc Nhan 24aec1d002 Fix broken Javadoc links 
Closes gh-19194

Signed-off-by: Tran Ngoc Nhan <ngocnhan.tran1996@gmail.com>
 2026-08-11 14:31:49 -07:00
Tran Ngoc Nhan 863753580c Fix Broken DefaultLoginPageGeneratingFilter Javadoc Link 
Use the `javadoc:` macro so the reference resolves correctly.

Signed-off-by: Tran Ngoc Nhan <ngocnhan.tran1996@gmail.com>
 2026-08-11 14:31:43 -07:00
Tran Ngoc Nhan fa92ce3758 Remove Unnecessary AuthorizationDecision Cast 
Closes gh-19282
 2026-08-11 14:30:52 -07:00
dependabot[bot] 561f1bba0f Bump com.unboundid:unboundid-ldapsdk from 7.0.4 to 7.0.5 
Bumps [com.unboundid:unboundid-ldapsdk](https://github.com/pingidentity/ldapsdk) from 7.0.4 to 7.0.5.
- [Release notes](https://github.com/pingidentity/ldapsdk/releases)
- [Changelog](https://github.com/pingidentity/ldapsdk/blob/master/docs/release-notes.html)
- [Commits](https://github.com/pingidentity/ldapsdk/compare/7.0.4...7.0.5)

---
updated-dependencies:
- dependency-name: com.unboundid:unboundid-ldapsdk
  dependency-version: 7.0.5
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-11 12:00:52 -07:00
dependabot[bot] 268fce2616 Bump antora from 3.2.0-alpha.12 to 3.2.0-rc.2 in /docs 
---
updated-dependencies:
- dependency-name: antora
  dependency-version: 3.2.0-rc.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-11 10:27:36 -07:00
dependabot[bot] c4c547b73b Bump org.apache.kerby:kerb-simplekdc from 2.1.1 to 2.1.2 
Bumps org.apache.kerby:kerb-simplekdc from 2.1.1 to 2.1.2.

---
updated-dependencies:
- dependency-name: org.apache.kerby:kerb-simplekdc
  dependency-version: 2.1.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-11 10:27:26 -07:00
dependabot[bot] d487048224 Bump ch.qos.logback:logback-classic from 1.5.34 to 1.5.38 
Bumps [ch.qos.logback:logback-classic](https://github.com/qos-ch/logback) from 1.5.34 to 1.5.38.
- [Release notes](https://github.com/qos-ch/logback/releases)
- [Commits](https://github.com/qos-ch/logback/compare/v_1.5.34...v_1.5.38)

---
updated-dependencies:
- dependency-name: ch.qos.logback:logback-classic
  dependency-version: 1.5.38
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-11 10:27:10 -07:00
dependabot[bot] 1d15210ae2 Bump actions/checkout from 6.0.3 to 7.0.1 
Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.3 to 7.0.1.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/df4cb1c069e1874edd31b4311f1884172cec0e10...3d3c42e5aac5ba805825da76410c181273ba90b1)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 7.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-11 10:26:57 -07:00
dependabot[bot] 5f377e5ec2 Bump @springio/antora-extensions from 1.14.12 to 1.14.13 in /docs 
Bumps [@springio/antora-extensions](https://github.com/spring-io/antora-extensions) from 1.14.12 to 1.14.13.
- [Changelog](https://github.com/spring-io/antora-extensions/blob/main/CHANGELOG.adoc)
- [Commits](https://github.com/spring-io/antora-extensions/compare/v1.14.12...v1.14.13)

---
updated-dependencies:
- dependency-name: "@springio/antora-extensions"
  dependency-version: 1.14.13
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-11 10:26:13 -07:00
dependabot[bot] e107329766 Bump actions/setup-java from 5.2.0 to 5.7.0 
Bumps [actions/setup-java](https://github.com/actions/setup-java) from 5.2.0 to 5.7.0.
- [Release notes](https://github.com/actions/setup-java/releases)
- [Commits](https://github.com/actions/setup-java/compare/be666c2fcd27ec809703dec50e508c2fdc7f6654...b6effb05e454b25005698d916606bdc6ffcbf961)

---
updated-dependencies:
- dependency-name: actions/setup-java
  dependency-version: 5.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-11 10:25:54 -07:00
Josh Cummings 905b4786e8 Remove Milestone Date Validation 
Closes gh-19526

Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
 2026-08-11 11:08:05 -06:00