Cwikius-Spring/spring-security
1
0
Fork 0
mirror of synced 2026-09-14 05:05:17 +00:00
Code Issues Packages Projects Releases Wiki Activity
21,222 Commits 51 Branches 385 Tags
ddcdd461e674214a282e99f7fc1999c69f1ca6a2
Commit Graph
74 Commits
Author SHA1 Message Date
Josh Cummings 118e51d45e Merge branch '7.0.x' into 7.1.x 2026-09-03 15:01:11 -06:00
Tran Ngoc Nhan 27a76a67ae Include code example for reactive onetimetoken 
Signed-off-by: Tran Ngoc Nhan <[email protected]>
 2026-09-03 14:00:44 -07:00
Tran Ngoc Nhan ff6cef0cd2 Include code example for servlet onetimetoken 
Signed-off-by: Tran Ngoc Nhan <[email protected]>
 2026-09-03 14:00:44 -07:00
Josh Cummings b62affe126 Correct Copyright Headers 
This commit updates all headers to have
the same date range.

Signed-off-by: Josh Cummings <[email protected]>
 2026-07-08 17:11:04 -06:00
Josh Cummings 6a029fd853 Merge branch '7.0.x' 2026-05-22 22:05:47 -06:00
Josh Cummings d039e0191f Move Doc Sample to Correct Package 
Issue gh-19128

Signed-off-by: Josh Cummings <[email protected]>
 2026-05-22 22:05:29 -06:00
Josh Cummings 78685cdd77 Merge branch '7.0.x' 2026-05-22 21:37:30 -06:00
Josh Cummings cfdadfea01 Apply Builder Bean Only to Application Endpoints 
A published PathPatternRequestMatcher.Builder bean is intended to align
application endpoint matchers, which commonly are from the same servlet.

This commit ensures that this bean is used by securityMatcher(s),
authorizeHttpRequests, and WebSecurity#ignoring, which target
application endpoints typically served by servlets.

This commit also adds tests ensuring that the bean is not applied to filter-chain
security endpoints such as those configured by formLogin, logout,
oneTimeTokenLogin, OAuth 2.0 Login, and SAML 2.0 Login, since
these endpoints are, by default, handled by filters independent from
any target servlet and servlet path.

Closes gh-19128

Signed-off-by: Josh Cummings <[email protected]>
 2026-05-22 21:36:19 -06:00
Robert Winch ff820a868e Polish AllRequiredFactorsAuthorizationManager.anyOf 
- Add validation
- Extract to static inner class
- Uniqueness determined by Set rather than requiredFactor
  This is important for the failure with the same RequiredFactor, but a
  different reason
- Add documentation

Signed-off-by: Robert Winch <[email protected]>
 2026-03-31 14:03:29 -05:00
Andrey Litvitski b92c072501 add tests 
Signed-off-by: Andrey Litvitski <[email protected]>
 2026-03-27 15:26:57 -06:00
Andrey Litvitski 6335caabae polish 
Signed-off-by: Andrey Litvitski <[email protected]>
 2026-03-27 15:26:57 -06:00
Andrey Litvitski c3e0b98b7e Use idiomatic Kotlin in custom filter documentation 
This will make Kotlin and all users more native and readable.

Closes: gh-18967

Signed-off-by: Andrey Litvitski <[email protected]>
 2026-03-27 15:26:57 -06:00
Josh Cummings de14d9684f Add Reference Docs for DelegatingJwtGrantedAuthoritiesConverter 
Issue gh-18300

Signed-off-by: Josh Cummings <[email protected]>
 2026-03-27 12:13:49 -06:00
Robert Winch 4199240662 Add Support for PreFlightRequestFilter 
Closes gh-18926
 2026-03-25 16:04:42 -04:00
Joe Grandja baad23caab Enable null-safety in spring-security-oauth2-client 
Closes gh-17819
 2026-03-18 05:04:30 -04:00
Robert Winch ea2f2302da Add MultiFactorCondition.WEBAUTHN_REGISTERED 
Closes gh-18923
 2026-03-17 17:20:58 -05:00
Robert Winch bd7171140e Support Customizer<AdditionalRequiredFactorsBuilder<Object>>> 
Closes gh-18922
 2026-03-17 17:20:58 -05:00
Robert Winch 28acf62936 AuthorizationManagerFactories.when 
Closes gh-18920
 2026-03-17 17:20:58 -05:00
Robert Winch 8224b16caf Add ConditionalAuthorizationManager 
Closes gh-18919
 2026-03-17 17:20:57 -05:00
Joe Grandja 22a98583f1 Enable null-safety in spring-security-oauth2-jose 
Closes gh-17821
 2026-03-13 11:58:29 -04:00
Tran Ngoc Nhan 0f7a6d45fd Polish websocket 
Signed-off-by: Tran Ngoc Nhan <[email protected]>
 2026-03-09 15:59:27 -04:00
Josh Cummings 587ac2cbad Move Snippets to Compiled Code 
Issue gh-18745

Signed-off-by: Josh Cummings <[email protected]>
 2026-03-02 16:20:22 -07:00
Josh Cummings 50caf0cb28 Merge branch '7.0.x' 2026-02-26 15:57:27 -07:00
Tran Ngoc Nhan 7c3c8bbdcb Update Remember-Me example 
Closes gh-18639

Signed-off-by: Tran Ngoc Nhan <[email protected]>
 2026-02-26 15:28:32 -07:00
Josh Cummings e30d9240c9 Add Docs for Custom Jwt Principal Converters 
Issue gh-6237

Signed-off-by: Josh Cummings <[email protected]>
 2026-02-26 12:28:50 -07:00
Robert Winch 0c394696ce Fix servlet/architecture.adoc disable Sample 
- Switch `include-java` (does not exist) to `include-code`
- Update kotlin to have the `disable` tag
- Update to suppress deprecation use for User builder (allowed for samples)

Signed-off-by: Robert Winch <[email protected]>
 2026-02-23 17:03:17 -06:00
Joe Kuhel 62d1bc86e3 Update servlet architecture docs to use include-code 
Also update antora.xml to include-xml in docs/src/test/resources

Signed-off-by: Joe Kuhel <[email protected]>
 2026-02-23 16:37:16 -06:00
Chen He d65625e399 Update BCryptPasswordEncoder example in password-storage.adoc 
Replaces the usage of BCryptPasswordEncoder with
BcryptPassword4jPasswordEncoder in documentation samples.

Signed-off-by: Chen He <[email protected]>
 2026-02-19 14:29:53 -06:00
Josh Cummings 705fa60a01 Document Method Security hasScope Support 
Issue gh-18013

Signed-off-by: Josh Cummings <[email protected]>
 2026-02-10 15:23:32 -07:00
Josh Cummings 688b6ca733 Add Documentation for ExpressionJwtGrantedAuthoritiesConverter 
Closes gh-18300
 2026-02-10 09:11:26 -07:00
Tran Ngoc Nhan 8bafd94b1f Add compile-warnings-error 
Closes gh-18424

Signed-off-by: Tran Ngoc Nhan <[email protected]>
 2026-02-02 11:37:39 -06:00
Tran Ngoc Nhan 3d9bc6a5cf Update mfa.adoc 
Signed-off-by: Tran Ngoc Nhan <[email protected]>
 2026-01-09 09:21:02 -06:00
Rob Winch 884cf0d62e EnableGlobalMultiFactorAuthentication->EnableMultiFactorAuthentication 
Closes gh-18127
 2025-11-03 22:42:28 -06:00
Josh Cummings da46ba2619 Update Password Samples for Nullability 
Issue gh-16226
 2025-10-20 17:04:22 -06:00
Josh Cummings a406f5fe2d Merge remote-tracking branch 'origin/6.5.x' 2025-10-20 16:46:49 -06:00
Himanshu Pareek dcb4e47cd5 Add Include-Code to the Password Storage page 
References gh-16226

Signed-off-by: Himanshu Pareek <[email protected]>
 2025-10-20 16:35:23 -06:00
Josh Cummings 9c7b34a48b Favor Relative Redirects by Default 
Closes gh-16300
 2025-10-20 10:25:17 -06:00
Josh Cummings ba42b9c4cc Update Documentation for All-Factor Propagation 
Issue gh-18000
 2025-10-16 13:41:46 -06:00
Josh Cummings 2e7cdd7b14 Revert "Merge branch 'builder-enhancements'" 
This reverts commit 95644fb73c, reversing
changes made to fbf7bb3be1.

Reverting this commit will allow us more time to
consider the ideal way to add this support to the public API.
 2025-10-16 13:41:45 -06:00
Josh Cummings e535e61c8b Move toBuilder to BuildableAuthentication 
Closes gh-18052
 2025-10-15 12:01:11 -06:00
Rob Winch 78701f94ee Document RequiredFactor Valid Duration 
Issue gh-17997
 2025-10-10 16:24:47 -05:00
Rob Winch 702878acae Create AuthorizationManagerFactories.multiFactor 
Closes gh-18032
 2025-10-10 16:24:47 -05:00
Rob Winch d18431a78d Move FACTOR_ constants to FactorGrantedAuthority 
Previously GrantedAuthorities had an implicit package tangle because it
was located in ~.core and FactorGrantedAuthority is in ~.core.authority
and FactorGrantedAuthority's authority property was implicitly expected
to be constants found in `GrantedAuthorities`.

This commit moves the constants to the FactorGrantedAuthority which
resolves this tangle. It wasn't initially done because
FactorGrantedAuthority did not exist at that time.

Closes gh-18030
 2025-10-10 16:24:46 -05:00
Rob Winch e290c98e97 Document Multi-Factor Simple to Complex 
This reworks the Multi-Factor documentation to start with the
simplest scenario and work to progressively more complex requirements.

Closes gh-18029
 2025-10-10 16:23:38 -05:00
Rob Winch 2473378fcd Use RequiredFactorErrors 
Closes gh-18002
 2025-10-03 15:20:03 -05:00
Rob Winch 667cd4aa7c Remove unnecessary throws Exception from spring-security-config 
Closes gh-17957
 2025-09-25 11:50:13 -05:00
Josh Cummings ad6fe4fdc3 Polish MFA Samples 
This commit removes unneeded AuthorizationManagerFactory
implementations, simplifies the custom AuthorizationManagerFactory
example, and updates usage of hasAllAuthorities.

Issue gh-17934
 2025-09-24 17:54:59 -06:00
Rob Winch f652920bb3 Add @EnableGlobalMultiFactorAuthentication 
Closes gh-17954
 2025-09-24 14:47:26 -05:00
Rob Winch e33e4d80a9 Fix Antora Warnings in servlet/authentication/adaptive.adoc 
Issue gh-2603
 2025-09-24 13:05:50 -05:00
Rob Winch b2d76dfe66 Add GrantedAuthorities.FACTOR_*_AUTHORITY 
Closes gh-17952
 2025-09-24 09:53:56 -05:00