Chrome DevTools itself (not the loaded page, and not the user)
requests /.well-known/appspecific/com.chrome.devtools.json when
DevTools is open against a page, as part of the Automatic Workspace
Folders feature, to map a local project folder for live source
editing. This request is tooling-driven, not user navigation, so it
should never be able to become the URL a user is redirected to after
authenticating.
Closes gh-19694
Legacy Internet Explorer 11 and pre-Chromium Edge automatically fetch
browserconfig.xml at the domain root to configure Windows pinned-site
tiles. It's still commonly generated by favicon-generator tooling even
though it's legacy, and is a background request unrelated to what the
user actually navigated to, so it shouldn't be able to become the URL
a user is redirected to after authenticating.
Closes gh-19693
Chrome, Edge, and other Chromium-based browsers asynchronously fetch
a page's web app manifest (manifest.json or manifest.webmanifest)
shortly after page load to evaluate PWA installability. This is a
fire-and-forget background request that should never become the URL
a user is redirected to after authenticating.
Closes gh-19695
Safari and other WebKit-based browsers automatically probe for
apple-touch-icon.png, apple-touch-icon-precomposed.png, and sized
variants (e.g. apple-touch-icon-152x152.png) at the domain root as
soon as a page loads, even without a matching <link> tag. This is a
background fetch unrelated to what the user actually navigated to, so
it should never become the URL a user is redirected to after
authenticating, just like the existing favicon.* exclusion.
This also refactors the single-pattern favicon matcher into a small
list of ignored background-request patterns so more patterns can be
added going forward.
Closes gh-19692
Spring Framework's HttpMethod#valueOf now normalizes casing, so
StrictServerWebExchangeFirewall no longer detects a non-canonical-case
HTTP method as distinct from its canonical form.
Closes gh-19541
Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
StandardEvaluationContext.setBeanResolver now accepts a nullable
BeanResolver, so the workarounds added for the original limitation
are no longer needed. This removes the explicit null guards (and
equivalent Optional.ofNullable idiom) as well as the
@SuppressWarnings("NullAway") annotations introduced to silence
the false positives.
In addition to the seven sites that explicitly referenced
spring-projects/spring-framework#35371, two sites in
spring-security-core followed the same workaround pattern without
the comment marker (AbstractSecurityExpressionHandler and
DefaultMethodSecurityExpressionHandler) and have also been
simplified.
Closes gh-17816
Signed-off-by: Kim Tae Eun <snowykte0426@naver.com>
SubjectX500PrincipalExtractor now returns the left-most, most-specific
matching RDN value, matching both convention and
SubjectDnX509PrincipalExtractor. Since LdapName#getRdns lists RDNs
most-significant first, the extractor reads them in reverse so that a
subject with more than one matching attribute (e.g. two CNs) resolves to
the most specific value.
Closes gh-19254
Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
This commit changes HtmlTemplates to use replace
instead of replaceAll since supporting regex in template
keys is not needed.
Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
Add CredentialRecordOwnerAuthorizationManager that verifies the
credential being deleted is owned by the currently authenticated user.
Also add an AuthorizationManager<Bytes> to WebAuthnRegistrationFilter
for the delete credential operation, defaulting to deny all, and wire it
up in WebAuthnConfigurer.
Per the WebAuthn specification [1], credential ids contain at least 16
bytes with at least 100 bits of entropy, making them practically
unguessable. The specification also advises that credential ids should
be kept private, as exposing them can leak personally identifying
information [2]. The CredentialRecordOwnerAuthorizationManager serves as
defense in depth: even if a credential id were somehow exposed, an
unauthorized user could not delete another user's credential.
[1] https://www.w3.org/TR/webauthn-3/#credential-id
[2] https://www.w3.org/TR/webauthn-3/#sctn-credential-id-privacy-leak
Currently, the List-receiving constructors of AndRequestMatcher,
OrRequestMatcher, AndServerWebExchangeMatcher, and OrServerWebExchangeMatcher
don't support covariance, which adds obstacles to users of these
APIs. For example, one cannot pass a List<PathPatternRequestMatcher>
to OrRequestMatcher(List<RequestMatcher>).
This commit resolves the aforementioned problem. It should not
break existing code.
Signed-off-by: Ziqin Wang <ziqin@wangziqin.net>
- fix compiler warnings in ServerOneTimeTokenAuthenticationConverter
- Replace deprecated API calls to create a OneTimeTokenAuthenticationToken.unauthenticated with OneTimeTokenAuthenticationToken(String token) call
- Update HttpMessageConverterAuthenticationSuccessHandler to replace deprecated MappingJackson2HttpMessageConverter with JacksonJsonHttpMessageConverter
- Replace updated OneTimeTokenAuthenticationConverter to use non-deprecated OneTimeTokenAuthenticationToken constructor
- update tests to remove use of deprecated methods
- refactor JdbcTokenRepositoryImpl to remove extension of deprecated JdbcDaoSupport class
- enable compile-warnings-error plugin
Closes gh-18441
Signed-off-by: Joe Kuhel <4983938+jkuhel@users.noreply.github.com>
Robert Winch