Cwikius-Spring/spring-security
1
0
Fork 0
mirror of synced 2026-08-03 16:56:56 +00:00
Code Issues Packages Projects Releases Wiki Activity
8,472 Commits 70 Branches 382 Tags
542c625d7d0074474f2f5faeb6dd6d0eee4768e3
Commit Graph

546 Commits

Author SHA1 Message Date
Rob Winch 628ea00ad4 Fix CsrfWebFilter error message when expected CSRF not found 
Closes gh-9337
 2021-01-12 11:31:26 -06:00
Rob Winch dcd2137418 LoginPageGeneratingWebFilter honors context path 
Closes gh-8807
 2020-07-07 13:37:06 -05:00
Eleftheria Stein a6dd119266 Mock request with non-standard HTTP method in test 
Fixes gh-8594
 2020-05-26 11:32:27 -04:00
Rob Winch bd93616567 Fix non-standard HTTP method for CsrfWebFilter 
Closes gh-8452
 2020-05-12 13:18:01 -05:00
Josh Cummings 258627eaee SwitchUserFilter Defaults to POST 
Fixes gh-4183
 2020-03-27 14:40:38 -06:00
Zeeshan Adnan a49a325db2 Fix exception for empty basic auth header token 
fixes spring-projectsgh-7976
 2020-03-16 16:06:52 -04:00
Peter Keller 2dbedf7af5 Set charset of BasicAuthenticationFilter converter 
Allow BasicAuthenticationFilter to pick up the given credentials charset.

Fixes: gh-7835
 2020-01-23 16:24:03 +01:00
Rob Winch 29182abb34 Fix HttpHeaderWriterWebFilterTests 
Ensure setComplete() is subscribed to
 2020-01-10 08:46:47 -06:00
Rob Winch 29eb8b9177 CompositeServerHttpHeadersWriter Executes Sequentially 
Fixes gh-7731
 2019-12-12 11:28:23 -06:00
Rob Winch bd6ff1f319 DelegatingServerAuthenticationSuccessHandler Executes Sequentially 
Fixes gh-7728
 2019-12-12 08:33:14 -06:00
Rob Winch 6db7b457b7 DelegatingServerLogoutHandler Executes Sequentially 
Fixes gh-7723
 2019-12-11 15:39:56 -06:00
Rob Winch 635f7e1edd CsrfWebFilter supports multipart/form-data 
Fixes gh-7576
 2019-10-28 14:06:10 -05:00
Michel Palourdio d26f40f062 DefaultRedirectStrategy should redirect to root if the context-relative URL does not contain the context-path. 2019-10-23 09:41:00 -04:00
Tadaya Tsuyukubo 62c7de03c3 Add RequestMatcher to AbstractPreAuthenticatedProcessingFilter 
Moved the existing auth check logic to the matcher.

Issue: gh-5928
 2019-10-22 16:55:54 -04:00
Eleftheria Stein 264daec697 Test context relative URL with multiple schemes 2019-10-16 15:32:02 -04:00
Josh Cummings b764af6b9b CookieServerCsrfTokenRepositoryTests Leading Dot 
ResponseCookie removed support for having a leading dot in the cookie
domain.

Fixes gh-7500
 2019-09-30 08:39:45 -06:00
Josh Cummings 7949dd492a Move DelegatingServerAuthenticationSuccessHandlerTests 
Moved from src/test/groovy to src/test/java

Issue gh-5332
 2019-09-27 16:57:43 -06:00
Josh Cummings 5f905232cb Polish CurrentSecurityContextArgumentResolvers 
Fixes gh-7487
 2019-09-27 13:19:08 -06:00
Rob Winch 00f8991fac Merge Remove Redudant Throws 
Fixes gh-7301
 2019-09-19 11:04:53 -05:00
Onur Kagan Ozcan 034b5e9e93 Introduce LogoutSuccessEvent 
LogoutSuccessEvent is a simple AbstractAuthenticationEvent implementation which indicates successful logout.

By default, LogoutConfigurer will add a new LogoutHandler called LogoutSuccessEventPublishingLogoutHandler to publish this event.

This PR will also fix ConcurrentSessionFilter's composite logoutHandler, now will get LogoutHandler instances from LogoutConfigurer for consistency.

Fixes gh-2900
 2019-09-18 10:57:16 -05:00
Josh Cummings 7576dc44d7 AuthenticationFilter Session Fixation Protection 
Fixes gh-7446
 2019-09-17 08:17:09 -06:00
Josh Cummings aa12748c9b Add Request-level CSRF Skip 
Fixes gh-7367
 2019-09-13 19:04:05 +01:00
Filip Hanik e9a44bc0ce HttpSecurity.saml2login() - MVP Core Code 
Implements minimal SAML 2.0 login/authentication functionality with the
following feature set:

  - Supports IDP initiated login at the default url of /login/saml2/sso/{registrationId}
  - Supports SP initiated login at the default url of /saml2/authenticate/{registrationId}
  - Supports basic java-configuration via DSL
  - Provides an integration sample using Spring Boot

Not implemented with this MVP

  - Single Logout
  - Dynamic Service Provider Metadata

Fixes gh-6019
 2019-09-05 14:40:08 -07:00
Josh Cummings 39e84013f7 ClearSiteDataHeaderWriter Directives 
Fixes gh-7347
 2019-09-03 15:57:10 -06:00
Eleftheria Stein ad0d3e9702 Polish remember me username check 2019-09-03 11:48:46 -04:00
Lars Grefer 95511331fa fix checkstyle 2019-08-26 22:42:26 +02:00
Lars Grefer 34dd5fea30 Remove redundant throws clauses 
Removes exceptions that are declared in a method's signature but never thrown by the method itself or its implementations/derivatives.
 2019-08-23 01:03:54 +02:00
Daniel Wegener 1a233a58c7 Add OnCommittedResponseWrapper.setContentLengthLong 
Add setContentLengthLong tracking to OnCommittedResponseWrapper in
order to detect commits on servlets that use setContentLengthLong to
announce the entity size they are about to write (as used in the
Apache Tomcat's DefaultServlet).

Fixes gh-7261
 2019-08-19 21:14:41 -04:00
Eleftheria Stein 4bc231872f Expire as many sessions as exceed maximum allowed 
Fixes: gh-7166
 2019-08-15 09:48:42 -05:00
Josh Cummings 9735a718cc Remove MultiTenantAuthenticationManagerResolver 
Fixes gh-7259
 2019-08-14 11:14:47 -06:00
Lars Grefer ec6ca97226 Fix tests 2019-08-11 21:09:10 +02:00
Lars Grefer ff1070df36 remove redundant modifiers found by checkstyle 2019-08-10 00:18:56 +02:00
Lars Grefer fb39d9c255 Anonymous type can be replaced with lambda 2019-08-08 17:09:09 -04:00
Lars Grefer 05f42a4995 Remove unused imports 2019-08-08 14:22:31 -04:00
Lars Grefer 2306d987e9 Cleanup unnecessary boxing 2019-08-06 10:17:38 -04:00
Eddú Meléndez 496579dde2 Add match result for servlet requests 
Fixes gh-7148
 2019-08-05 19:43:00 -04:00
Eddú Meléndez f712c5598c Add support for allowedHostnames in StrictHttpFirewall 
Introduce a new method `setAllowedHostnames` which perform the validation
against untrusted hostnames.

Fixes gh-4310
 2019-08-03 21:16:45 -04:00
Lars Grefer 776a4c3760 Use org.mockito.ArgumentMatchers in favor of org.mockito.Matchers 2019-08-03 12:28:37 -04:00
Rob Winch ad2f999c25 Polish BasicAuthenticationConverter 
This reverts to the old behavior from BasicAuthenticationFilter.
Specifically, if a token has an empty password, it still parses a username
and an empty String password.

Issue gh-7025
 2019-08-02 09:04:55 -05:00
Eleftheria Stein b55322b2cb Make basic authentication scheme case-insensitive 
Fixes: gh-7163
 2019-07-29 16:30:03 -04:00
sbespalov f1187bdfc2 issue/6506: AuthenticationConverter implementation 2019-07-23 17:31:21 -05:00
Clement Ng ab6440db10 Throws exception when passed IP address with too long mask 
Fixes gh-2790
 2019-07-19 06:25:58 -04:00
Rob Winch ea54d9014d DSL nested builder for HTTP security 
DSL nested builder for HTTP security

Fixes gh-5557
 2019-07-12 16:09:19 -05:00
Lars Grefer 3ea9d376b2 Cleanup explicit type arguments 2019-07-10 09:32:41 -05:00
Lars Grefer c5b5cc507c Cleanup redundant type casts 2019-07-10 09:31:09 -05:00
Eleftheria Stein 758397f102 Allow configuration of headers through nested builder 
Issue: gh-5557
 2019-07-09 15:35:37 -04:00
Lars Grefer 43737a56bd Use foreach where possible 2019-07-09 06:11:45 -06:00
Josh Cummings f5da63118e Add MultiTenantAuthenticationManagerResolver 
A class with a number of handy request-based implementations of
AuthenticationManagerResolver targeted at common multi-tenancy
scenarios.

Fixes: gh-6976
 2019-06-25 17:21:38 -06:00
Rafiullah Hamedy f6ed1db702 Introduced ReactiveAuthenticationManagerResolver 
Suitable for multi-tenant reactive applications needing to branch
authentication strategies based on request details.
 2019-06-13 08:52:19 -06:00
Clement Ng e66369f6c6 Added null checks and tests to constructors 
RequestKey, JaasGrantedAuthority, and SwitchUserGrantedAuthority
assume certain final members are non-null.

Issue: gh-6892
 2019-05-29 16:10:36 -06:00