diff --git a/cas/src/main/java/org/springframework/security/cas/ServiceProperties.java b/cas/src/main/java/org/springframework/security/cas/ServiceProperties.java index 55d913f417..13e706b477 100644 --- a/cas/src/main/java/org/springframework/security/cas/ServiceProperties.java +++ b/cas/src/main/java/org/springframework/security/cas/ServiceProperties.java @@ -60,7 +60,7 @@ public class ServiceProperties implements InitializingBean { * This service is the callback URL belonging to the local Spring Security System for Spring secured application. * For example, *
- * https://www.mycompany.com/application/j_spring_cas_security_check
+ * https://www.mycompany.com/application/login/cas
*
*
* @return the URL of the service the user is authenticating to
diff --git a/cas/src/main/java/org/springframework/security/cas/web/CasAuthenticationFilter.java b/cas/src/main/java/org/springframework/security/cas/web/CasAuthenticationFilter.java
index a954e8f252..e374067e03 100644
--- a/cas/src/main/java/org/springframework/security/cas/web/CasAuthenticationFilter.java
+++ b/cas/src/main/java/org/springframework/security/cas/web/CasAuthenticationFilter.java
@@ -51,7 +51,7 @@ import org.springframework.util.Assert;
* presented in the ticket request parameter.
*
* This filter monitors the service URL so it can
- * receive the service ticket and process it. By default this filter processes the URL /j_spring_cas_security_check.
+ * receive the service ticket and process it. By default this filter processes the URL /login/cas.
* When processing this URL, the value of {@link ServiceProperties#getService()} is used as the service when validating
* the ticket. This means that it is important that {@link ServiceProperties#getService()} specifies the same value
* as the filterProcessesUrl.
@@ -92,7 +92,7 @@ import org.springframework.util.Assert;
*
* <b:bean id="serviceProperties"
* class="org.springframework.security.cas.ServiceProperties"
- * p:service="https://service.example.com/cas-sample/j_spring_cas_security_check"
+ * p:service="https://service.example.com/cas-sample/login/cas"
* p:authenticateAllArtifacts="true"/>
* <b:bean id="casEntryPoint"
* class="org.springframework.security.cas.web.CasAuthenticationEntryPoint"
@@ -102,7 +102,7 @@ import org.springframework.util.Assert;
* p:authenticationManager-ref="authManager"
* p:serviceProperties-ref="serviceProperties"
* p:proxyGrantingTicketStorage-ref="pgtStorage"
- * p:proxyReceptorUrl="/j_spring_cas_security_proxyreceptor">
+ * p:proxyReceptorUrl="/login/cas/proxyreceptor">
* <b:property name="authenticationDetailsSource">
* <b:bean class="org.springframework.security.cas.web.authentication.ServiceAuthenticationDetailsSource"/>
* </b:property>
@@ -129,7 +129,7 @@ import org.springframework.util.Assert;
* <b:bean
* class="org.jasig.cas.client.validation.Cas20ProxyTicketValidator"
* p:acceptAnyProxy="true"
- * p:proxyCallbackUrl="https://service.example.com/cas-sample/j_spring_cas_security_proxyreceptor"
+ * p:proxyCallbackUrl="https://service.example.com/cas-sample/login/cas/proxyreceptor"
* p:proxyGrantingTicketStorage-ref="pgtStorage">
* <b:constructor-arg value="https://login.example.org/cas" />
* </b:bean>
@@ -188,7 +188,7 @@ public class CasAuthenticationFilter extends AbstractAuthenticationProcessingFil
//~ Constructors ===================================================================================================
public CasAuthenticationFilter() {
- super("/j_spring_cas_security_check");
+ super("/login/cas");
setAuthenticationFailureHandler(new SimpleUrlAuthenticationFailureHandler());
}
diff --git a/cas/src/main/java/org/springframework/security/cas/web/authentication/DefaultServiceAuthenticationDetails.java b/cas/src/main/java/org/springframework/security/cas/web/authentication/DefaultServiceAuthenticationDetails.java
index 41b4201c22..4dcec20df9 100644
--- a/cas/src/main/java/org/springframework/security/cas/web/authentication/DefaultServiceAuthenticationDetails.java
+++ b/cas/src/main/java/org/springframework/security/cas/web/authentication/DefaultServiceAuthenticationDetails.java
@@ -1,12 +1,12 @@
/*
* Copyright 2011 the original author or authors.
- *
+ *
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
- *
+ *
* http://www.apache.org/licenses/LICENSE-2.0
- *
+ *
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
@@ -135,7 +135,7 @@ final class DefaultServiceAuthenticationDetails extends WebAuthenticationDetails
/**
* Gets the port from the casServiceURL ensuring to return the proper value if the default port is being used.
- * @param casServiceUrl the casServerUrl to be used (i.e. "https://example.com/context/j_spring_security_cas_check")
+ * @param casServiceUrl the casServerUrl to be used (i.e. "https://example.com/context/login/cas")
* @return the port that is configured for the casServerUrl
*/
private static int getServicePort(URL casServiceUrl) {
diff --git a/cas/src/test/java/org/springframework/security/cas/authentication/AbstractStatelessTicketCacheTests.java b/cas/src/test/java/org/springframework/security/cas/authentication/AbstractStatelessTicketCacheTests.java
index a62d3f6049..bce82dbd88 100644
--- a/cas/src/test/java/org/springframework/security/cas/authentication/AbstractStatelessTicketCacheTests.java
+++ b/cas/src/test/java/org/springframework/security/cas/authentication/AbstractStatelessTicketCacheTests.java
@@ -19,7 +19,7 @@ public abstract class AbstractStatelessTicketCacheTests {
protected CasAuthenticationToken getToken() {
List proxyList = new ArrayList();
- proxyList.add("https://localhost/newPortal/j_spring_cas_security_check");
+ proxyList.add("https://localhost/newPortal/login/cas");
User user = new User("rod", "password", true, true, true, true, AuthorityUtils.createAuthorityList("ROLE_ONE", "ROLE_TWO"));
final Assertion assertion = new AssertionImpl("rod");
diff --git a/cas/src/test/java/org/springframework/security/cas/web/CasAuthenticationEntryPointTests.java b/cas/src/test/java/org/springframework/security/cas/web/CasAuthenticationEntryPointTests.java
index 5349fc4e94..9c0af7b2be 100644
--- a/cas/src/test/java/org/springframework/security/cas/web/CasAuthenticationEntryPointTests.java
+++ b/cas/src/test/java/org/springframework/security/cas/web/CasAuthenticationEntryPointTests.java
@@ -69,7 +69,7 @@ public class CasAuthenticationEntryPointTests extends TestCase {
public void testNormalOperationWithRenewFalse() throws Exception {
ServiceProperties sp = new ServiceProperties();
sp.setSendRenew(false);
- sp.setService("https://mycompany.com/bigWebApp/j_spring_cas_security_check");
+ sp.setService("https://mycompany.com/bigWebApp/login/cas");
CasAuthenticationEntryPoint ep = new CasAuthenticationEntryPoint();
ep.setLoginUrl("https://cas/login");
@@ -84,14 +84,14 @@ public class CasAuthenticationEntryPointTests extends TestCase {
ep.commence(request, response, null);
assertEquals("https://cas/login?service="
- + URLEncoder.encode("https://mycompany.com/bigWebApp/j_spring_cas_security_check", "UTF-8"),
+ + URLEncoder.encode("https://mycompany.com/bigWebApp/login/cas", "UTF-8"),
response.getRedirectedUrl());
}
public void testNormalOperationWithRenewTrue() throws Exception {
ServiceProperties sp = new ServiceProperties();
sp.setSendRenew(true);
- sp.setService("https://mycompany.com/bigWebApp/j_spring_cas_security_check");
+ sp.setService("https://mycompany.com/bigWebApp/login/cas");
CasAuthenticationEntryPoint ep = new CasAuthenticationEntryPoint();
ep.setLoginUrl("https://cas/login");
@@ -105,7 +105,7 @@ public class CasAuthenticationEntryPointTests extends TestCase {
ep.afterPropertiesSet();
ep.commence(request, response, null);
assertEquals("https://cas/login?service="
- + URLEncoder.encode("https://mycompany.com/bigWebApp/j_spring_cas_security_check", "UTF-8") + "&renew=true",
+ + URLEncoder.encode("https://mycompany.com/bigWebApp/login/cas", "UTF-8") + "&renew=true",
response.getRedirectedUrl());
}
}
diff --git a/cas/src/test/java/org/springframework/security/cas/web/CasAuthenticationFilterTests.java b/cas/src/test/java/org/springframework/security/cas/web/CasAuthenticationFilterTests.java
index 60c29e9827..309d8159df 100644
--- a/cas/src/test/java/org/springframework/security/cas/web/CasAuthenticationFilterTests.java
+++ b/cas/src/test/java/org/springframework/security/cas/web/CasAuthenticationFilterTests.java
@@ -71,7 +71,7 @@ public class CasAuthenticationFilterTests {
@Test
public void testNormalOperation() throws Exception {
MockHttpServletRequest request = new MockHttpServletRequest();
- request.setServletPath("/j_spring_cas_security_check");
+ request.setServletPath("/login/cas");
request.addParameter("ticket", "ST-0-ER94xMJmn6pha35CQRoZ");
CasAuthenticationFilter filter = new CasAuthenticationFilter();
diff --git a/config/src/main/java/org/springframework/security/config/annotation/web/builders/HttpSecurity.java b/config/src/main/java/org/springframework/security/config/annotation/web/builders/HttpSecurity.java
index b49b86eced..6bd5c3204a 100644
--- a/config/src/main/java/org/springframework/security/config/annotation/web/builders/HttpSecurity.java
+++ b/config/src/main/java/org/springframework/security/config/annotation/web/builders/HttpSecurity.java
@@ -948,8 +948,8 @@ public final class HttpSecurity extends AbstractConfiguredSecurityBuilderasList(provider));
+ } catch(NoSuchBeanDefinitionException noUds) {}
throw new NoSuchBeanDefinitionException(BeanIds.AUTHENTICATION_MANAGER, MISSING_BEAN_ERROR_MESSAGE);
}
throw e;
diff --git a/config/src/main/java/org/springframework/security/config/http/AuthenticationConfigBuilder.java b/config/src/main/java/org/springframework/security/config/http/AuthenticationConfigBuilder.java
index ff1d665836..f81785bc6e 100644
--- a/config/src/main/java/org/springframework/security/config/http/AuthenticationConfigBuilder.java
+++ b/config/src/main/java/org/springframework/security/config/http/AuthenticationConfigBuilder.java
@@ -130,12 +130,12 @@ final class AuthenticationConfigBuilder {
private String loginProcessingUrl;
private String openidLoginProcessingUrl;
- public AuthenticationConfigBuilder(Element element, ParserContext pc, SessionCreationPolicy sessionPolicy,
+ public AuthenticationConfigBuilder(Element element, boolean forceAutoConfig, ParserContext pc, SessionCreationPolicy sessionPolicy,
BeanReference requestCache, BeanReference authenticationManager, BeanReference sessionStrategy, BeanReference portMapper, BeanReference portResolver, BeanMetadataElement csrfLogoutHandler) {
this.httpElt = element;
this.pc = pc;
this.requestCache = requestCache;
- autoConfig = "true".equals(element.getAttribute(ATT_AUTO_CONFIG));
+ autoConfig = forceAutoConfig | "true".equals(element.getAttribute(ATT_AUTO_CONFIG));
this.allowSessionCreation = sessionPolicy != SessionCreationPolicy.NEVER
&& sessionPolicy != SessionCreationPolicy.STATELESS;
this.portMapper = portMapper;
@@ -193,7 +193,7 @@ final class AuthenticationConfigBuilder {
RootBeanDefinition formFilter = null;
if (formLoginElt != null || autoConfig) {
- FormLoginBeanDefinitionParser parser = new FormLoginBeanDefinitionParser("/j_spring_security_check",
+ FormLoginBeanDefinitionParser parser = new FormLoginBeanDefinitionParser("/login", "POST",
AUTHENTICATION_PROCESSING_FILTER_CLASS, requestCache, sessionStrategy, allowSessionCreation, portMapper, portResolver);
parser.parse(formLoginElt, pc);
@@ -218,7 +218,7 @@ final class AuthenticationConfigBuilder {
RootBeanDefinition openIDFilter = null;
if (openIDLoginElt != null) {
- FormLoginBeanDefinitionParser parser = new FormLoginBeanDefinitionParser("/j_spring_openid_security_check",
+ FormLoginBeanDefinitionParser parser = new FormLoginBeanDefinitionParser("/login/openid", null,
OPEN_ID_AUTHENTICATION_PROCESSING_FILTER_CLASS, requestCache, sessionStrategy, allowSessionCreation, portMapper, portResolver);
parser.parse(openIDLoginElt, pc);
@@ -492,7 +492,11 @@ final class AuthenticationConfigBuilder {
void createLogoutFilter() {
Element logoutElt = DomUtils.getChildElementByTagName(httpElt, Elements.LOGOUT);
if (logoutElt != null || autoConfig) {
- LogoutBeanDefinitionParser logoutParser = new LogoutBeanDefinitionParser(rememberMeServicesId, csrfLogoutHandler);
+ String formLoginPage = getLoginFormUrl(formEntryPoint);
+ if(formLoginPage == null) {
+ formLoginPage = DefaultLoginPageGeneratingFilter.DEFAULT_LOGIN_PAGE_URL;
+ }
+ LogoutBeanDefinitionParser logoutParser = new LogoutBeanDefinitionParser(formLoginPage,rememberMeServicesId, csrfLogoutHandler);
logoutFilter = logoutParser.parse(logoutElt, pc);
logoutHandlers = logoutParser.getLogoutHandlers();
}
diff --git a/config/src/main/java/org/springframework/security/config/http/FilterInvocationSecurityMetadataSourceParser.java b/config/src/main/java/org/springframework/security/config/http/FilterInvocationSecurityMetadataSourceParser.java
index d81ab4a41b..a6851f21a7 100644
--- a/config/src/main/java/org/springframework/security/config/http/FilterInvocationSecurityMetadataSourceParser.java
+++ b/config/src/main/java/org/springframework/security/config/http/FilterInvocationSecurityMetadataSourceParser.java
@@ -48,7 +48,7 @@ public class FilterInvocationSecurityMetadataSourceParser implements BeanDefinit
}
}
- BeanDefinition mds = createSecurityMetadataSource(interceptUrls, element, parserContext);
+ BeanDefinition mds = createSecurityMetadataSource(interceptUrls, false, element, parserContext);
String id = element.getAttribute(AbstractBeanDefinitionParser.ID_ATTRIBUTE);
@@ -60,16 +60,16 @@ public class FilterInvocationSecurityMetadataSourceParser implements BeanDefinit
return mds;
}
- static RootBeanDefinition createSecurityMetadataSource(List interceptUrls, Element elt, ParserContext pc) {
- MatcherType matcherType = MatcherType.fromElement(elt);
- boolean useExpressions = isUseExpressions(elt);
+ static RootBeanDefinition createSecurityMetadataSource(List interceptUrls, boolean addAllAuth, Element httpElt, ParserContext pc) {
+ MatcherType matcherType = MatcherType.fromElement(httpElt);
+ boolean useExpressions = isUseExpressions(httpElt);
ManagedMap requestToAttributesMap = parseInterceptUrlsForFilterInvocationRequestMap(
- matcherType, interceptUrls, useExpressions, pc);
+ matcherType, interceptUrls, useExpressions, addAllAuth, pc);
BeanDefinitionBuilder fidsBuilder;
if (useExpressions) {
- Element expressionHandlerElt = DomUtils.getChildElementByTagName(elt, Elements.EXPRESSION_HANDLER);
+ Element expressionHandlerElt = DomUtils.getChildElementByTagName(httpElt, Elements.EXPRESSION_HANDLER);
String expressionHandlerRef = expressionHandlerElt == null ? null : expressionHandlerElt.getAttribute("ref");
if (StringUtils.hasText(expressionHandlerRef)) {
@@ -86,7 +86,7 @@ public class FilterInvocationSecurityMetadataSourceParser implements BeanDefinit
fidsBuilder.addConstructorArgValue(requestToAttributesMap);
}
- fidsBuilder.getRawBeanDefinition().setSource(pc.extractSource(elt));
+ fidsBuilder.getRawBeanDefinition().setSource(pc.extractSource(httpElt));
return (RootBeanDefinition) fidsBuilder.getBeanDefinition();
}
@@ -100,12 +100,13 @@ public class FilterInvocationSecurityMetadataSourceParser implements BeanDefinit
}
static boolean isUseExpressions(Element elt) {
- return "true".equals(elt.getAttribute(ATT_USE_EXPRESSIONS));
+ String useExpressions = elt.getAttribute(ATT_USE_EXPRESSIONS);
+ return !StringUtils.hasText(useExpressions) || "true".equals(useExpressions);
}
private static ManagedMap
parseInterceptUrlsForFilterInvocationRequestMap(MatcherType matcherType,
- List urlElts, boolean useExpressions, ParserContext parserContext) {
+ List urlElts, boolean useExpressions, boolean addAuthenticatedAll, ParserContext parserContext) {
ManagedMap filterInvocationDefinitionMap = new ManagedMap();
@@ -147,6 +148,15 @@ public class FilterInvocationSecurityMetadataSourceParser implements BeanDefinit
filterInvocationDefinitionMap.put(matcher, attributeBuilder.getBeanDefinition());
}
+ if(addAuthenticatedAll && filterInvocationDefinitionMap.isEmpty()) {
+
+ BeanDefinition matcher = matcherType.createMatcher("/**", null);
+ BeanDefinitionBuilder attributeBuilder = BeanDefinitionBuilder.rootBeanDefinition(SecurityConfig.class);
+ attributeBuilder.addConstructorArgValue(new String[] { "authenticated" });
+ attributeBuilder.setFactoryMethod("createList");
+ filterInvocationDefinitionMap.put(matcher, attributeBuilder.getBeanDefinition());
+ }
+
return filterInvocationDefinitionMap;
}
diff --git a/config/src/main/java/org/springframework/security/config/http/FormLoginBeanDefinitionParser.java b/config/src/main/java/org/springframework/security/config/http/FormLoginBeanDefinitionParser.java
index 42f9e3e9a4..9a08bff9b2 100644
--- a/config/src/main/java/org/springframework/security/config/http/FormLoginBeanDefinitionParser.java
+++ b/config/src/main/java/org/springframework/security/config/http/FormLoginBeanDefinitionParser.java
@@ -66,11 +66,13 @@ public class FormLoginBeanDefinitionParser {
private RootBeanDefinition filterBean;
private RootBeanDefinition entryPointBean;
private String loginPage;
+ private String loginMethod;
private String loginProcessingUrl;
- FormLoginBeanDefinitionParser(String defaultLoginProcessingUrl, String filterClassName,
+ FormLoginBeanDefinitionParser(String defaultLoginProcessingUrl, String loginMethod, String filterClassName,
BeanReference requestCache, BeanReference sessionStrategy, boolean allowSessionCreation, BeanReference portMapper, BeanReference portResolver) {
this.defaultLoginProcessingUrl = defaultLoginProcessingUrl;
+ this.loginMethod = loginMethod;
this.filterClassName = filterClassName;
this.requestCache = requestCache;
this.sessionStrategy = sessionStrategy;
@@ -153,6 +155,9 @@ public class FormLoginBeanDefinitionParser {
BeanDefinitionBuilder matcherBuilder = BeanDefinitionBuilder.rootBeanDefinition("org.springframework.security.web.util.matcher.AntPathRequestMatcher");
matcherBuilder.addConstructorArgValue(loginUrl);
+ if(loginMethod != null) {
+ matcherBuilder.addConstructorArgValue("POST");
+ }
filterBuilder.addPropertyValue("requiresAuthenticationRequestMatcher", matcherBuilder.getBeanDefinition());
diff --git a/config/src/main/java/org/springframework/security/config/http/HttpConfigurationBuilder.java b/config/src/main/java/org/springframework/security/config/http/HttpConfigurationBuilder.java
index b158df688a..aec530bb80 100644
--- a/config/src/main/java/org/springframework/security/config/http/HttpConfigurationBuilder.java
+++ b/config/src/main/java/org/springframework/security/config/http/HttpConfigurationBuilder.java
@@ -133,10 +133,12 @@ class HttpConfigurationBuilder {
private CsrfBeanDefinitionParser csrfParser;
private BeanDefinition invalidSession;
+ private boolean addAllAuth;
- public HttpConfigurationBuilder(Element element, ParserContext pc,
+ public HttpConfigurationBuilder(Element element, boolean addAllAuth, ParserContext pc,
BeanReference portMapper, BeanReference portResolver, BeanReference authenticationManager) {
this.httpElt = element;
+ this.addAllAuth = addAllAuth;
this.pc = pc;
this.portMapper = portMapper;
this.portResolver = portResolver;
@@ -583,7 +585,7 @@ class HttpConfigurationBuilder {
private void createFilterSecurityInterceptor(BeanReference authManager) {
boolean useExpressions = FilterInvocationSecurityMetadataSourceParser.isUseExpressions(httpElt);
- RootBeanDefinition securityMds = FilterInvocationSecurityMetadataSourceParser.createSecurityMetadataSource(interceptUrls, httpElt, pc);
+ RootBeanDefinition securityMds = FilterInvocationSecurityMetadataSourceParser.createSecurityMetadataSource(interceptUrls, addAllAuth, httpElt, pc);
RootBeanDefinition accessDecisionMgr;
ManagedList voters = new ManagedList(2);
diff --git a/config/src/main/java/org/springframework/security/config/http/HttpSecurityBeanDefinitionParser.java b/config/src/main/java/org/springframework/security/config/http/HttpSecurityBeanDefinitionParser.java
index fbeea15cb6..c4c9d1cec6 100644
--- a/config/src/main/java/org/springframework/security/config/http/HttpSecurityBeanDefinitionParser.java
+++ b/config/src/main/java/org/springframework/security/config/http/HttpSecurityBeanDefinitionParser.java
@@ -132,10 +132,11 @@ public class HttpSecurityBeanDefinitionParser implements BeanDefinitionParser {
ManagedList authenticationProviders = new ManagedList();
BeanReference authenticationManager = createAuthenticationManager(element, pc, authenticationProviders);
- HttpConfigurationBuilder httpBldr = new HttpConfigurationBuilder(element, pc,
+ boolean forceAutoConfig = isDefaultHttpConfig(element);
+ HttpConfigurationBuilder httpBldr = new HttpConfigurationBuilder(element, forceAutoConfig, pc,
portMapper, portResolver, authenticationManager);
- AuthenticationConfigBuilder authBldr = new AuthenticationConfigBuilder(element, pc,
+ AuthenticationConfigBuilder authBldr = new AuthenticationConfigBuilder(element, forceAutoConfig, pc,
httpBldr.getSessionCreationPolicy(), httpBldr.getRequestCache(), authenticationManager,
httpBldr.getSessionStrategy(), portMapper, portResolver, httpBldr.getCsrfLogoutHandler());
@@ -164,6 +165,10 @@ public class HttpSecurityBeanDefinitionParser implements BeanDefinitionParser {
return createSecurityFilterChainBean(element, pc, filterChain);
}
+ private static boolean isDefaultHttpConfig(Element httpElt) {
+ return httpElt.getChildNodes().getLength() == 0 && httpElt.getAttributes().getLength() == 0;
+ }
+
private BeanReference createSecurityFilterChainBean(Element element, ParserContext pc, List> filterChain) {
BeanMetadataElement filterChainMatcher;
diff --git a/config/src/main/java/org/springframework/security/config/http/LogoutBeanDefinitionParser.java b/config/src/main/java/org/springframework/security/config/http/LogoutBeanDefinitionParser.java
index aa1c8c1a66..2a1c330989 100644
--- a/config/src/main/java/org/springframework/security/config/http/LogoutBeanDefinitionParser.java
+++ b/config/src/main/java/org/springframework/security/config/http/LogoutBeanDefinitionParser.java
@@ -35,23 +35,24 @@ import org.w3c.dom.Element;
*/
class LogoutBeanDefinitionParser implements BeanDefinitionParser {
static final String ATT_LOGOUT_SUCCESS_URL = "logout-success-url";
- static final String DEF_LOGOUT_SUCCESS_URL = "/";
static final String ATT_INVALIDATE_SESSION = "invalidate-session";
static final String ATT_LOGOUT_URL = "logout-url";
- static final String DEF_LOGOUT_URL = "/j_spring_security_logout";
+ static final String DEF_LOGOUT_URL = "/logout";
static final String ATT_LOGOUT_HANDLER = "success-handler-ref";
static final String ATT_DELETE_COOKIES = "delete-cookies";
final String rememberMeServices;
+ private final String defaultLogoutUrl;
private ManagedList logoutHandlers = new ManagedList();
private boolean csrfEnabled;
- public LogoutBeanDefinitionParser(String rememberMeServices, BeanMetadataElement csrfLogoutHandler) {
+ public LogoutBeanDefinitionParser(String loginPageUrl, String rememberMeServices, BeanMetadataElement csrfLogoutHandler) {
+ this.defaultLogoutUrl = loginPageUrl + "?logout";
this.rememberMeServices = rememberMeServices;
this.csrfEnabled = csrfLogoutHandler != null;
- if(this.csrfEnabled) {
+ if (this.csrfEnabled) {
logoutHandlers.add(csrfLogoutHandler);
}
}
@@ -93,7 +94,7 @@ class LogoutBeanDefinitionParser implements BeanDefinitionParser {
} else {
// Use the logout URL if no handler set
if (!StringUtils.hasText(logoutSuccessUrl)) {
- logoutSuccessUrl = DEF_LOGOUT_SUCCESS_URL;
+ logoutSuccessUrl = defaultLogoutUrl;
}
builder.addConstructorArgValue(logoutSuccessUrl);
}
diff --git a/config/src/main/resources/org/springframework/security/config/spring-security-2.0.1.xsd b/config/src/main/resources/org/springframework/security/config/spring-security-2.0.1.xsd
index 1d8830a073..a10875e002 100644
--- a/config/src/main/resources/org/springframework/security/config/spring-security-2.0.1.xsd
+++ b/config/src/main/resources/org/springframework/security/config/spring-security-2.0.1.xsd
@@ -844,7 +844,7 @@
Specifies the URL that will cause a logout. Spring Security will
initialize a filter that responds to this particular URL. Defaults to
- /j_spring_security_logout if unspecified.
+ /logout if unspecified.
@@ -864,7 +864,7 @@
The URL that the login form is posted to. If unspecified, it defaults to
- /j_spring_security_check.
+ /login.
diff --git a/config/src/main/resources/org/springframework/security/config/spring-security-2.0.2.xsd b/config/src/main/resources/org/springframework/security/config/spring-security-2.0.2.xsd
index c80145e285..58e0199094 100644
--- a/config/src/main/resources/org/springframework/security/config/spring-security-2.0.2.xsd
+++ b/config/src/main/resources/org/springframework/security/config/spring-security-2.0.2.xsd
@@ -863,7 +863,7 @@
Specifies the URL that will cause a logout. Spring Security will
initialize a filter that responds to this particular URL. Defaults to
- /j_spring_security_logout if unspecified.
+ /logout if unspecified.
@@ -883,7 +883,7 @@
The URL that the login form is posted to. If unspecified, it defaults to
- /j_spring_security_check.
+ /login.
diff --git a/config/src/main/resources/org/springframework/security/config/spring-security-2.0.4.xsd b/config/src/main/resources/org/springframework/security/config/spring-security-2.0.4.xsd
index 34844f4a38..032f256c9b 100644
--- a/config/src/main/resources/org/springframework/security/config/spring-security-2.0.4.xsd
+++ b/config/src/main/resources/org/springframework/security/config/spring-security-2.0.4.xsd
@@ -893,7 +893,7 @@
Specifies the URL that will cause a logout. Spring Security will
initialize a filter that responds to this particular URL. Defaults to
- /j_spring_security_logout if unspecified.
+ /logout if unspecified.
@@ -913,7 +913,7 @@
The URL that the login form is posted to. If unspecified, it defaults to
- /j_spring_security_check.
+ /login.
diff --git a/config/src/main/resources/org/springframework/security/config/spring-security-2.0.xsd b/config/src/main/resources/org/springframework/security/config/spring-security-2.0.xsd
index 1106f7a78a..f64b0cfb4c 100644
--- a/config/src/main/resources/org/springframework/security/config/spring-security-2.0.xsd
+++ b/config/src/main/resources/org/springframework/security/config/spring-security-2.0.xsd
@@ -772,7 +772,7 @@
Specifies the URL that will cause a logout. Spring Security will
initialize a filter that responds to this particular URL. Defaults to
- /j_spring_security_logout if unspecified.
+ /logout if unspecified.
@@ -792,7 +792,7 @@
The URL that the login form is posted to. If unspecified, it defaults to
- /j_spring_security_check.
+ /login.
diff --git a/config/src/main/resources/org/springframework/security/config/spring-security-3.0.3.xsd b/config/src/main/resources/org/springframework/security/config/spring-security-3.0.3.xsd
index f3d11045a9..3f026e78f9 100644
--- a/config/src/main/resources/org/springframework/security/config/spring-security-3.0.3.xsd
+++ b/config/src/main/resources/org/springframework/security/config/spring-security-3.0.3.xsd
@@ -799,7 +799,7 @@
- Specifies the URL that will cause a logout. Spring Security will initialize a filter that responds to this particular URL. Defaults to /j_spring_security_logout if unspecified.
+ Specifies the URL that will cause a logout. Spring Security will initialize a filter that responds to this particular URL. Defaults to /logout if unspecified.
@@ -827,7 +827,7 @@
- The URL that the login form is posted to. If unspecified, it defaults to /j_spring_security_check.
+ The URL that the login form is posted to. If unspecified, it defaults to /login.
diff --git a/config/src/main/resources/org/springframework/security/config/spring-security-3.0.xsd b/config/src/main/resources/org/springframework/security/config/spring-security-3.0.xsd
index de2df47956..6a57eb4070 100644
--- a/config/src/main/resources/org/springframework/security/config/spring-security-3.0.xsd
+++ b/config/src/main/resources/org/springframework/security/config/spring-security-3.0.xsd
@@ -787,7 +787,7 @@
- Specifies the URL that will cause a logout. Spring Security will initialize a filter that responds to this particular URL. Defaults to /j_spring_security_logout if unspecified.
+ Specifies the URL that will cause a logout. Spring Security will initialize a filter that responds to this particular URL. Defaults to /logout if unspecified.
@@ -815,7 +815,7 @@
- The URL that the login form is posted to. If unspecified, it defaults to /j_spring_security_check.
+ The URL that the login form is posted to. If unspecified, it defaults to /login.
diff --git a/config/src/main/resources/org/springframework/security/config/spring-security-3.1.rnc b/config/src/main/resources/org/springframework/security/config/spring-security-3.1.rnc
index 4a36b496ee..958d7e176b 100644
--- a/config/src/main/resources/org/springframework/security/config/spring-security-3.1.rnc
+++ b/config/src/main/resources/org/springframework/security/config/spring-security-3.1.rnc
@@ -370,7 +370,7 @@ logout =
## Incorporates a logout processing filter. Most web applications require a logout filter, although you may not require one if you write a controller to provider similar logic.
element logout {logout.attlist, empty}
logout.attlist &=
- ## Specifies the URL that will cause a logout. Spring Security will initialize a filter that responds to this particular URL. Defaults to /j_spring_security_logout if unspecified.
+ ## Specifies the URL that will cause a logout. Spring Security will initialize a filter that responds to this particular URL. Defaults to /logout if unspecified.
attribute logout-url {xsd:token}?
logout.attlist &=
## Specifies the URL to display once the user has logged out. If not specified, defaults to /.
@@ -393,13 +393,13 @@ form-login =
## Sets up a form login configuration for authentication with a username and password
element form-login {form-login.attlist, empty}
form-login.attlist &=
- ## The URL that the login form is posted to. If unspecified, it defaults to /j_spring_security_check.
+ ## The URL that the login form is posted to. If unspecified, it defaults to /login.
attribute login-processing-url {xsd:token}?
form-login.attlist &=
- ## The name of the request parameter which contains the username. Defaults to 'j_username'.
+ ## The name of the request parameter which contains the username. Defaults to 'username'.
attribute username-parameter {xsd:token}?
form-login.attlist &=
- ## The name of the request parameter which contains the password. Defaults to 'j_password'.
+ ## The name of the request parameter which contains the password. Defaults to 'password'.
attribute password-parameter {xsd:token}?
form-login.attlist &=
## The URL that will be redirected to after successful authentication, if the user's previous action could not be resumed. This generally happens if the user visits a login page without having first requested a secured operation that triggers authentication. If unspecified, defaults to the root of the application.
diff --git a/config/src/main/resources/org/springframework/security/config/spring-security-3.1.xsd b/config/src/main/resources/org/springframework/security/config/spring-security-3.1.xsd
index b44c9f070b..2c2b6fc457 100644
--- a/config/src/main/resources/org/springframework/security/config/spring-security-3.1.xsd
+++ b/config/src/main/resources/org/springframework/security/config/spring-security-3.1.xsd
@@ -1278,7 +1278,7 @@
Specifies the URL that will cause a logout. Spring Security will initialize a filter that
- responds to this particular URL. Defaults to /j_spring_security_logout if unspecified.
+ responds to this particular URL. Defaults to /logout if unspecified.
@@ -1325,19 +1325,19 @@
The URL that the login form is posted to. If unspecified, it defaults to
- /j_spring_security_check.
+ /login.
- The name of the request parameter which contains the username. Defaults to 'j_username'.
+ The name of the request parameter which contains the username. Defaults to 'username'.
- The name of the request parameter which contains the password. Defaults to 'j_password'.
+ The name of the request parameter which contains the password. Defaults to 'password'.
diff --git a/config/src/main/resources/org/springframework/security/config/spring-security-3.2.rnc b/config/src/main/resources/org/springframework/security/config/spring-security-3.2.rnc
index 4bf7519ae1..b2e3a62e8b 100644
--- a/config/src/main/resources/org/springframework/security/config/spring-security-3.2.rnc
+++ b/config/src/main/resources/org/springframework/security/config/spring-security-3.2.rnc
@@ -370,7 +370,7 @@ logout =
## Incorporates a logout processing filter. Most web applications require a logout filter, although you may not require one if you write a controller to provider similar logic.
element logout {logout.attlist, empty}
logout.attlist &=
- ## Specifies the URL that will cause a logout. Spring Security will initialize a filter that responds to this particular URL. Defaults to /j_spring_security_logout if unspecified.
+ ## Specifies the URL that will cause a logout. Spring Security will initialize a filter that responds to this particular URL. Defaults to /logout if unspecified.
attribute logout-url {xsd:token}?
logout.attlist &=
## Specifies the URL to display once the user has logged out. If not specified, defaults to /.
@@ -393,13 +393,13 @@ form-login =
## Sets up a form login configuration for authentication with a username and password
element form-login {form-login.attlist, empty}
form-login.attlist &=
- ## The URL that the login form is posted to. If unspecified, it defaults to /j_spring_security_check.
+ ## The URL that the login form is posted to. If unspecified, it defaults to /login.
attribute login-processing-url {xsd:token}?
form-login.attlist &=
- ## The name of the request parameter which contains the username. Defaults to 'j_username'.
+ ## The name of the request parameter which contains the username. Defaults to 'username'.
attribute username-parameter {xsd:token}?
form-login.attlist &=
- ## The name of the request parameter which contains the password. Defaults to 'j_password'.
+ ## The name of the request parameter which contains the password. Defaults to 'password'.
attribute password-parameter {xsd:token}?
form-login.attlist &=
## The URL that will be redirected to after successful authentication, if the user's previous action could not be resumed. This generally happens if the user visits a login page without having first requested a secured operation that triggers authentication. If unspecified, defaults to the root of the application.
diff --git a/config/src/main/resources/org/springframework/security/config/spring-security-3.2.xsd b/config/src/main/resources/org/springframework/security/config/spring-security-3.2.xsd
index d60cd056c6..3007855206 100644
--- a/config/src/main/resources/org/springframework/security/config/spring-security-3.2.xsd
+++ b/config/src/main/resources/org/springframework/security/config/spring-security-3.2.xsd
@@ -1280,7 +1280,7 @@
Specifies the URL that will cause a logout. Spring Security will initialize a filter that
- responds to this particular URL. Defaults to /j_spring_security_logout if unspecified.
+ responds to this particular URL. Defaults to /logout if unspecified.
@@ -1327,19 +1327,19 @@
The URL that the login form is posted to. If unspecified, it defaults to
- /j_spring_security_check.
+ /login.
- The name of the request parameter which contains the username. Defaults to 'j_username'.
+ The name of the request parameter which contains the username. Defaults to 'username'.
- The name of the request parameter which contains the password. Defaults to 'j_password'.
+ The name of the request parameter which contains the password. Defaults to 'password'.
diff --git a/config/src/main/resources/org/springframework/security/config/spring-security-4.0.rnc b/config/src/main/resources/org/springframework/security/config/spring-security-4.0.rnc
index 572d8e8266..f426cdf779 100644
--- a/config/src/main/resources/org/springframework/security/config/spring-security-4.0.rnc
+++ b/config/src/main/resources/org/springframework/security/config/spring-security-4.0.rnc
@@ -73,7 +73,7 @@ role-prefix =
attribute role-prefix {xsd:token}
use-expressions =
- ## Enables the use of expressions in the 'access' attributes in elements rather than the traditional list of configuration attributes. Defaults to 'false'. If enabled, each attribute should contain a single boolean expression. If the expression evaluates to 'true', access will be granted.
+ ## Enables the use of expressions in the 'access' attributes in elements rather than the traditional list of configuration attributes. Defaults to 'true'. If enabled, each attribute should contain a single boolean expression. If the expression evaluates to 'true', access will be granted.
attribute use-expressions {xsd:boolean}
ldap-server =
@@ -380,7 +380,7 @@ logout =
## Incorporates a logout processing filter. Most web applications require a logout filter, although you may not require one if you write a controller to provider similar logic.
element logout {logout.attlist, empty}
logout.attlist &=
- ## Specifies the URL that will cause a logout. Spring Security will initialize a filter that responds to this particular URL. Defaults to /j_spring_security_logout if unspecified.
+ ## Specifies the URL that will cause a logout. Spring Security will initialize a filter that responds to this particular URL. Defaults to /logout if unspecified.
attribute logout-url {xsd:token}?
logout.attlist &=
## Specifies the URL to display once the user has logged out. If not specified, defaults to /.
@@ -403,13 +403,13 @@ form-login =
## Sets up a form login configuration for authentication with a username and password
element form-login {form-login.attlist, empty}
form-login.attlist &=
- ## The URL that the login form is posted to. If unspecified, it defaults to /j_spring_security_check.
+ ## The URL that the login form is posted to. If unspecified, it defaults to /login.
attribute login-processing-url {xsd:token}?
form-login.attlist &=
- ## The name of the request parameter which contains the username. Defaults to 'j_username'.
+ ## The name of the request parameter which contains the username. Defaults to 'username'.
attribute username-parameter {xsd:token}?
form-login.attlist &=
- ## The name of the request parameter which contains the password. Defaults to 'j_password'.
+ ## The name of the request parameter which contains the password. Defaults to 'password'.
attribute password-parameter {xsd:token}?
form-login.attlist &=
## The URL that will be redirected to after successful authentication, if the user's previous action could not be resumed. This generally happens if the user visits a login page without having first requested a secured operation that triggers authentication. If unspecified, defaults to the root of the application.
@@ -418,10 +418,10 @@ form-login.attlist &=
## Whether the user should always be redirected to the default-target-url after login.
attribute always-use-default-target {xsd:boolean}?
form-login.attlist &=
- ## The URL for the login page. If no login URL is specified, Spring Security will automatically create a login URL at /spring_security_login and a corresponding filter to render that login URL when requested.
+ ## The URL for the login page. If no login URL is specified, Spring Security will automatically create a login URL at GET /login and a corresponding filter to render that login URL when requested.
attribute login-page {xsd:token}?
form-login.attlist &=
- ## The URL for the login failure page. If no login failure URL is specified, Spring Security will automatically create a failure login URL at /spring_security_login?login_error and a corresponding filter to render that login failure URL when requested.
+ ## The URL for the login failure page. If no login failure URL is specified, Spring Security will automatically create a failure login URL at /login?error and a corresponding filter to render that login failure URL when requested.
attribute authentication-failure-url {xsd:token}?
form-login.attlist &=
## Reference to an AuthenticationSuccessHandler bean which should be used to handle a successful authentication request. Should not be used in combination with default-target-url (or always-use-default-target-url) as the implementation should always deal with navigation to the subsequent destination
diff --git a/config/src/main/resources/org/springframework/security/config/spring-security-4.0.xsd b/config/src/main/resources/org/springframework/security/config/spring-security-4.0.xsd
index 1c9fd007f5..56989b5e4a 100644
--- a/config/src/main/resources/org/springframework/security/config/spring-security-4.0.xsd
+++ b/config/src/main/resources/org/springframework/security/config/spring-security-4.0.xsd
@@ -1307,7 +1307,7 @@
Specifies the URL that will cause a logout. Spring Security will initialize a filter that
- responds to this particular URL. Defaults to /j_spring_security_logout if unspecified.
+ responds to this particular URL. Defaults to /logout if unspecified.
@@ -1354,19 +1354,19 @@
The URL that the login form is posted to. If unspecified, it defaults to
- /j_spring_security_check.
+ /login.
- The name of the request parameter which contains the username. Defaults to 'j_username'.
+ The name of the request parameter which contains the username. Defaults to 'username'.
- The name of the request parameter which contains the password. Defaults to 'j_password'.
+ The name of the request parameter which contains the password. Defaults to 'password'.
@@ -1388,7 +1388,7 @@
The URL for the login page. If no login URL is specified, Spring Security will
- automatically create a login URL at /spring_security_login and a corresponding filter to
+ automatically create a login URL at GET /login and a corresponding filter to
render that login URL when requested.
@@ -1396,7 +1396,7 @@
The URL for the login failure page. If no login failure URL is specified, Spring Security
- will automatically create a failure login URL at /spring_security_login?login_error and a
+ will automatically create a failure login URL at /login?error and a
corresponding filter to render that login failure URL when requested.
diff --git a/config/src/test/groovy/org/springframework/security/config/annotation/web/SampleWebSecurityConfigurerAdapterTests.groovy b/config/src/test/groovy/org/springframework/security/config/annotation/web/SampleWebSecurityConfigurerAdapterTests.groovy
index 37707da0e1..5a4d6adcbf 100644
--- a/config/src/test/groovy/org/springframework/security/config/annotation/web/SampleWebSecurityConfigurerAdapterTests.groovy
+++ b/config/src/test/groovy/org/springframework/security/config/annotation/web/SampleWebSecurityConfigurerAdapterTests.groovy
@@ -63,7 +63,7 @@ public class SampleWebSecurityConfigurerAdapterTests extends BaseSpringSpec {
/**
*
- *
+ *
*
*
*
*
- *
+ *
*
*
*
@@ -239,12 +239,12 @@ public class SampleWebSecurityConfigurerAdapterTests extends BaseSpringSpec {
/**
*
*
- *
+ *
*
*
*
*
- *
+ *
*
*
*
diff --git a/config/src/test/groovy/org/springframework/security/config/annotation/web/configurers/NamespaceHttpFormLoginTests.groovy b/config/src/test/groovy/org/springframework/security/config/annotation/web/configurers/NamespaceHttpFormLoginTests.groovy
index 7667f98192..0ed79e111a 100644
--- a/config/src/test/groovy/org/springframework/security/config/annotation/web/configurers/NamespaceHttpFormLoginTests.groovy
+++ b/config/src/test/groovy/org/springframework/security/config/annotation/web/configurers/NamespaceHttpFormLoginTests.groovy
@@ -105,8 +105,8 @@ public class NamespaceHttpFormLoginTests extends BaseSpringSpec {
super.setup()
request.servletPath = "/authentication/login/process"
request.method = "POST"
- request.parameters.j_username = ["user"] as String[]
- request.parameters.j_password = ["password"] as String[]
+ request.parameters.username = ["user"] as String[]
+ request.parameters.password = ["password"] as String[]
springSecurityFilterChain.doFilter(request,response,chain)
then: "sent to default succes page"
response.getRedirectedUrl() == "/default"
@@ -121,8 +121,8 @@ public class NamespaceHttpFormLoginTests extends BaseSpringSpec {
.anyRequest().hasRole("USER")
.and()
.formLogin()
- .usernameParameter("j_username") // form-login@username-parameter
- .passwordParameter("j_password") // form-login@password-parameter
+ .usernameParameter("username") // form-login@username-parameter
+ .passwordParameter("password") // form-login@password-parameter
.loginPage("/authentication/login") // form-login@login-page
.failureUrl("/authentication/login?failed") // form-login@authentication-failure-url
.loginProcessingUrl("/authentication/login/process") // form-login@login-processing-url
diff --git a/config/src/test/groovy/org/springframework/security/config/http/AbstractHttpConfigTests.groovy b/config/src/test/groovy/org/springframework/security/config/http/AbstractHttpConfigTests.groovy
index 5c82e4bb77..976d96c409 100644
--- a/config/src/test/groovy/org/springframework/security/config/http/AbstractHttpConfigTests.groovy
+++ b/config/src/test/groovy/org/springframework/security/config/http/AbstractHttpConfigTests.groovy
@@ -20,6 +20,8 @@ import org.springframework.security.config.AbstractXmlConfigTests
import org.springframework.security.config.BeanIds
import org.springframework.security.web.FilterInvocation
+import javax.servlet.http.HttpServletRequest
+
/**
*
* @author Rob Winch
@@ -29,11 +31,11 @@ abstract class AbstractHttpConfigTests extends AbstractXmlConfigTests {
final int AUTO_CONFIG_FILTERS = 14;
def httpAutoConfig(Closure c) {
- xml.http('auto-config': 'true', c)
+ xml.http(['auto-config': 'true', 'use-expressions':false], c)
}
def httpAutoConfig(String matcher, Closure c) {
- xml.http(['auto-config': 'true', 'request-matcher': matcher], c)
+ xml.http(['auto-config': 'true', 'use-expressions':false, 'request-matcher': matcher], c)
}
def interceptUrl(String path, String authz) {
@@ -72,4 +74,9 @@ abstract class AbstractHttpConfigTests extends AbstractXmlConfigTests {
return new FilterInvocation(request, new MockHttpServletResponse(), new MockFilterChain());
}
+
+ def basicLogin(HttpServletRequest request, String username="user",String password="password") {
+ def credentials = username + ":" + password
+ request.addHeader("Authorization", "Basic " + credentials.bytes.encodeBase64())
+ }
}
diff --git a/config/src/test/groovy/org/springframework/security/config/http/CsrfConfigTests.groovy b/config/src/test/groovy/org/springframework/security/config/http/CsrfConfigTests.groovy
index 2d03eb42cc..c1ec6ca659 100644
--- a/config/src/test/groovy/org/springframework/security/config/http/CsrfConfigTests.groovy
+++ b/config/src/test/groovy/org/springframework/security/config/http/CsrfConfigTests.groovy
@@ -152,14 +152,14 @@ class CsrfConfigTests extends AbstractHttpConfigTests {
springSecurityFilterChain.doFilter(request,response,chain)
then: "sent to the login page"
response.status == HttpServletResponse.SC_MOVED_TEMPORARILY
- response.redirectedUrl == "http://localhost/spring_security_login"
+ response.redirectedUrl == "http://localhost/login"
when: "authenticate successfully"
response = new MockHttpServletResponse()
request = new MockHttpServletRequest(session: request.session)
- request.servletPath = "/j_spring_security_check"
+ request.servletPath = "/login"
request.setParameter(token.parameterName,token.token)
- request.setParameter("j_username","user")
- request.setParameter("j_password","password")
+ request.setParameter("username","user")
+ request.setParameter("password","password")
request.method = "POST"
springSecurityFilterChain.doFilter(request,response,chain)
then: "sent to default success because we don't want csrf attempts made prior to authentication to pass"
@@ -186,14 +186,14 @@ class CsrfConfigTests extends AbstractHttpConfigTests {
springSecurityFilterChain.doFilter(request,response,chain)
then: "sent to the login page"
response.status == HttpServletResponse.SC_MOVED_TEMPORARILY
- response.redirectedUrl == "http://localhost/spring_security_login"
+ response.redirectedUrl == "http://localhost/login"
when: "authenticate successfully"
response = new MockHttpServletResponse()
request = new MockHttpServletRequest(session: request.session)
- request.servletPath = "/j_spring_security_check"
+ request.servletPath = "/login"
request.setParameter(token.parameterName,token.token)
- request.setParameter("j_username","user")
- request.setParameter("j_password","password")
+ request.setParameter("username","user")
+ request.setParameter("password","password")
request.method = "POST"
springSecurityFilterChain.doFilter(request,response,chain)
then: "sent to original URL since it was a GET"
@@ -279,9 +279,9 @@ class CsrfConfigTests extends AbstractHttpConfigTests {
when(repo.loadToken(any(HttpServletRequest))).thenReturn(token)
request.setParameter(token.parameterName,token.token)
request.method = "POST"
- request.setParameter("j_username","user")
- request.setParameter("j_password","password")
- request.servletPath = "/j_spring_security_check"
+ request.setParameter("username","user")
+ request.setParameter("password","password")
+ request.servletPath = "/login"
when:
springSecurityFilterChain.doFilter(request,response,chain)
then:
@@ -300,7 +300,7 @@ class CsrfConfigTests extends AbstractHttpConfigTests {
when(repo.loadToken(any(HttpServletRequest))).thenReturn(token)
request.setParameter(token.parameterName,token.token)
request.method = "POST"
- request.servletPath = "/j_spring_security_logout"
+ request.servletPath = "/logout"
when:
springSecurityFilterChain.doFilter(request,response,chain)
then:
@@ -315,7 +315,7 @@ class CsrfConfigTests extends AbstractHttpConfigTests {
createAppContext()
login()
request.method = "GET"
- request.requestURI = "/j_spring_security_logout"
+ request.requestURI = "/logout"
when:
springSecurityFilterChain.doFilter(request,response,chain)
then:
diff --git a/config/src/test/groovy/org/springframework/security/config/http/FormLoginBeanDefinitionParserTests.groovy b/config/src/test/groovy/org/springframework/security/config/http/FormLoginBeanDefinitionParserTests.groovy
index 37f23194d8..d8def9663a 100644
--- a/config/src/test/groovy/org/springframework/security/config/http/FormLoginBeanDefinitionParserTests.groovy
+++ b/config/src/test/groovy/org/springframework/security/config/http/FormLoginBeanDefinitionParserTests.groovy
@@ -12,7 +12,7 @@ class FormLoginBeanDefinitionParserTests extends AbstractHttpConfigTests {
def 'form-login default login page'() {
setup:
- MockHttpServletRequest request = new MockHttpServletRequest(method:'GET',requestURI:'/spring_security_login')
+ MockHttpServletRequest request = new MockHttpServletRequest(method:'GET',requestURI:'/login')
MockHttpServletResponse response = new MockHttpServletResponse()
MockFilterChain chain = new MockFilterChain()
httpAutoConfig {
@@ -22,11 +22,11 @@ class FormLoginBeanDefinitionParserTests extends AbstractHttpConfigTests {
when:
springSecurityFilterChain.doFilter(request,response,chain)
then:
- response.getContentAsString() == """Login Page
-Login with Username and Password
"""
@@ -34,7 +34,7 @@ class FormLoginBeanDefinitionParserTests extends AbstractHttpConfigTests {
def 'form-login default login page custom attributes'() {
setup:
- MockHttpServletRequest request = new MockHttpServletRequest(method:'GET',requestURI:'/spring_security_login')
+ MockHttpServletRequest request = new MockHttpServletRequest(method:'GET',requestURI:'/login')
MockHttpServletResponse response = new MockHttpServletResponse()
MockFilterChain chain = new MockFilterChain()
httpAutoConfig {
@@ -57,7 +57,7 @@ class FormLoginBeanDefinitionParserTests extends AbstractHttpConfigTests {
def 'openid-login default login page'() {
setup:
- MockHttpServletRequest request = new MockHttpServletRequest(method:'GET',requestURI:'/spring_security_login')
+ MockHttpServletRequest request = new MockHttpServletRequest(method:'GET',requestURI:'/login')
MockHttpServletResponse response = new MockHttpServletResponse()
MockFilterChain chain = new MockFilterChain()
httpAutoConfig {
@@ -68,14 +68,14 @@ class FormLoginBeanDefinitionParserTests extends AbstractHttpConfigTests {
when:
springSecurityFilterChain.doFilter(request,response,chain)
then:
- response.getContentAsString() == """Login Page
-Login with Username and Password
Login with OpenID Identity
Login with OpenID Identity