e113bd3c01
issue 5414 - configurable secure flag in CookieCsrfTokenRepository
...
While using the request's "isSecure" flag is a reasonable default, when webapps sit behind firewalls, sometimes the firewall does the SSL, and the traffic between the firewall and the app is plain HTTP (not HTTPS). In this case the "isSecure" flag on the request is always false, but we still want th XSRF-TOKEN cookie to be secure (the firewall forwards all cookies to the app, and the browser sends the secure cookie to the firewall).
It would be nice if we could configure the desired value for the secure flag of the cookie, just like we can configure the value for the httpOnly flag of the cookie.
2020-06-25 14:42:38 -05:00
c71352c548
Validate headers and parameters in StrictHttpFirewall
...
Adds methods to configure validation of header names and values and
parameter names and values:
* setAllowedHeaderNames(Predicate)
* setAllowedHeaderValues(Predicate)
* setAllowedParameterNames(Predicate)
* setAllowedParameterValues(Predicate)
By default, header names, header values, and parameter names that
contain ISO control characters or unassigned unicode characters are
rejected. No parameter value validation is performed by default.
Issue gh-8644
2020-06-24 14:15:46 -06:00
12d20f99a1
Fix incorrect Javadoc
...
Closes gh-8744
2020-06-22 13:14:34 +02:00
c854f6b190
Add missing Javadoc
...
Closes gh-8743
2020-06-22 13:13:32 +02:00
efb6953017
Reject the NULL character in paths in StrictHttpFirewall
...
Adds `setAllowNull`
By default, denies null in paths
2020-06-18 10:19:37 -06:00
ccbad61ae8
Change blacklist to blocklist
...
Closes gh-8676
2020-06-10 11:49:49 -05:00
ca1252be94
Replace whitelist with allowlist
...
Issue gh-8676
2020-06-10 11:49:21 -05:00
a907026eae
Deprecate X-FRAME-OPTIONS ALLOW-FROM Directive
...
Closes gh-8677
2020-06-10 11:48:56 -05:00
da4b626bf1
OAuth2LoginAuthenticationWebFilter should handle OAuth2AuthorizationException
...
Issue gh-8609
2020-06-09 17:28:21 -04:00
0a42aa26c8
Mock request with non-standard HTTP method in test
...
Fixes gh-8594
2020-05-26 10:16:56 -04:00
f08ca4e688
Throw exception if URL does not include context path when context relative
...
Issue: gh-8399
2020-05-20 14:02:17 -04:00
dc514b369e
FilterInvocation Support Default Methods on HttpServletRequest
...
Closes gh-8566
2020-05-20 10:13:59 -05:00
bfb401eeed
Create the CSRF token on the bounded elactic scheduler
...
The CSRF token is created with a call to UUID.randomUUID which is blocking.
This change ensures this blocking call is done on the bounded elastic scheduler which supports blocking calls.
Fixes gh-8128
2020-05-18 11:04:54 -05:00
cd08102b93
Add debug logging
...
Goal is to provide insight to devs on:
- Authentication & Authorization success/failures
- WebSession & SecurityContext
- Request matchers, cache & authn/authz flow
Fixes gh-5758
2020-05-12 09:03:24 -05:00
4473dca022
Polish matchesRequireCsrfProtectionWhenNonStandardHTTPMethodIsUsed
...
Issue gh-8149
2020-05-11 17:20:16 -05:00
0f92415395
Fix non-standard HTTP method for CsrfWebFilter
...
Closes gh-8149
2020-05-11 17:19:57 -05:00
6db514a4e2
Update AntPathRequestMatcher.java
...
Fixed typo in JavaDoc. Actually, In these two cases, we are calling the constructor with a `boolean caseSensitive` which is equal to true. This means case sensitive
2020-05-11 17:11:22 -04:00
86ca6b013c
Unlock dependencies
...
This reverts commit 206960cf44
2020-05-06 17:27:35 -04:00
206960cf44
Lock dependencies for 5.4.0-M1
2020-05-06 17:13:04 -04:00
0483b3e042
Polish RequestRejectedHandler
...
Issue gh-5007
2020-05-01 10:51:11 -05:00
b826c798f7
Add RequestRejectedHandler
...
Closes gh-5007
2020-05-01 10:51:01 -05:00
b7d3acc02c
Add constructors to AbstractAuthenticationProcessingFilter
...
Closes gh-8309
2020-04-09 13:53:06 -05:00
6bdd5f710f
Fix example in javadoc of FilterChainProxy
2020-04-07 21:05:12 +03:00
91728ef53b
Fix HttpServlet3RequestFactory Logout Handlers
...
Previously there was a problem with Servlet API logout integration
when Servlet API was configured before log out.
This ensures that logout handlers is a reference to the logout handlers
vs copying the logout handlers. This ensures that the ordering does not
matter.
Closes gh-4760
2020-03-30 17:50:28 -05:00
eed71243cb
SwitchUserFilter Defaults to POST
...
Fixes gh-4183
2020-03-27 13:41:49 -06:00
935c547dde
Fix exception for empty basic auth header token
...
fixes spring-projectsgh-7976
2020-03-16 12:57:13 -04:00
47011eb9e2
Polish transfer session's max inactive interval
...
Issue: gh-2693
2020-03-12 12:11:14 -04:00
02b7d04027
Transfer session's max inactive interval
...
Fixes: gh-2693
2020-03-12 10:11:59 -04:00
b2ea0ba775
Polish SessionIdChangedEvent
...
Add AbstractSessionEvent; clean up license headers and Javadocs
Fixes: gh-5438
2020-03-06 12:04:49 -05:00
5fc6414377
SessionRegistryImpl is now aware of SessionIdChangedEvent
2020-03-06 12:04:01 -05:00
ae532c080c
Add server request cache that uses cookie
...
Fixes: gh-8033
2020-03-05 15:36:47 -05:00
38979b1b09
Add test for ServerRequestCacheWebFilter
2020-03-05 14:57:07 -05:00
6eadf7b140
Unlock dependencies for 5.3.0.RELEASE
...
This reverts commit 147d7dadd7
2020-03-04 12:02:48 -07:00
147d7dadd7
Lock dependencies for 5.3.0.RELEASE
2020-03-04 10:28:39 -07:00
2ce9eef95e
Fix typo in AntPathRequestMatcher contructor comment
2020-03-02 07:14:27 -06:00
82cd203791
Remove unnecessary mocking
...
Fixes gh-8012
2020-02-23 19:35:16 -05:00
5bdf57d1e5
Remove Groovy and Spock Dependencies
...
Fixes gh-4939
2020-02-10 10:38:40 -07:00
bae50ecc05
AbstractSecurityWebApplicationInitializerTests groovy->java
...
Issue gh-4939
2020-02-10 10:38:39 -07:00
84b8a5abd7
Unlock dependencies for next development version
...
This reverts commit 064616f1ef
2020-02-05 15:53:04 +01:00
064616f1ef
Lock dependencies for 5.3.0.RC1
2020-02-05 10:20:05 +01:00
cb9fd09150
Change AuthenticationWebFilter's constructor
...
Fixes gh-7872
2020-01-31 09:31:28 -07:00
e62fb755e8
Set charset of BasicAuthenticationFilter converter
...
Allow BasicAuthenticationFilter to pick up the given credentials charset.
Fixes: gh-7835
2020-01-23 15:34:35 +01:00
1f6381d970
Set secure on cookie when logging out
...
Mark cookie secure flag to ensure cookie identity is the same
2020-01-13 11:01:33 +01:00
ffccec953f
Fix HttpHeaderWriterWebFilterTests
...
Ensure setComplete() is subscribed to
2020-01-09 14:24:35 -06:00
fcc6457bef
Unlock dependencies for next development version
...
This reverts commit 93acf8f0f1
2020-01-08 22:15:17 +01:00
93acf8f0f1
Lock dependencies for 5.3.0.M1
2020-01-08 19:41:10 +01:00
2015f392ef
Set secure when cancelling remember-me cookie
...
AbstractRememberMeServices is setting remember-me cookie with checking request is secure or secure usage is independently set to a fixed flag.
But when cancelling a cookie, cookie is not being marked secure or not. It produces an inconsistency when using secure flag as a part to identity of cookie.
2019-12-20 16:04:31 +01:00
a8331ba7ed
CompositeServerHttpHeadersWriter Executes Sequentially
...
Fixes gh-7731
2019-12-12 11:23:56 -06:00
64e063d948
switches web authentication principal resolver to use reactive context
...
gh #6598
Signed-off-by: David Herberth <github@dav1d.de >
2019-12-12 15:33:23 +01:00
8e53c3f269
DelegatingServerAuthenticationSuccessHandler Executes Sequentially
...
Fixes gh-7728
2019-12-12 08:32:44 -06:00
michal