Release 6.1.4

Automate spring-security.xsd

Closes gh-13825

build.gradle

@@ -1,4 +1,5 @@
 import io.spring.gradle.IncludeRepoTask
+import trang.RncToXsd
 
 buildscript {
 	dependencies {
@@ -174,7 +175,7 @@ if (hasProperty('buildScan')) {
 
 nohttp {
 	source.exclude "buildSrc/build/**"
-
+	source.builtBy(project(':spring-security-config').tasks.withType(RncToXsd))
 }
 
 tasks.register('cloneSamples', IncludeRepoTask) {

buildSrc/src/main/groovy/io/spring/gradle/convention/JacocoPlugin.groovy

@@ -34,7 +34,7 @@ class JacocoPlugin implements Plugin<Project> {
 			project.tasks.check.dependsOn project.tasks.jacocoTestReport
 
 			project.jacoco {
-				toolVersion = '0.8.7'
+				toolVersion = '0.8.9'
 			}
 		}
 	}

buildSrc/src/main/groovy/io/spring/gradle/convention/SchemaZipPlugin.groovy

@@ -4,6 +4,7 @@ import org.gradle.api.Plugin
 import org.gradle.api.Project
 import org.gradle.api.plugins.JavaPlugin
 import org.gradle.api.tasks.bundling.Zip
+import org.springframework.gradle.xsd.CreateVersionlessXsdTask
 
 public class SchemaZipPlugin implements Plugin<Project> {
 
@@ -15,7 +16,10 @@ public class SchemaZipPlugin implements Plugin<Project> {
 		schemaZip.archiveClassifier = 'schema'
 		schemaZip.description = "Builds -${schemaZip.archiveClassifier} archive containing all " +
 			"XSDs for deployment at static.springframework.org/schema."
-
+		def versionlessXsd = project.tasks.create("versionlessXsd", CreateVersionlessXsdTask) {
+			description = "Generates spring-security.xsd"
+			versionlessXsdFile = project.layout.buildDirectory.file("versionlessXsd/spring-security.xsd")
+		}
 		project.rootProject.subprojects.each { module ->
 
 			module.getPlugins().withType(JavaPlugin.class).all {
@@ -36,17 +40,14 @@ public class SchemaZipPlugin implements Plugin<Project> {
 						duplicatesStrategy 'exclude'
 						from xsdFile.path
 					}
-				}
-				File symlink = module.sourceSets.main.resources.find {
-					it.path.endsWith('org/springframework/security/config/spring-security.xsd')
-				}
-				if (symlink != null) {
-					schemaZip.into('security') {
-						duplicatesStrategy 'exclude'
-						from symlink.path
-					}
+					versionlessXsd.getInputFiles().from(xsdFile.path)
 				}
 			}
 		}
+
+        schemaZip.into("security") {
+            from(versionlessXsd.getOutputs())
+        }
+
 	}
 }

buildSrc/src/main/java/org/springframework/gradle/xsd/CreateVersionlessXsdTask.java

@@ -0,0 +1,147 @@
+/*
+ * Copyright 2019-2023 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.gradle.xsd;
+
+import org.gradle.api.DefaultTask;
+import org.gradle.api.file.ConfigurableFileCollection;
+import org.gradle.api.file.RegularFileProperty;
+import org.gradle.api.tasks.*;
+import org.gradle.work.DisableCachingByDefault;
+
+import java.io.File;
+import java.io.IOException;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.nio.file.StandardCopyOption;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
+
+/**
+ * Creates the spring-security.xsd automatically
+ *
+ * @author Rob Winch
+ */
+@DisableCachingByDefault(because = "not worth it")
+public abstract class CreateVersionlessXsdTask extends DefaultTask {
+
+	@InputFiles
+	public abstract ConfigurableFileCollection getInputFiles();
+
+	@OutputFile
+	abstract RegularFileProperty getVersionlessXsdFile();
+
+	@TaskAction
+	void createVersionlessXsd() throws IOException {
+		XsdFileMajorMinorVersion largest = null;
+		ConfigurableFileCollection inputFiles = getInputFiles();
+		if (inputFiles.isEmpty()) {
+			throw new IllegalStateException("No Inputs configured");
+		}
+		for (File file : inputFiles) {
+			XsdFileMajorMinorVersion current = XsdFileMajorMinorVersion.create(file);
+			if (current == null) {
+				continue;
+			}
+			if (largest == null) {
+				largest = current;
+			}
+			else if (current.getVersion().isGreaterThan(largest.getVersion())) {
+				largest = current;
+			}
+		}
+		if (largest == null) {
+			throw new IllegalStateException("Could not create versionless xsd file because no files matching spring-security-<digit>.xsd were found in " + inputFiles.getFiles());
+		}
+		Path to = getVersionlessXsdFile().getAsFile().get().toPath();
+		Path from = largest.getFile().toPath();
+		Files.copy(from, to, StandardCopyOption.REPLACE_EXISTING, StandardCopyOption.COPY_ATTRIBUTES);
+	}
+
+	static class XsdFileMajorMinorVersion {
+		private final File file;
+
+		private final MajorMinorVersion version;
+
+		private XsdFileMajorMinorVersion(File file, MajorMinorVersion version) {
+			this.file = file;
+			this.version = version;
+		}
+
+		private static final Pattern FILE_MAJOR_MINOR_VERSION_PATTERN = Pattern.compile("^spring-security-(\\d+)\\.(\\d+)\\.xsd$");
+
+		/**
+		 * If matches xsd with major minor version (e.g. spring-security-5.1.xsd returns it, otherwise null
+		 * @param file
+		 * @return
+		 */
+		static XsdFileMajorMinorVersion create(File file) {
+			String fileName = file.getName();
+			Matcher matcher = FILE_MAJOR_MINOR_VERSION_PATTERN.matcher(fileName);
+			if (!matcher.find()) {
+				return null;
+			}
+			int major = Integer.parseInt(matcher.group(1));
+			int minor = Integer.parseInt(matcher.group(2));
+			MajorMinorVersion version = new MajorMinorVersion(major, minor);
+			return new XsdFileMajorMinorVersion(file, version);
+		}
+
+		public File getFile() {
+			return file;
+		}
+
+		public MajorMinorVersion getVersion() {
+			return version;
+		}
+	}
+
+	static class MajorMinorVersion {
+		private final int major;
+
+		private final int minor;
+
+		MajorMinorVersion(int major, int minor) {
+			this.major = major;
+			this.minor = minor;
+		}
+
+		public int getMajor() {
+			return major;
+		}
+
+		public int getMinor() {
+			return minor;
+		}
+
+		public boolean isGreaterThan(MajorMinorVersion version) {
+			if (getMajor() > version.getMajor()) {
+				return true;
+			}
+			if (getMajor() < version.getMajor()) {
+				return false;
+			}
+			if (getMinor() > version.getMinor()) {
+				return true;
+			}
+			if (getMinor() < version.getMinor()) {
+				return false;
+			}
+			// they are equal
+			return false;
+		}
+	}
+}

buildSrc/src/test/java/org/springframework/gradle/xsd/CreateVersionlessXsdTaskTests.java

@@ -0,0 +1,94 @@
+/*
+ * Copyright 2019-2023 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.gradle.xsd;
+
+import org.junit.jupiter.api.Test;
+import org.springframework.gradle.xsd.CreateVersionlessXsdTask.MajorMinorVersion;
+import org.springframework.gradle.xsd.CreateVersionlessXsdTask.XsdFileMajorMinorVersion;
+
+import java.io.File;
+
+import static org.assertj.core.api.AssertionsForClassTypes.assertThat;
+
+/**
+ * @author Rob Winch
+ */
+class CreateVersionlessXsdTaskTests {
+
+	@Test
+	void xsdCreateWhenValid() {
+		File file = new File("spring-security-2.0.xsd");
+		XsdFileMajorMinorVersion xsdFile = XsdFileMajorMinorVersion.create(file);
+		assertThat(xsdFile).isNotNull();
+		assertThat(xsdFile.getFile()).isEqualTo(file);
+		assertThat(xsdFile.getVersion().getMajor()).isEqualTo(2);
+		assertThat(xsdFile.getVersion().getMinor()).isEqualTo(0);
+	}
+
+	@Test
+	void xsdCreateWhenPatchReleaseThenNull() {
+		File file = new File("spring-security-2.0.1.xsd");
+		XsdFileMajorMinorVersion xsdFile = XsdFileMajorMinorVersion.create(file);
+		assertThat(xsdFile).isNull();
+	}
+
+	@Test
+	void xsdCreateWhenNotXsdFileThenNull() {
+		File file = new File("spring-security-2.0.txt");
+		XsdFileMajorMinorVersion xsdFile = XsdFileMajorMinorVersion.create(file);
+		assertThat(xsdFile).isNull();
+	}
+
+	@Test
+	void xsdCreateWhenNotStartWithSpringSecurityThenNull() {
+		File file = new File("spring-securityNO-2.0.xsd");
+		XsdFileMajorMinorVersion xsdFile = XsdFileMajorMinorVersion.create(file);
+		assertThat(xsdFile).isNull();
+	}
+
+	@Test
+	void isGreaterWhenMajorLarger() {
+		MajorMinorVersion larger = new MajorMinorVersion(2,0);
+		MajorMinorVersion smaller = new MajorMinorVersion(1,0);
+		assertThat(larger.isGreaterThan(smaller)).isTrue();
+		assertThat(smaller.isGreaterThan(larger)).isFalse();
+	}
+
+	@Test
+	void isGreaterWhenMinorLarger() {
+		MajorMinorVersion larger = new MajorMinorVersion(1,1);
+		MajorMinorVersion smaller = new MajorMinorVersion(1,0);
+		assertThat(larger.isGreaterThan(smaller)).isTrue();
+		assertThat(smaller.isGreaterThan(larger)).isFalse();
+	}
+
+	@Test
+	void isGreaterWhenMajorAndMinorLarger() {
+		MajorMinorVersion larger = new MajorMinorVersion(2,1);
+		MajorMinorVersion smaller = new MajorMinorVersion(1,0);
+		assertThat(larger.isGreaterThan(smaller)).isTrue();
+		assertThat(smaller.isGreaterThan(larger)).isFalse();
+	}
+
+	@Test
+	void isGreaterWhenSame() {
+		MajorMinorVersion first = new MajorMinorVersion(1,0);
+		MajorMinorVersion second = new MajorMinorVersion(1,0);
+		assertThat(first.isGreaterThan(second)).isFalse();
+		assertThat(second.isGreaterThan(first)).isFalse();
+	}
+}

config/spring-security-config.gradle

@@ -1,4 +1,6 @@
 import org.jetbrains.kotlin.gradle.tasks.KotlinCompile
+import org.springframework.gradle.xsd.CreateVersionlessXsdTask
+import trang.RncToXsd
 
 apply plugin: 'io.spring.convention.spring-module'
 apply plugin: 'trang'
@@ -115,13 +117,31 @@ dependencies {
 	testRuntimeOnly 'org.hsqldb:hsqldb'
 }
 
+def versionlessXsd = project.tasks.create("versionlessXsd", CreateVersionlessXsdTask) {
+	inputFiles.from(project.sourceSets.main.resources)
+	versionlessXsdFile = project.layout.buildDirectory.file("versionlessXsd/spring-security.xsd")
+}
 
-rncToXsd {
+processResources {
+	from(versionlessXsd) {
+		into 'org/springframework/security/config/'
+	}
+}
+
+tasks.named('rncToXsd', RncToXsd).configure {
 	rncDir = file('src/main/resources/org/springframework/security/config/')
 	xsdDir = rncDir
 	xslFile = new File(rncDir, 'spring-security.xsl')
 }
 
+sourceSets {
+	main {
+		resources {
+			srcDir(tasks.named('rncToXsd'))
+		}
+	}
+}
+
 tasks.withType(KotlinCompile).configureEach {
 	kotlinOptions {
 		languageVersion = "1.7"
@@ -130,5 +150,3 @@ tasks.withType(KotlinCompile).configureEach {
 		jvmTarget = "17"
 	}
 }
-
-build.dependsOn rncToXsd

config/src/main/java/org/springframework/security/config/annotation/method/configuration/PrePostMethodSecurityConfiguration.java

@@ -16,8 +16,11 @@
 
 package org.springframework.security.config.annotation.method.configuration;
 
+import java.util.function.Supplier;
+
 import io.micrometer.observation.ObservationRegistry;
 import org.aopalliance.intercept.MethodInterceptor;
+import org.aopalliance.intercept.MethodInvocation;
 
 import org.springframework.beans.factory.ObjectProvider;
 import org.springframework.beans.factory.config.BeanDefinition;
@@ -25,6 +28,9 @@ import org.springframework.context.ApplicationContext;
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
 import org.springframework.context.annotation.Role;
+import org.springframework.expression.EvaluationContext;
+import org.springframework.expression.Expression;
+import org.springframework.expression.ExpressionParser;
 import org.springframework.security.access.expression.method.DefaultMethodSecurityExpressionHandler;
 import org.springframework.security.access.expression.method.MethodSecurityExpressionHandler;
 import org.springframework.security.authorization.AuthorizationEventPublisher;
@@ -36,7 +42,9 @@ import org.springframework.security.authorization.method.PostFilterAuthorization
 import org.springframework.security.authorization.method.PreAuthorizeAuthorizationManager;
 import org.springframework.security.authorization.method.PreFilterAuthorizationMethodInterceptor;
 import org.springframework.security.config.core.GrantedAuthorityDefaults;
+import org.springframework.security.core.Authentication;
 import org.springframework.security.core.context.SecurityContextHolderStrategy;
+import org.springframework.util.function.SingletonSupplier;
 
 /**
  * Base {@link Configuration} for enabling Spring Security Method Security.
@@ -59,7 +67,7 @@ final class PrePostMethodSecurityConfiguration {
 		PreFilterAuthorizationMethodInterceptor preFilter = new PreFilterAuthorizationMethodInterceptor();
 		strategyProvider.ifAvailable(preFilter::setSecurityContextHolderStrategy);
 		preFilter.setExpressionHandler(
-				expressionHandlerProvider.getIfAvailable(() -> defaultExpressionHandler(defaultsProvider, context)));
+				new DeferringMethodSecurityExpressionHandler(expressionHandlerProvider, defaultsProvider, context));
 		return preFilter;
 	}
 
@@ -73,7 +81,7 @@ final class PrePostMethodSecurityConfiguration {
 			ObjectProvider<ObservationRegistry> registryProvider, ApplicationContext context) {
 		PreAuthorizeAuthorizationManager manager = new PreAuthorizeAuthorizationManager();
 		manager.setExpressionHandler(
-				expressionHandlerProvider.getIfAvailable(() -> defaultExpressionHandler(defaultsProvider, context)));
+				new DeferringMethodSecurityExpressionHandler(expressionHandlerProvider, defaultsProvider, context));
 		AuthorizationManagerBeforeMethodInterceptor preAuthorize = AuthorizationManagerBeforeMethodInterceptor
 				.preAuthorize(manager(manager, registryProvider));
 		strategyProvider.ifAvailable(preAuthorize::setSecurityContextHolderStrategy);
@@ -91,7 +99,7 @@ final class PrePostMethodSecurityConfiguration {
 			ObjectProvider<ObservationRegistry> registryProvider, ApplicationContext context) {
 		PostAuthorizeAuthorizationManager manager = new PostAuthorizeAuthorizationManager();
 		manager.setExpressionHandler(
-				expressionHandlerProvider.getIfAvailable(() -> defaultExpressionHandler(defaultsProvider, context)));
+				new DeferringMethodSecurityExpressionHandler(expressionHandlerProvider, defaultsProvider, context));
 		AuthorizationManagerAfterMethodInterceptor postAuthorize = AuthorizationManagerAfterMethodInterceptor
 				.postAuthorize(manager(manager, registryProvider));
 		strategyProvider.ifAvailable(postAuthorize::setSecurityContextHolderStrategy);
@@ -108,7 +116,7 @@ final class PrePostMethodSecurityConfiguration {
 		PostFilterAuthorizationMethodInterceptor postFilter = new PostFilterAuthorizationMethodInterceptor();
 		strategyProvider.ifAvailable(postFilter::setSecurityContextHolderStrategy);
 		postFilter.setExpressionHandler(
-				expressionHandlerProvider.getIfAvailable(() -> defaultExpressionHandler(defaultsProvider, context)));
+				new DeferringMethodSecurityExpressionHandler(expressionHandlerProvider, defaultsProvider, context));
 		return postFilter;
 	}
 
@@ -125,4 +133,43 @@ final class PrePostMethodSecurityConfiguration {
 		return new DeferringObservationAuthorizationManager<>(registryProvider, delegate);
 	}
 
+	private static final class DeferringMethodSecurityExpressionHandler implements MethodSecurityExpressionHandler {
+
+		private final Supplier<MethodSecurityExpressionHandler> expressionHandler;
+
+		private DeferringMethodSecurityExpressionHandler(
+				ObjectProvider<MethodSecurityExpressionHandler> expressionHandlerProvider,
+				ObjectProvider<GrantedAuthorityDefaults> defaultsProvider, ApplicationContext applicationContext) {
+			this.expressionHandler = SingletonSupplier.of(() -> expressionHandlerProvider
+					.getIfAvailable(() -> defaultExpressionHandler(defaultsProvider, applicationContext)));
+		}
+
+		@Override
+		public ExpressionParser getExpressionParser() {
+			return this.expressionHandler.get().getExpressionParser();
+		}
+
+		@Override
+		public EvaluationContext createEvaluationContext(Authentication authentication, MethodInvocation invocation) {
+			return this.expressionHandler.get().createEvaluationContext(authentication, invocation);
+		}
+
+		@Override
+		public EvaluationContext createEvaluationContext(Supplier<Authentication> authentication,
+				MethodInvocation invocation) {
+			return this.expressionHandler.get().createEvaluationContext(authentication, invocation);
+		}
+
+		@Override
+		public Object filter(Object filterTarget, Expression filterExpression, EvaluationContext ctx) {
+			return this.expressionHandler.get().filter(filterTarget, filterExpression, ctx);
+		}
+
+		@Override
+		public void setReturnObject(Object returnObject, EvaluationContext ctx) {
+			this.expressionHandler.get().setReturnObject(returnObject, ctx);
+		}
+
+	}
+
 }

config/src/main/resources/org/springframework/security/config/spring-security.xsd

@@ -1 +0,0 @@
-spring-security-6.1.xsd

docs/modules/ROOT/pages/servlet/authorization/authorize-http-requests.adoc

@@ -562,8 +562,8 @@ http
 ----
 http {
     authorizeHttpRequests {
-        authorize(DispatcherType.FORWARD, permitAll)
-        authorize(DispatcherType.ERROR, permitAll)
+        authorize(DispatcherTypeRequestMatcher(DispatcherType.FORWARD), permitAll)
+        authorize(DispatcherTypeRequestMatcher(DispatcherType.ERROR), permitAll)
         authorize("/endpoint", permitAll)
         authorize(anyRequest, denyAll)
     }

gradle.properties

@@ -5,7 +5,7 @@ springBootVersion=3.1.1
 springFrameworkVersion=6.0.11
 micrometerVersion=1.10.10
 openSamlVersion=4.1.1
-version=6.1.3
+version=6.1.4
 kotlinVersion=1.8.22
 samplesBranch=main
 org.gradle.jvmargs=-Xmx3g -XX:+HeapDumpOnOutOfMemoryError

oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/jackson2/OAuth2AuthenticationExceptionMixin.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2020 the original author or authors.
+ * Copyright 2002-2023 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -30,16 +30,23 @@ import org.springframework.security.oauth2.core.OAuth2Error;
  * {@link OAuth2AuthenticationException}.
  *
  * @author Dennis Neufeld
+ * @author Steve Riesenberg
  * @since 5.3.4
  * @see OAuth2AuthenticationException
  * @see OAuth2ClientJackson2Module
  */
 @JsonTypeInfo(use = JsonTypeInfo.Id.CLASS)
-@JsonAutoDetect(fieldVisibility = JsonAutoDetect.Visibility.ANY, getterVisibility = JsonAutoDetect.Visibility.NONE,
+@JsonAutoDetect(fieldVisibility = JsonAutoDetect.Visibility.NONE, getterVisibility = JsonAutoDetect.Visibility.NONE,
 		isGetterVisibility = JsonAutoDetect.Visibility.NONE)
 @JsonIgnoreProperties(ignoreUnknown = true, value = { "cause", "stackTrace", "suppressedExceptions" })
 abstract class OAuth2AuthenticationExceptionMixin {
 
+	@JsonProperty("error")
+	abstract OAuth2Error getError();
+
+	@JsonProperty("detailMessage")
+	abstract String getMessage();
+
 	@JsonCreator
 	OAuth2AuthenticationExceptionMixin(@JsonProperty("error") OAuth2Error error,
 			@JsonProperty("detailMessage") String message) {

saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/jackson2/Saml2AuthenticationExceptionMixin.java

@@ -34,10 +34,16 @@ import org.springframework.security.saml2.provider.service.authentication.Saml2A
  * @see Saml2Jackson2Module
  */
 @JsonTypeInfo(use = JsonTypeInfo.Id.CLASS)
-@JsonAutoDetect(fieldVisibility = JsonAutoDetect.Visibility.ANY, getterVisibility = JsonAutoDetect.Visibility.NONE,
+@JsonAutoDetect(fieldVisibility = JsonAutoDetect.Visibility.NONE, getterVisibility = JsonAutoDetect.Visibility.NONE,
 		isGetterVisibility = JsonAutoDetect.Visibility.NONE)
 @JsonIgnoreProperties(ignoreUnknown = true, value = { "cause", "stackTrace", "suppressedExceptions" })
-class Saml2AuthenticationExceptionMixin {
+abstract class Saml2AuthenticationExceptionMixin {
+
+	@JsonProperty("error")
+	abstract Saml2Error getSaml2Error();
+
+	@JsonProperty("detailMessage")
+	abstract String getMessage();
 
 	@JsonCreator
 	Saml2AuthenticationExceptionMixin(@JsonProperty("error") Saml2Error error,

web/src/main/java/org/springframework/security/web/authentication/www/BasicAuthenticationEntryPoint.java

@@ -52,7 +52,7 @@ public class BasicAuthenticationEntryPoint implements AuthenticationEntryPoint,
 	@Override
 	public void commence(HttpServletRequest request, HttpServletResponse response,
 			AuthenticationException authException) throws IOException {
-		response.addHeader("WWW-Authenticate", "Basic realm=\"" + this.realmName + "\"");
+		response.setHeader("WWW-Authenticate", "Basic realm=\"" + this.realmName + "\"");
 		response.sendError(HttpStatus.UNAUTHORIZED.value(), HttpStatus.UNAUTHORIZED.getReasonPhrase());
 	}
 

web/src/main/java/org/springframework/security/web/csrf/CookieCsrfTokenRepository.java

@@ -178,7 +178,7 @@ public final class CookieCsrfTokenRepository implements CsrfTokenRepository {
 	 */
 	public static CookieCsrfTokenRepository withHttpOnlyFalse() {
 		CookieCsrfTokenRepository result = new CookieCsrfTokenRepository();
-		result.setCookieCustomizer((cookie) -> cookie.httpOnly(false));
+		result.cookieHttpOnly = false;
 		return result;
 	}
 

web/src/main/java/org/springframework/security/web/savedrequest/CookieRequestCache.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2020 the original author or authors.
+ * Copyright 2002-2023 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -17,6 +17,7 @@
 package org.springframework.security.web.savedrequest;
 
 import java.util.Base64;
+import java.util.Collections;
 
 import jakarta.servlet.http.Cookie;
 import jakarta.servlet.http.HttpServletRequest;
@@ -77,7 +78,7 @@ public class CookieRequestCache implements RequestCache {
 		int port = getPort(uriComponents);
 		return builder.setScheme(uriComponents.getScheme()).setServerName(uriComponents.getHost())
 				.setRequestURI(uriComponents.getPath()).setQueryString(uriComponents.getQuery()).setServerPort(port)
-				.setMethod(request.getMethod()).build();
+				.setMethod(request.getMethod()).setLocales(Collections.list(request.getLocales())).build();
 	}
 
 	private int getPort(UriComponents uriComponents) {

web/src/main/java/org/springframework/security/web/savedrequest/HttpSessionRequestCache.java

@@ -28,6 +28,8 @@ import org.springframework.security.web.PortResolverImpl;
 import org.springframework.security.web.util.UrlUtils;
 import org.springframework.security.web.util.matcher.AnyRequestMatcher;
 import org.springframework.security.web.util.matcher.RequestMatcher;
+import org.springframework.util.StringUtils;
+import org.springframework.web.util.UriComponentsBuilder;
 
 /**
  * {@code RequestCache} which stores the {@code SavedRequest} in the HttpSession.
@@ -100,11 +102,14 @@ public class HttpSessionRequestCache implements RequestCache {
 
 	@Override
 	public HttpServletRequest getMatchingRequest(HttpServletRequest request, HttpServletResponse response) {
-		if (this.matchingRequestParameterName != null
-				&& request.getParameter(this.matchingRequestParameterName) == null) {
-			this.logger.trace(
-					"matchingRequestParameterName is required for getMatchingRequest to lookup a value, but not provided");
-			return null;
+		if (this.matchingRequestParameterName != null) {
+			if (!StringUtils.hasText(request.getQueryString())
+					|| !UriComponentsBuilder.fromUriString(UrlUtils.buildRequestUrl(request)).build().getQueryParams()
+							.containsKey(this.matchingRequestParameterName)) {
+				this.logger.trace(
+						"matchingRequestParameterName is required for getMatchingRequest to lookup a value, but not provided");
+				return null;
+			}
 		}
 		SavedRequest saved = getRequest(request, response);
 		if (saved == null) {

web/src/test/java/org/springframework/security/web/authentication/www/BasicAuthenticationEntryPointTests.java

@@ -16,8 +16,12 @@
 
 package org.springframework.security.web.authentication.www;
 
+import java.io.IOException;
+import java.util.List;
+
 import org.junit.jupiter.api.Test;
 
+import org.springframework.http.HttpHeaders;
 import org.springframework.http.HttpStatus;
 import org.springframework.mock.web.MockHttpServletRequest;
 import org.springframework.mock.web.MockHttpServletResponse;
@@ -61,4 +65,19 @@ public class BasicAuthenticationEntryPointTests {
 		assertThat(response.getHeader("WWW-Authenticate")).isEqualTo("Basic realm=\"hello\"");
 	}
 
+	// gh-13737
+	@Test
+	void commenceWhenResponseHasHeaderThenOverride() throws IOException {
+		BasicAuthenticationEntryPoint ep = new BasicAuthenticationEntryPoint();
+		ep.setRealmName("hello");
+		MockHttpServletRequest request = new MockHttpServletRequest();
+		request.setRequestURI("/some_path");
+		MockHttpServletResponse response = new MockHttpServletResponse();
+		response.setHeader(HttpHeaders.WWW_AUTHENTICATE, "Basic realm=\"test\"");
+		ep.commence(request, response, new DisabledException("Disabled"));
+		List<String> headers = response.getHeaders("WWW-Authenticate");
+		assertThat(headers).hasSize(1);
+		assertThat(headers.get(0)).isEqualTo("Basic realm=\"hello\"");
+	}
+
 }

web/src/test/java/org/springframework/security/web/csrf/CookieCsrfTokenRepositoryTests.java

@@ -423,6 +423,19 @@ class CookieCsrfTokenRepositoryTests {
 		assertThat(((MockCookie) tokenCookie).getSameSite()).isEqualTo(sameSitePolicy);
 	}
 
+	// gh-13659
+	@Test
+	void withHttpOnlyFalseWhenCookieCustomizerThenStillDefaultsToFalse() {
+		CookieCsrfTokenRepository repository = CookieCsrfTokenRepository.withHttpOnlyFalse();
+		repository.setCookieCustomizer((customizer) -> customizer.maxAge(1000));
+		CsrfToken token = repository.generateToken(this.request);
+		repository.saveToken(token, this.request, this.response);
+		Cookie tokenCookie = this.response.getCookie(CookieCsrfTokenRepository.DEFAULT_CSRF_COOKIE_NAME);
+		assertThat(tokenCookie).isNotNull();
+		assertThat(tokenCookie.getMaxAge()).isEqualTo(1000);
+		assertThat(tokenCookie.isHttpOnly()).isEqualTo(Boolean.FALSE);
+	}
+
 	@Test
 	void setCookieNameNullIllegalArgumentException() {
 		assertThatIllegalArgumentException().isThrownBy(() -> this.repository.setCookieName(null));

web/src/test/java/org/springframework/security/web/savedrequest/CookieRequestCacheTests.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2020 the original author or authors.
+ * Copyright 2002-2023 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -16,7 +16,10 @@
 
 package org.springframework.security.web.savedrequest;
 
+import java.util.Arrays;
 import java.util.Base64;
+import java.util.Collections;
+import java.util.Locale;
 
 import jakarta.servlet.http.Cookie;
 import jakarta.servlet.http.HttpServletRequest;
@@ -182,6 +185,25 @@ public class CookieRequestCacheTests {
 		assertThat(expiredCookie.getMaxAge()).isZero();
 	}
 
+	// gh-13792
+	@Test
+	public void matchingRequestWhenMatchThenKeepOriginalRequestLocale() {
+		CookieRequestCache cookieRequestCache = new CookieRequestCache();
+		MockHttpServletRequest request = new MockHttpServletRequest();
+		request.setServerPort(443);
+		request.setSecure(true);
+		request.setScheme("https");
+		request.setServerName("example.com");
+		request.setRequestURI("/destination");
+		request.setPreferredLocales(Arrays.asList(Locale.FRENCH, Locale.GERMANY));
+		String redirectUrl = "https://example.com/destination";
+		request.setCookies(new Cookie(DEFAULT_COOKIE_NAME, encodeCookie(redirectUrl)));
+		MockHttpServletResponse response = new MockHttpServletResponse();
+		HttpServletRequest matchingRequest = cookieRequestCache.getMatchingRequest(request, response);
+		assertThat(matchingRequest).isNotNull();
+		assertThat(Collections.list(matchingRequest.getLocales())).contains(Locale.FRENCH, Locale.GERMANY);
+	}
+
 	private static String encodeCookie(String cookieValue) {
 		return Base64.getEncoder().encodeToString(cookieValue.getBytes());
 	}

web/src/test/java/org/springframework/security/web/savedrequest/HttpSessionRequestCacheTests.java

@@ -32,8 +32,9 @@ import org.springframework.security.web.PortResolverImpl;
 
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.mockito.ArgumentMatchers.anyBoolean;
-import static org.mockito.Mockito.mock;
+import static org.mockito.ArgumentMatchers.anyString;
 import static org.mockito.Mockito.never;
+import static org.mockito.Mockito.spy;
 import static org.mockito.Mockito.verify;
 
 /**
@@ -100,7 +101,7 @@ public class HttpSessionRequestCacheTests {
 	public void getMatchingRequestWhenMatchingRequestParameterNameSetThenSessionNotAccessed() {
 		HttpSessionRequestCache cache = new HttpSessionRequestCache();
 		cache.setMatchingRequestParameterName("success");
-		HttpServletRequest request = mock(HttpServletRequest.class);
+		HttpServletRequest request = spy(new MockHttpServletRequest());
 		HttpServletRequest matchingRequest = cache.getMatchingRequest(request, new MockHttpServletResponse());
 		assertThat(matchingRequest).isNull();
 		verify(request, never()).getSession();
@@ -115,7 +116,6 @@ public class HttpSessionRequestCacheTests {
 		cache.saveRequest(request, new MockHttpServletResponse());
 		MockHttpServletRequest requestToMatch = new MockHttpServletRequest();
 		requestToMatch.setQueryString("success"); // gh-12665
-		requestToMatch.setParameter("success", "");
 		requestToMatch.setSession(request.getSession());
 		HttpServletRequest matchingRequest = cache.getMatchingRequest(requestToMatch, new MockHttpServletResponse());
 		assertThat(matchingRequest).isNotNull();
@@ -131,7 +131,6 @@ public class HttpSessionRequestCacheTests {
 		cache.saveRequest(request, new MockHttpServletResponse());
 		MockHttpServletRequest requestToMatch = new MockHttpServletRequest();
 		requestToMatch.setQueryString("param=true&success");
-		requestToMatch.setParameter("success", "");
 		requestToMatch.setSession(request.getSession());
 		HttpServletRequest matchingRequest = cache.getMatchingRequest(requestToMatch, new MockHttpServletResponse());
 		assertThat(matchingRequest).isNotNull();
@@ -146,13 +145,28 @@ public class HttpSessionRequestCacheTests {
 		assertThat(request.getSession().getAttribute(HttpSessionRequestCache.SAVED_REQUEST)).isNotNull();
 		MockHttpServletRequest requestToMatch = new MockHttpServletRequest();
 		requestToMatch.setQueryString("success");
-		requestToMatch.setParameter("success", "");
 		requestToMatch.setSession(request.getSession());
 		HttpServletRequest matchingRequest = cache.getMatchingRequest(requestToMatch, new MockHttpServletResponse());
 		assertThat(matchingRequest).isNotNull();
 		assertThat(request.getSession().getAttribute(HttpSessionRequestCache.SAVED_REQUEST)).isNull();
 	}
 
+	// gh-13731
+	@Test
+	public void getMatchingRequestWhenMatchingRequestParameterNameSetThenDoesNotInvokeGetParameterMethods() {
+		HttpSessionRequestCache cache = new HttpSessionRequestCache();
+		cache.setMatchingRequestParameterName("success");
+		MockHttpServletRequest mockRequest = new MockHttpServletRequest();
+		mockRequest.setQueryString("success");
+		HttpServletRequest request = spy(mockRequest);
+		HttpServletRequest matchingRequest = cache.getMatchingRequest(request, new MockHttpServletResponse());
+		assertThat(matchingRequest).isNull();
+		verify(request, never()).getParameter(anyString());
+		verify(request, never()).getParameterValues(anyString());
+		verify(request, never()).getParameterNames();
+		verify(request, never()).getParameterMap();
+	}
+
 	private static final class CustomSavedRequest implements SavedRequest {
 
 		private final SavedRequest delegate;