diff --git a/config/src/main/java/org/springframework/security/config/http/AuthorizationFilterParser.java b/config/src/main/java/org/springframework/security/config/http/AuthorizationFilterParser.java index b01054ffe7..2855966da2 100644 --- a/config/src/main/java/org/springframework/security/config/http/AuthorizationFilterParser.java +++ b/config/src/main/java/org/springframework/security/config/http/AuthorizationFilterParser.java @@ -85,8 +85,8 @@ class AuthorizationFilterParser implements BeanDefinitionParser { BeanDefinitionBuilder filterBuilder = BeanDefinitionBuilder.rootBeanDefinition(AuthorizationFilter.class); filterBuilder.getRawBeanDefinition().setSource(parserContext.extractSource(element)); filterBuilder.addConstructorArgReference(this.authorizationManagerRef); - if ("true".equals(element.getAttribute(ATT_FILTER_ALL_DISPATCHER_TYPES))) { - filterBuilder.addPropertyValue("shouldFilterAllDispatcherTypes", Boolean.TRUE); + if ("false".equals(element.getAttribute(ATT_FILTER_ALL_DISPATCHER_TYPES))) { + filterBuilder.addPropertyValue("shouldFilterAllDispatcherTypes", Boolean.FALSE); } BeanDefinition filter = filterBuilder .addPropertyValue("securityContextHolderStrategy", this.securityContextHolderStrategy) diff --git a/config/src/main/resources/org/springframework/security/config/spring-security-6.0.rnc b/config/src/main/resources/org/springframework/security/config/spring-security-6.0.rnc index 04af5c4189..069705a5ff 100644 --- a/config/src/main/resources/org/springframework/security/config/spring-security-6.0.rnc +++ b/config/src/main/resources/org/springframework/security/config/spring-security-6.0.rnc @@ -386,7 +386,7 @@ http.attlist &= ## Corresponds to the observeOncePerRequest property of FilterSecurityInterceptor. Defaults to "false" attribute once-per-request {xsd:boolean}? http.attlist &= - ## Corresponds to the shouldFilterAllDispatcherTypes property of AuthorizationFilter. Do not work when use-authorization-manager=false. Defaults to "false". + ## Corresponds to the shouldFilterAllDispatcherTypes property of AuthorizationFilter. Do not work when use-authorization-manager=false. Defaults to "true". attribute filter-all-dispatcher-types {xsd:boolean}? http.attlist &= ## Prevents the jsessionid parameter from being added to rendered URLs. Defaults to "true" (rewriting is disabled). diff --git a/config/src/main/resources/org/springframework/security/config/spring-security-6.0.xsd b/config/src/main/resources/org/springframework/security/config/spring-security-6.0.xsd index d7f351fdc6..ec9b94b045 100644 --- a/config/src/main/resources/org/springframework/security/config/spring-security-6.0.xsd +++ b/config/src/main/resources/org/springframework/security/config/spring-security-6.0.xsd @@ -1366,7 +1366,7 @@ Corresponds to the shouldFilterAllDispatcherTypes property of AuthorizationFilter. Do not - work when use-authorization-manager=false. Defaults to "false". + work when use-authorization-manager=false. Defaults to "true". diff --git a/config/src/test/java/org/springframework/security/config/http/InterceptUrlConfigTests.java b/config/src/test/java/org/springframework/security/config/http/InterceptUrlConfigTests.java index 9ab3bbae88..f925de4d0e 100644 --- a/config/src/test/java/org/springframework/security/config/http/InterceptUrlConfigTests.java +++ b/config/src/test/java/org/springframework/security/config/http/InterceptUrlConfigTests.java @@ -406,6 +406,28 @@ public class InterceptUrlConfigTests { assertThat(this.spring.getContext().getBean(AuthorizationManager.class)).isNotNull(); } + @Test + public void requestWhenUsingFilterAllDispatcherTypesFalseThenAuthorizesRequestsAccordingly() throws Exception { + this.spring.configLocations(this.xml("FilterAllDispatcherTypesFalse")).autowire(); + // @formatter:off + this.mvc.perform(get("/path").with(userCredentials())) + .andExpect(status().isOk()); + this.mvc.perform(get("/path").with(adminCredentials())) + .andExpect(status().isForbidden()); + this.mvc.perform(get("/error").with((request) -> { + request.setAttribute(WebUtils.ERROR_REQUEST_URI_ATTRIBUTE, "/error"); + request.setDispatcherType(DispatcherType.ERROR); + return request; + })).andExpect(status().isOk()); + this.mvc.perform(get("/path").with((request) -> { + request.setAttribute(WebUtils.ERROR_REQUEST_URI_ATTRIBUTE, "/path"); + request.setDispatcherType(DispatcherType.ERROR); + return request; + })).andExpect(status().isOk()); + // @formatter:on + assertThat(this.spring.getContext().getBean(AuthorizationManager.class)).isNotNull(); + } + private static RequestPostProcessor adminCredentials() { return httpBasic("admin", "password"); } diff --git a/config/src/test/resources/org/springframework/security/config/http/InterceptUrlConfigTests-AuthorizationManagerFilterAllDispatcherTypes.xml b/config/src/test/resources/org/springframework/security/config/http/InterceptUrlConfigTests-AuthorizationManagerFilterAllDispatcherTypes.xml index cbb7a514d5..aefa2c96a4 100644 --- a/config/src/test/resources/org/springframework/security/config/http/InterceptUrlConfigTests-AuthorizationManagerFilterAllDispatcherTypes.xml +++ b/config/src/test/resources/org/springframework/security/config/http/InterceptUrlConfigTests-AuthorizationManagerFilterAllDispatcherTypes.xml @@ -24,7 +24,7 @@ http://www.springframework.org/schema/beans https://www.springframework.org/schema/beans/spring-beans.xsd"> - + diff --git a/config/src/test/resources/org/springframework/security/config/http/InterceptUrlConfigTests-FilterAllDispatcherTypesFalse.xml b/config/src/test/resources/org/springframework/security/config/http/InterceptUrlConfigTests-FilterAllDispatcherTypesFalse.xml new file mode 100644 index 0000000000..9cc9f57a58 --- /dev/null +++ b/config/src/test/resources/org/springframework/security/config/http/InterceptUrlConfigTests-FilterAllDispatcherTypesFalse.xml @@ -0,0 +1,55 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/docs/modules/ROOT/pages/servlet/appendix/namespace/http.adoc b/docs/modules/ROOT/pages/servlet/appendix/namespace/http.adoc index fd15759dd5..ae5f139fda 100644 --- a/docs/modules/ROOT/pages/servlet/appendix/namespace/http.adoc +++ b/docs/modules/ROOT/pages/servlet/appendix/namespace/http.adoc @@ -99,8 +99,8 @@ Defaults to `false`. [[nsa-http-filter-all-dispatcher-types]] * **filter-all-dispatcher-types** -Corresponds to the `shouldFilterAllDispatcherTypes` property of the `AuthorizationFilter`. Only works when `use-authorization-manager=true`. -Defaults to `false`. +Corresponds to the `shouldFilterAllDispatcherTypes` property of the `AuthorizationFilter`. Does not work when `use-authorization-manager=false`. +Defaults to `true`. [[nsa-http-pattern]]