This commit removes the now defunkt `ErrorAttributes.ERROR_ATTRIBUTE`
that was introduce to register handled errors as metrics. This has been
replaced since 3.0 by a direct support in Spring Framework and had no
effect whatsoever since that release.
This also updates the documentation to point to the Framework mechanism
that replaced it.
Fixes gh-33731
There are some notable differences in the behavior of Spring
Security's reactive and servlet-based web security. Notably,
Servlet-based web security (`@EnableWebSecurity`) works without
any authentication manager, rejecting requests as not authorized.
By contrast reactive-based web security (`@EnableWebFluxSecurity`)
fails to start up when there's no authentication manager, either
provided directly as a bean or derived from a
ReactiveUserDetailsService. There are also further differences at
runtime where empty Monos from all ReactiveAuthenticationManagers
results in an internal error and a 500 response whereas a similar
situation in the servlet implementation results in a 401.
Previously, to accommodate these differences in behavior, Spring
Boot's auto-configuration would behave differently. In the Servlet
case, web security would be enabled whenever the necessary
dependencies were on the classpath. In the reactive case, web
security would back off in the absence of an authentication manager
to prevent a start up failure. While this difference is rooted in
Spring Security, it is undesirable and something that we want to
avoid Spring Boot users being exposed to where possible.
Unfortunately, the situation is more likely to occur than before
as ReactiveUserDetailsServiceAutoConfiguration now backs off more
readily (gh-35338). This makes it more likely that the context will
contain neither a reactive authetication manager not a reactive
user details service.
This commit reworks the auto-configurations related to reactive
security. ReactiveSecurityAutoConfiguration will now auto-configure
an "empty" reactive authentication manager that denies access through
Mono.error in the absence of a ReactiveAuthenticationManager,
ReactiveUserDetailsService, or SecurityWebFilterChain. The last of
these is to allow for the situation where a filter chain has been
defined with an authentication manager configured directly on it.
This configuration of an authentication manager allows
`@EnableWebFluxSecurity` to be auto-configured more readily,
removing one of the differences between reactive- and Servlet-based
security.
Corresponding updates to the auto-configurations for reactive OAuth2
support have also been made. They no longer try to auto-configure
`@EnableWebFluxSecurity`, relying instead upon
ReactiveSecurityAutoConfiguration, which they are ordered before, to
do that instead.
Closes gh-38713
The stream auto-configuration is tested in RabbitStreamConfigurationTests,
and excluding it prevents the creation of the "rabbitStreamEnvironment"
Environment bean, which delays the application context close by 1 second
because it has to wait for some Netty resources to gracefully shut down.
Closes gh-38750
If @AutoConfigureObservability is applied to a sliced test, it
auto-configures:
- An in-memory MeterRegistry
- A no-op Tracer
- An ObservationRegistry
Closes gh-38568
This auto-configuration ensures, if Micrometer Tracing is on the
classpath, that there is always a tracer. It backs off if there is
already a tracer, for example contributed by the Brave or the Otel
auto-configurations, which are run before.
See gh-38568
Following the changes in gh-37504, the reactive resource server
auto-configuration could enable WebFlux security in situations where
it was otherwise in active. This could then result in an application
failing to start as no authentication manager is available.
This commit updates the configurations that enable WebFlux security
so that they fully back off unless their related configurations are
active. Previously, only the configuration of the
SecurityWebFilterChain would back off. This has been expanded to
cover `@EnableWebFluxSecurity` as well. This has required splitting
the configuration classes up so that the condition evaluation order
can be controlled more precisely. We need to ensure that the JWT
decoder bean or the opaque token introspector bean has been defined
before evaluation of the conditions for `@EnableWebFluxSecurity`.
Without this control, the import through `@EnableWebFluxSecurity` in
one location where the conditions do not matchcan prevent a
successful import in another where they do.
Fixes gh-38713
1. remove unused imports
2. remove redundant semicolon
3. remove empty class body
4. remove redundant 'constructor' keyword
5. remove redundant 'Unit' return type
6. use non-null type if possible
See gh-38708
In gh-38154, we started handling ClosedByInterruptException. The
FileChannel was repaired by recreating it and then the exception was
rethrown. This allowed other threads to use the channel that had been
read by an interrupted thread while allowing that interruption to
continue.
This approach has proven to be insufficient as there are scenarios
where the read needs to succeed on the interrupted thread. This
commit updates the handling of ClosedByInterruptException so that
this is the case. The FileChannel is recreated as before but the
thread's interrupted flag is now cleared before retrying the read.
The flag is then reinstated so that any subsequent actions that
should fail due to the interruption will do so.
We could clear and reinstate the interrupted flag before the first
read, rather than catching ClosedByInterruptException. This approach
was rejected as it will have an impact on the performance of the
happy path where the thread hasn't been interrupted.
Fixes gh-38611
Add addition description and action text to help point to the
fact that the `NoUniqueBeanDefinitionException` can be thrown
due to a missing `-parameters` compiler setting.
Closes gh-38652
Update `DataObjectBinder` interface and `ValueObjectBinder`
implementation so that suppressed exceptions are added whenever
parameter names cannot be discovered.
See gh-38603
Prior to this commit, we set in gh-37388 the ObservationRegistry on the
auto-configured JmsTemplate bean. This enables observations and context
propagation when sending JMS messages.
This commit applies the same to the `DefaultJmsListenerContainerFactory`
and the `DefaultJmsListenerContainerFactoryConfigurer`, in order to
enable observations on `@JmsListener` annotated methods.
This commit also refactors the support implemented in gh-37388 to avoid
relying on a bean post processor and instead set the observation
registry directly in the main auto-configuration: while Micrometer core
is an actuator-only dependency, Micrometer Observation API is a compile
dependnecy for spring-jms itself and there is no need to separate
concerns there.
Fixes gh-38613
If a connector is bound on init, it won't be unbound when stop()
is called. This leaves the connector running when it should have
been stopped. We currently disable bind on init for the main
connector but not for any additional connectors. This commit
disables bind on it for all connectors unless it is been
explicitly enabled through the bindOnInit property.
Closes gh-38564
Co-authored-by: Moritz Halbritter <moritz.halbritter@broadcom.com>
Relax the constraint that a `NestedLocation` must have a nested entry
name specified so that URLs can be split and rebuilt.
Prior to this commit, given a URL of the following form:
jar:nested:/myjar.jar!/nested.jar!/my/file
It was possible to create a FileSystem from
"jar:nested:/myjar.jar!/nested.jar" and from that create a path to
"my/file".
However, it wasn't possible to create a FileSystem from
"jar:nested:/myjar.jar", then create another file system from the path
"nested.jar" and then finally create a path to "/nested.jar".
This was because `nested:/myjar.jar` was not considered a value URL
because it didn't include a nested entry name.
Projects such as `JobRunr` were relying on the ability to compose file
systems, so it makes sense to remove our somewhat artificial
restriction.
Fixes gh-38592
Update `NestedByteChannel.read` so that it loops until all
remaining data has been read into the buffer. Prior to this
commit, it was possible for to read only some bytes into the
buffer. Although it looks like this should be OK according to
the API documentation, the `ZipFileSystem` relies on all
remaining bytes being returned.
Fixes gh-38595
Update `ZipContent` so that `eocd.totalNumberOfCentralDirectoryEntries`
is converted from a short to an unsigned int to prevent a negative
number from being used.
This commit also updates the code to consistently use `X.toUnsigned...`
helper methods rather than using bitwise operators.
Fixed gh-38572
Instead of creating the thread directly in the constructor, the thread
is now created when the context is refreshed and stopped when the
context is closed.
As AOT processing never refreshes the context, the thread is never
started and can't block the AOT processing task.
Closes gh-38531
Update jar `Handler` code so that the `parseUrl` method can accept an
empty `spec`. Prior to this commit, a `classLoader.getResource("")`
call would result in a `null` result. This breaks a number of things
including `ClassPathResource` and `PathMatchingResourcePatternResolver`.
Fixes gh-38524
Previously, the child management context was created when the
parent context's web server was initialized and it wasn't stopped
or closed until the parent context was closed. This resulted in
the child context being left running when the parent context was
stopped. This would then cause a failure when the parent context
was started again as another web server initialized event would be
received and a second child management context would be started.
This commit updates the initialization of the child management
context to integrate it with the lifecycle of the parent context.
The management context is now created the first time the parent
context is started. It is stopped when the parent context is
stopped and restarted if the parent context is started again.
This lifecycle management is done using a phase that ensures
that the child context is not started until the parent context's
web server has been started.
Fixes gh-38502
The mocks being static meant that their state was shared across each
test in the class. This resulted in the tests being order dependent.
This commit uses instance variables to hold the mocks, thereby
ensuring that they're recreated for each test as part of the standard
JUnit lifecycle.
Closes gh-38363
Andy Wilkinson
Moritz Halbritter
Brian Clozel
Phillip Webb
Yanming Zhou
Donghun Shin
Georg Pirklbauer
Lars Uffmann
Arthur Gavlyukovskiy
Tom Frenken
Phillip Webb
Andy Wilkinson
Moritz Halbritter
Alex Serbin
Johnny Lim
penekhun
Scott Frederick
Jonatan Ivanov
abdullah-jaffer
Eddú Meléndez
Sébastien Deleuze