Cwikius-Spring/spring-security
1
0
Fork 0
mirror of synced 2026-09-12 20:25:06 +00:00
Code Issues Packages Projects Releases Wiki Activity
21,239 Commits 50 Branches 385 Tags
c7be397a1617cd3b107c27534f418c8a71f83c2d
Commit Graph

21239 Commits

This Branch
This Branch
All Branches
Author SHA1 Message Date
Josh Cummings c7be397a16 Merge branch '7.1.x' 
# Conflicts:
#	docs/modules/ROOT/pages/reactive/authentication/onetimetoken.adoc
#	docs/modules/ROOT/pages/servlet/authentication/onetimetoken.adoc
 2026-09-03 15:14:01 -06:00
Josh Cummings 118e51d45e Merge branch '7.0.x' into 7.1.x 2026-09-03 15:01:11 -06:00
Tran Ngoc Nhan 27a76a67ae Include code example for reactive onetimetoken 
Signed-off-by: Tran Ngoc Nhan <ngocnhan.tran1996@gmail.com>
 2026-09-03 14:00:44 -07:00
Tran Ngoc Nhan ff6cef0cd2 Include code example for servlet onetimetoken 
Signed-off-by: Tran Ngoc Nhan <ngocnhan.tran1996@gmail.com>
 2026-09-03 14:00:44 -07:00
Josh Cummings 2e52e1063a Merge branch '7.1.x' 
Closes gh-19646
 2026-09-03 12:27:03 -06:00
Josh Cummings 801f890ed0 Merge branch '7.0.x' into 7.1.x 
Closes gh-9175 on 7.1.x
 2026-09-03 12:26:14 -06:00
Josh Cummings 1a7769be28 Fix Checkstyle 
Issue gh-9175

Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
 2026-09-03 11:18:58 -07:00
Dmitrii Bocharov bdf501fe87 Fix HeaderWriterFilter Race Condition 
Closes gh-9175

Signed-off-by: Dmitrii Bocharov <bdshadow@gmail.com>
 2026-09-03 11:18:58 -07:00
avsan b26d968c1c Simplify ProviderManager null provider check 
Use Assert.noNullElements to validate configured AuthenticationProviders
without relying on CollectionUtils.contains.

Preserve the existing null-provider validation behavior.

Closes gh-19510

Signed-off-by: avsan <abhishekrajabca@gmail.com>
 2026-09-03 11:10:09 -07:00
Josh Cummings 3070c96594 Add authenticationSuccessHandler to Reactive Resource Server Kotlin DSL 
Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
 2026-09-01 18:14:07 -07:00
Josh Cummings 6eb7ef6e6d Update What's New 
Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
 2026-09-01 18:14:07 -07:00
Josh Cummings 988ba6b33c Align Formatting 
Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
 2026-09-01 18:14:07 -07:00
Iain Henderson d1fb6141c1 Add authenticationSuccessHandler to Reactive Resource Server DSL 
Signed-off-by: Iain Henderson <Iain.henderson@mac.com>
 2026-09-01 18:14:07 -07:00
Josh Cummings 43f5ae5b21 Remove Auto-merge for .x Branches 
Closes gh-19632

Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
 2026-08-31 10:43:16 -06:00
Josh Cummings b2a6bbf314 Merge branch '7.1.x' 2026-08-31 10:42:04 -06:00
Josh Cummings a161421409 Turn Off Auto-merge for Maintenance Branch 
This commit removes the auto-merge workflow on 7.1.x since it
is a maintenance branch.

Closes gh-19631

Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
 2026-08-31 10:41:54 -06:00
Joe Grandja 36aa2ad744 Merge branch '7.1.x' 2026-08-31 12:02:21 -04:00
Josh Cummings ed4e0e2ea8 Merge branch '7.1.x' 2026-08-31 09:55:00 -06:00
Joe Grandja 978eb4396a Polish gh-19585 2026-08-31 11:09:18 -04:00
Evgeniy Cheban 770c860d9d Ensure WebSession ID is not changed after token refresh (Reactive) 
Closes gh-19424

Signed-off-by: Evgeniy Cheban <mister.cheban@gmail.com>
 2026-08-31 10:11:13 -04:00
dependabot[bot] 11890f2f49 Bump io.spring.gradle:spring-security-release-plugin 
Bumps [io.spring.gradle:spring-security-release-plugin](https://github.com/spring-io/spring-security-release-tools) from 1.0.16 to 1.0.17.
- [Release notes](https://github.com/spring-io/spring-security-release-tools/releases)
- [Changelog](https://github.com/spring-io/spring-security-release-tools/blob/main/RELEASE.adoc)
- [Commits](https://github.com/spring-io/spring-security-release-tools/compare/v1.0.16...v1.0.17)

---
updated-dependencies:
- dependency-name: io.spring.gradle:spring-security-release-plugin
  dependency-version: 1.0.17
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-28 03:17:31 +00:00
dependabot[bot] 5809451de7 Bump spring-io/spring-release-actions/compute-next-version 
Bumps [spring-io/spring-release-actions/compute-next-version](https://github.com/spring-io/spring-release-actions) from 0.0.5 to 0.0.6.
- [Release notes](https://github.com/spring-io/spring-release-actions/releases)
- [Commits](https://github.com/spring-io/spring-release-actions/compare/a1f321783a0769dd2aea4fad6c2ae2f95a52b885...1b8671612c3eb3d9b9763e2d7b66f1a80d00ee95)

---
updated-dependencies:
- dependency-name: spring-io/spring-release-actions/compute-next-version
  dependency-version: 0.0.6
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-28 00:50:20 +00:00
dependabot[bot] 31d379a7bf Bump spring-io/spring-security-release-tools/.github/workflows/release-announcements-stage.yml 
Bumps [spring-io/spring-security-release-tools/.github/workflows/release-announcements-stage.yml](https://github.com/spring-io/spring-security-release-tools) from 1.0.16 to 1.0.17.
- [Release notes](https://github.com/spring-io/spring-security-release-tools/releases)
- [Changelog](https://github.com/spring-io/spring-security-release-tools/blob/main/RELEASE.adoc)
- [Commits](https://github.com/spring-io/spring-security-release-tools/compare/d6c65d3013c0888e2c9cbae9f4beda610994776c...3f6cc7ffc137ca160061749d5f34dc30d5f36986)

---
updated-dependencies:
- dependency-name: spring-io/spring-security-release-tools/.github/workflows/release-announcements-stage.yml
  dependency-version: 1.0.17
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-28 00:47:19 +00:00
dependabot[bot] 825370f8e3 Bump spring-io/spring-security-release-tools/.github/workflows/deploy-schema.yml 
Bumps [spring-io/spring-security-release-tools/.github/workflows/deploy-schema.yml](https://github.com/spring-io/spring-security-release-tools) from 1.0.15 to 1.0.17.
- [Release notes](https://github.com/spring-io/spring-security-release-tools/releases)
- [Changelog](https://github.com/spring-io/spring-security-release-tools/blob/main/RELEASE.adoc)
- [Commits](https://github.com/spring-io/spring-security-release-tools/compare/v1.0.15...3f6cc7ffc137ca160061749d5f34dc30d5f36986)

---
updated-dependencies:
- dependency-name: spring-io/spring-security-release-tools/.github/workflows/deploy-schema.yml
  dependency-version: 1.0.17
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-28 00:47:16 +00:00
Josh Cummings 61feae94a0 Merge branch '7.1.x' 2026-08-26 10:17:45 -06:00
Josh Cummings edaae1d17d Merge branch '7.0.x' into 7.1.x 2026-08-26 10:17:34 -06:00
dependabot[bot] e8084090ff Bump org.hibernate.orm:hibernate-core from 7.4.5.Final to 7.4.6.Final 
Bumps [org.hibernate.orm:hibernate-core](https://github.com/hibernate/hibernate-orm) from 7.4.5.Final to 7.4.6.Final.
- [Release notes](https://github.com/hibernate/hibernate-orm/releases)
- [Changelog](https://github.com/hibernate/hibernate-orm/blob/7.4.6/changelog.txt)
- [Commits](https://github.com/hibernate/hibernate-orm/compare/7.4.5...7.4.6)

---
updated-dependencies:
- dependency-name: org.hibernate.orm:hibernate-core
  dependency-version: 7.4.6.Final
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-26 03:24:42 +00:00
dependabot[bot] 4773b40f02 Bump gradle-wrapper from 9.7.0 to 9.7.1 
Bumps [gradle-wrapper](https://github.com/gradle/gradle) from 9.7.0 to 9.7.1.
- [Release notes](https://github.com/gradle/gradle/releases)
- [Commits](https://github.com/gradle/gradle/compare/v9.7.0...v9.7.1)

---
updated-dependencies:
- dependency-name: gradle-wrapper
  dependency-version: 9.7.1
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-24 03:28:40 +00:00
dependabot[bot] 9a4a965b0d Bump io.spring.gradle:spring-security-release-plugin 
Bumps [io.spring.gradle:spring-security-release-plugin](https://github.com/spring-io/spring-security-release-tools) from 1.0.15 to 1.0.16.
- [Release notes](https://github.com/spring-io/spring-security-release-tools/releases)
- [Changelog](https://github.com/spring-io/spring-security-release-tools/blob/main/RELEASE.adoc)
- [Commits](https://github.com/spring-io/spring-security-release-tools/compare/v1.0.15...v1.0.16)

---
updated-dependencies:
- dependency-name: io.spring.gradle:spring-security-release-plugin
  dependency-version: 1.0.16
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
 2026-08-24 03:27:38 +00:00
Josh Cummings 0bae8a73d1 Next Development Version 
Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
 2026-08-21 09:14:37 -06:00
Josh Cummings 461ccd817d Next Development Version 
Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
 2026-08-21 09:14:09 -06:00
Josh Cummings d449950b36 Merge branch '7.1.x' 
Closes gh-19573
 2026-08-20 16:58:15 -06:00
Josh Cummings 8dc341af8c Merge branch '7.0.x' into 7.1.x 
Closes gh-19572
 2026-08-20 16:58:02 -06:00
Josh Cummings 381c556f78 Add Release Announcement Workflows 
Closes gh-19571

Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
 2026-08-20 16:57:48 -06:00
Josh Cummings 19afc9121e Merge branch '7.1.x' 
Closes gh-19568
# Conflicts:
#	gradle/libs.versions.toml
 2026-08-20 12:29:12 -06:00
Josh Cummings 6b2f892e66 Merge branch '7.0.x' into 7.1.x 
Closes gh-19567
# Conflicts:
#	config/src/main/java/org/springframework/security/config/annotation/web/configurers/oauth2/server/resource/DPoPAuthenticationConfigurer.java
#	config/src/main/java/org/springframework/security/config/annotation/web/configurers/oauth2/server/resource/OAuth2ResourceServerConfigurer.java
#	config/src/test/java/org/springframework/security/config/annotation/web/configurers/oauth2/server/resource/DPoPAuthenticationTests.java
#	gradle/libs.versions.toml
#	oauth2/oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/InMemoryOAuth2AuthorizationService.java
#	oauth2/oauth2-jose/src/main/java/org/springframework/security/oauth2/jwt/DPoPProofJwtDecoderFactory.java
#	oauth2/oauth2-jose/src/main/java/org/springframework/security/oauth2/jwt/DPoPProofReplayValidator.java
#	oauth2/oauth2-resource-server/src/main/java/org/springframework/security/oauth2/server/resource/authentication/DPoPAuthenticationProvider.java
 2026-08-20 12:23:20 -06:00
Josh Cummings 3b276e6c0d Update to Spring Data 2025.1.7 
Closes gh-19485

Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
 2026-08-20 11:24:08 -06:00
Josh Cummings f2115fbef8 Update to Spring LDAP 4.0.5 
Closes gh-19486

Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
 2026-08-20 11:24:01 -06:00
Josh Cummings 298335a57e Update to Micrometer 1.16.7 
Closes gh-19484

Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
 2026-08-20 11:23:55 -06:00
Josh Cummings c6566ee772 Update to Reactor 2025.0.7 
Closes gh-19483

Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
 2026-08-20 11:23:50 -06:00
Josh Cummings 7442214225 Update to Spring Framework 7.0.9 
Closes gh-19482

Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
 2026-08-20 11:23:44 -06:00
Josh Cummings 0123ae0981 Deprecate AesBytesEncryptor 
This commit separates AesBytesEncryptor into two separate
implememtations, allowing for a migration away from default
arrangements that used a null IV

Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
 2026-08-20 11:23:36 -06:00
Josh Cummings 11a648d106 Improve Equivalence Tests 
This commit adds equals and hashCode implementations as well
as a readResolve implementation to ensure that deserialization
mechanisms can correctly assess the equality of a constnat
and a corresponding deserialized instance. For defense-in-depth
reasons, this commit also favors .equals over == for these
constants.

Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
 2026-08-20 11:23:29 -06:00
Joe Grandja 536e09756c Bind UnboundIdContainer to loopback address 2026-08-20 11:23:22 -06:00
Joe Grandja ac15cdbea3 Apply html encoding in DefaultConsentPage 2026-08-20 11:23:14 -06:00
Joe Grandja ad812aefc4 Provide ability to configure DPoP proof replay 2026-08-20 11:23:08 -06:00
Josh Cummings d8769fb183 Use Constant-Time Comparison 
This commit updates password encoders to use a
constant-time comparison method to defend against
timing attacks

Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
 2026-08-20 11:23:02 -06:00
Josh Cummings ae997a4f46 Use Utf8#isEqual 
Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
 2026-08-20 11:22:55 -06:00
Josh Cummings bbc6273abf Use Constant-Time Equals 
This commit updates the filter to use constant-time
equals for sensitive material

Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
 2026-08-20 11:22:49 -06:00
Josh Cummings 475af0d3db Use Constant-Time Equals 
This commit updates the filter to use constant-time
equals for sensitive material

Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
 2026-08-20 11:22:43 -06:00