diff --git a/config/src/main/java/org/springframework/security/config/http/AuthorizationFilterParser.java b/config/src/main/java/org/springframework/security/config/http/AuthorizationFilterParser.java
index b01054ffe7..2855966da2 100644
--- a/config/src/main/java/org/springframework/security/config/http/AuthorizationFilterParser.java
+++ b/config/src/main/java/org/springframework/security/config/http/AuthorizationFilterParser.java
@@ -85,8 +85,8 @@ class AuthorizationFilterParser implements BeanDefinitionParser {
BeanDefinitionBuilder filterBuilder = BeanDefinitionBuilder.rootBeanDefinition(AuthorizationFilter.class);
filterBuilder.getRawBeanDefinition().setSource(parserContext.extractSource(element));
filterBuilder.addConstructorArgReference(this.authorizationManagerRef);
- if ("true".equals(element.getAttribute(ATT_FILTER_ALL_DISPATCHER_TYPES))) {
- filterBuilder.addPropertyValue("shouldFilterAllDispatcherTypes", Boolean.TRUE);
+ if ("false".equals(element.getAttribute(ATT_FILTER_ALL_DISPATCHER_TYPES))) {
+ filterBuilder.addPropertyValue("shouldFilterAllDispatcherTypes", Boolean.FALSE);
}
BeanDefinition filter = filterBuilder
.addPropertyValue("securityContextHolderStrategy", this.securityContextHolderStrategy)
diff --git a/config/src/main/resources/org/springframework/security/config/spring-security-6.0.rnc b/config/src/main/resources/org/springframework/security/config/spring-security-6.0.rnc
index 04af5c4189..069705a5ff 100644
--- a/config/src/main/resources/org/springframework/security/config/spring-security-6.0.rnc
+++ b/config/src/main/resources/org/springframework/security/config/spring-security-6.0.rnc
@@ -386,7 +386,7 @@ http.attlist &=
## Corresponds to the observeOncePerRequest property of FilterSecurityInterceptor. Defaults to "false"
attribute once-per-request {xsd:boolean}?
http.attlist &=
- ## Corresponds to the shouldFilterAllDispatcherTypes property of AuthorizationFilter. Do not work when use-authorization-manager=false. Defaults to "false".
+ ## Corresponds to the shouldFilterAllDispatcherTypes property of AuthorizationFilter. Do not work when use-authorization-manager=false. Defaults to "true".
attribute filter-all-dispatcher-types {xsd:boolean}?
http.attlist &=
## Prevents the jsessionid parameter from being added to rendered URLs. Defaults to "true" (rewriting is disabled).
diff --git a/config/src/main/resources/org/springframework/security/config/spring-security-6.0.xsd b/config/src/main/resources/org/springframework/security/config/spring-security-6.0.xsd
index d7f351fdc6..ec9b94b045 100644
--- a/config/src/main/resources/org/springframework/security/config/spring-security-6.0.xsd
+++ b/config/src/main/resources/org/springframework/security/config/spring-security-6.0.xsd
@@ -1366,7 +1366,7 @@
Corresponds to the shouldFilterAllDispatcherTypes property of AuthorizationFilter. Do not
- work when use-authorization-manager=false. Defaults to "false".
+ work when use-authorization-manager=false. Defaults to "true".
diff --git a/config/src/test/java/org/springframework/security/config/http/InterceptUrlConfigTests.java b/config/src/test/java/org/springframework/security/config/http/InterceptUrlConfigTests.java
index 9ab3bbae88..f925de4d0e 100644
--- a/config/src/test/java/org/springframework/security/config/http/InterceptUrlConfigTests.java
+++ b/config/src/test/java/org/springframework/security/config/http/InterceptUrlConfigTests.java
@@ -406,6 +406,28 @@ public class InterceptUrlConfigTests {
assertThat(this.spring.getContext().getBean(AuthorizationManager.class)).isNotNull();
}
+ @Test
+ public void requestWhenUsingFilterAllDispatcherTypesFalseThenAuthorizesRequestsAccordingly() throws Exception {
+ this.spring.configLocations(this.xml("FilterAllDispatcherTypesFalse")).autowire();
+ // @formatter:off
+ this.mvc.perform(get("/path").with(userCredentials()))
+ .andExpect(status().isOk());
+ this.mvc.perform(get("/path").with(adminCredentials()))
+ .andExpect(status().isForbidden());
+ this.mvc.perform(get("/error").with((request) -> {
+ request.setAttribute(WebUtils.ERROR_REQUEST_URI_ATTRIBUTE, "/error");
+ request.setDispatcherType(DispatcherType.ERROR);
+ return request;
+ })).andExpect(status().isOk());
+ this.mvc.perform(get("/path").with((request) -> {
+ request.setAttribute(WebUtils.ERROR_REQUEST_URI_ATTRIBUTE, "/path");
+ request.setDispatcherType(DispatcherType.ERROR);
+ return request;
+ })).andExpect(status().isOk());
+ // @formatter:on
+ assertThat(this.spring.getContext().getBean(AuthorizationManager.class)).isNotNull();
+ }
+
private static RequestPostProcessor adminCredentials() {
return httpBasic("admin", "password");
}
diff --git a/config/src/test/resources/org/springframework/security/config/http/InterceptUrlConfigTests-AuthorizationManagerFilterAllDispatcherTypes.xml b/config/src/test/resources/org/springframework/security/config/http/InterceptUrlConfigTests-AuthorizationManagerFilterAllDispatcherTypes.xml
index cbb7a514d5..aefa2c96a4 100644
--- a/config/src/test/resources/org/springframework/security/config/http/InterceptUrlConfigTests-AuthorizationManagerFilterAllDispatcherTypes.xml
+++ b/config/src/test/resources/org/springframework/security/config/http/InterceptUrlConfigTests-AuthorizationManagerFilterAllDispatcherTypes.xml
@@ -24,7 +24,7 @@
http://www.springframework.org/schema/beans
https://www.springframework.org/schema/beans/spring-beans.xsd">
-
+
diff --git a/config/src/test/resources/org/springframework/security/config/http/InterceptUrlConfigTests-FilterAllDispatcherTypesFalse.xml b/config/src/test/resources/org/springframework/security/config/http/InterceptUrlConfigTests-FilterAllDispatcherTypesFalse.xml
new file mode 100644
index 0000000000..9cc9f57a58
--- /dev/null
+++ b/config/src/test/resources/org/springframework/security/config/http/InterceptUrlConfigTests-FilterAllDispatcherTypesFalse.xml
@@ -0,0 +1,55 @@
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
diff --git a/docs/modules/ROOT/pages/servlet/appendix/namespace/http.adoc b/docs/modules/ROOT/pages/servlet/appendix/namespace/http.adoc
index fd15759dd5..ae5f139fda 100644
--- a/docs/modules/ROOT/pages/servlet/appendix/namespace/http.adoc
+++ b/docs/modules/ROOT/pages/servlet/appendix/namespace/http.adoc
@@ -99,8 +99,8 @@ Defaults to `false`.
[[nsa-http-filter-all-dispatcher-types]]
* **filter-all-dispatcher-types**
-Corresponds to the `shouldFilterAllDispatcherTypes` property of the `AuthorizationFilter`. Only works when `use-authorization-manager=true`.
-Defaults to `false`.
+Corresponds to the `shouldFilterAllDispatcherTypes` property of the `AuthorizationFilter`. Does not work when `use-authorization-manager=false`.
+Defaults to `true`.
[[nsa-http-pattern]]