e6223dede3
Merge branch '6.4.x'
...
- adb303e
2025-03-17 14:34:18 -05:00
05116eabbd
Merge branch '6.3.x' into 6.4.x
...
- adb303e
2025-03-17 14:18:49 -05:00
adb303e152
Add testRuntimeOnly junit-platform-launcher
...
Closes gh-16755
2025-03-17 14:16:44 -05:00
3a11d1529d
Merge branch '6.4.x'
...
- Disable Flaky WebAuthnWebDriverTests
Closes gh-16754
2025-03-17 13:57:37 -05:00
f2f9d8282a
Disable Flaky WebAuthnWebDriverTests
...
Closes gh-16753
2025-03-17 13:54:17 -05:00
58a665e5aa
Add Support SingleResultAuthorizationManager
...
Closes gh-16590
Signed-off-by: Max Batischev <mblancer@mail.ru>
2025-03-07 13:46:23 -07:00
72070cd191
Deprecate ChannelSecurityConfigurer
...
Closes gh-16680
2025-02-28 09:38:45 -07:00
be23268c37
Add redirectToHttps DSL Configurer
...
Closes gh-16679
2025-02-28 09:38:07 -07:00
fa35c5b4d8
Make DefaultOneTimeToken Serializable
...
Closes gh-16617
Signed-off-by: Max Batischev <mblancer@mail.ru>
2025-02-27 12:49:48 -07:00
76a566265c
Use PortResolver Beans by Default
...
Closes gh-16664
2025-02-26 16:13:10 -06:00
7d301f87d6
Add Opt-in PathPattern Strategy
...
Closes gh-16573
2025-02-21 13:40:24 -07:00
588220a020
Add PathPatterRequestMatcher
...
Closes gh-16429
Clsoes gh-16430
2025-02-21 13:40:23 -07:00
51ce91f07b
Merge branch '6.4.x'
2025-02-18 15:11:08 -07:00
cc2cfc62b0
Add Test Requiring serialVersionUID
...
Issue gh-16276
2025-02-18 15:06:50 -07:00
c4b223266c
Return Invalid Credentials message on login error
...
Closes gh-16484
Signed-off-by: tejas-teju <tejas8196@gmail.com>
2025-02-14 16:01:22 -07:00
e42865b926
Merge branch '6.4.x'
2025-02-14 13:08:17 -07:00
946812691e
Make AuthenticatorAttestation Serializable
...
Issue gh-16481
2025-02-14 13:07:56 -07:00
b5a4218a0b
Make WebAuthnAuthenticationRequestToken Serializable
...
Closes gh-16481
Signed-off-by: Max Batischev <mblancer@mail.ru>
2025-02-14 11:51:46 -07:00
f9e04594a7
Refactor authorization manager variable naming
...
- Renamed PERMIT_ALL_AUTHORIZATION_MANAGER to snake_case style
- Introduced AUTHORIZATION_DECISION for reuse
Signed-off-by: plll0123 <jsh951227@gmail.com>
2025-02-14 10:02:55 -07:00
666d3a4af6
Merge branch '6.4.x'
2025-02-13 17:25:39 -07:00
879b44f9a1
Make PublicKeyCredentialRequestOptions Serializable
...
Closes gh-16432
Signed-off-by: Max Batischev <mblancer@mail.ru>
2025-02-13 17:17:16 -07:00
2480d41981
Add support for OAuth 2.0 Demonstrating Proof of Possession (DPoP)
...
Signed-off-by: Joe Grandja <10884212+jgrandja@users.noreply.github.com>
2025-02-11 14:10:23 -05:00
238f47ce5e
One Time Token login registers the default login page
...
closes gh-16414
Signed-off-by: Daniel Garnier-Moiroux <git@garnier.wf>
2025-02-10 09:55:51 -06:00
5ee6b83953
Introduce OneTimeTokenAuthenticationFilter
...
closes gh-16539
Signed-off-by: Daniel Garnier-Moiroux <git@garnier.wf>
2025-02-10 09:55:51 -06:00
8e19b8039c
Merge branch '6.4.x'
2025-02-05 15:49:20 -07:00
4776446b14
Add Missing Serialzed AuthorizationDeniedException
...
Issue gh-16544
2025-02-05 15:48:55 -07:00
9676739c88
TestServerOneTimeTokenGenerationSuccessHandler.lastToken to non-static variable
...
Signed-off-by: Max Batischev <mblancer@mail.ru>
2025-02-05 14:14:16 -07:00
be81377235
Add Support ServerGenerateOneTimeTokenRequestResolver
...
Closes gh-16488
Signed-off-by: Max Batischev <mblancer@mail.ru>
2025-02-05 14:14:16 -07:00
981e3fd779
Merge branch '6.4.x'
2025-02-05 13:59:12 -07:00
b4c7795699
Support Serialization for Authorization Components
...
Closes gh-16544
2025-02-05 13:58:32 -07:00
f7e0f7fa8a
Polish OneTimeTokenLoginConfigurer
...
Signed-off-by: DingHao <dh.hiekn@gmail.com>
2025-02-04 12:38:27 -07:00
5ff87128b1
Make Saml2AuthenticationToken Serializable
...
Issue gh-16286
2025-02-03 10:13:14 -07:00
bcc4b415b3
Make RelyingPartyRegistration Serializable
...
Closes gh-16286
2025-02-03 10:13:13 -07:00
10394c8f2a
OTT Tests use Mocks Instead of Comparing Expires
...
Previously, expires was compared to test if a custom implementations
were used. Now the tests verify this through mocks.
Closes gh-16515
2025-01-31 16:47:50 -06:00
5af4b9a2ad
Merge branch '6.4.x'
2025-01-30 18:06:01 -07:00
4b5bacf71a
Make Saml2AuthenticationToken Serializable
...
Issue gh-16286
2025-01-30 18:05:17 -07:00
e50415de85
Make RelyingPartyRegistration Serializable
...
Closes gh-16286
2025-01-30 17:45:41 -07:00
28615e7f64
Remove Stray Import
2025-01-24 11:47:40 -07:00
a841737941
Use credPropsField.getType()
...
Using the type from a field retains generics information.
Issue gh-16432
2025-01-23 20:13:11 -06:00
c7bc4c98db
Make PublicKeyCredentialRequestOptions Serializable
...
Closes gh-16432
Signed-off-by: Max Batischev <mblancer@mail.ru>
2025-01-23 20:13:10 -06:00
e1a42db845
Merge branch '6.4.x'
2025-01-23 17:03:53 -07:00
e1e5970a24
Support Serialization for LDAP Components
...
Issue gh-16276
2025-01-23 16:55:30 -07:00
36716d12ba
Serialization Support of Core Components
...
Issue gh-16276
2025-01-23 16:50:30 -07:00
d7921daa13
Support Serialization for SecurityConfig
...
Issue gh-16276
2025-01-23 16:44:53 -07:00
d043884e32
Support Serialization
...
Issue gh-16276
2025-01-23 16:44:45 -07:00
177ce59a4b
Merge branch '6.4.x'
...
Implement Serializable for WebAuthnAuthentication
Closes gh-16474
2025-01-23 14:12:30 -06:00
e557c7227b
Implement Serializable for WebAuthnAuthentication
...
Closes gh-16273
Closes gh-16285
Signed-off-by: Tran Ngoc Nhan <ngocnhan.tran1996@gmail.com>
2025-01-23 13:53:26 -06:00
f8132018d5
Merge branch '6.4.x'
...
TestOneTimeTokenGenerationSuccessHandler.lastToken to non-static variable
Closes gh-16472
2025-01-23 12:45:09 -06:00
751b5580a1
TestOneTimeTokenGenerationSuccessHandler.lastToken to non-static variable
...
Previously there were race conditions on the static member lastToken of
TestOneTimeTokenGenerationSuccessHandler. This is because the tests run in
parallel and one test may override the other tests lastToken and thus
make the assertion on it incorrect.
This commit changes lastToken to be a non-static variable to ensure that
each test has it's own lastToken for asserting the expected value.
Closes gh-16471
2025-01-23 12:43:22 -06:00
4f860a5481
Merge branch '6.4.x'
...
# Conflicts:
# config/src/main/java/org/springframework/security/config/annotation/web/configurers/oauth2/client/OAuth2LoginConfigurer.java
2025-01-22 17:30:29 -06:00
474b5e151a
Add Support GenerateOneTimeTokenRequestResolver
...
Closes gh-16291
Signed-off-by: Max Batischev <mblancer@mail.ru>
2025-01-22 17:09:55 -06:00
d97e01d1de
Merge branch '6.3.x' into 6.4.x
...
Closes gh-16466
2025-01-22 17:09:34 -06:00
211fa52649
Favor provided instances over shared objects
...
Prior to this commit, providing oauth2Login() and oauth2Client() with
clientRegistrationRepository() and authorizedClientRepository() caused
objects to be shared across both configurers.
These configurers will now prefer explicitly provided instances of
those objects when they are available.
Closes gh-16105
2025-01-22 17:07:44 -06:00
68c8a5ad99
Remove debug test
...
Issue gh-16443
2025-01-22 16:11:25 -06:00
6149489b70
Merge branch '6.4.x'
...
fix flakey test in WebAuthnWebDriverTests
Closes gh-16464
2025-01-22 14:46:05 -06:00
028c212be4
fix flakey test in WebAuthnWebDriverTests
...
Closes gh-16463
Signed-off-by: Daniel Garnier-Moiroux <git@garnier.wf>
2025-01-22 14:45:44 -06:00
4ee9358900
Add serializeAndDeserializeAreEqual
...
Checks that serialization/deserialization can be performed.
Issue gh-16443
2025-01-22 14:06:11 -06:00
e5ea75f7f4
Implement Serial
...
Signed-off-by: Tran Ngoc Nhan <ngocnhan.tran1996@gmail.com>
2025-01-21 18:14:52 -06:00
a2abe3c33e
Add HttpMessageConverter WebAuthnDsl Support
...
Issue gh-16397
2025-01-17 21:07:46 -06:00
4314e68329
Add WebAuthenticationDsl.creationOptionsRepository
...
Issue gh-16396
2025-01-17 20:51:43 -06:00
bea232237f
Fix whitespace
2025-01-17 20:51:43 -06:00
f4491f388e
Set PublicKeyCredentialCreationOptionsRepository by DSL or Bean
...
Closes gh-16369
Signed-off-by: DingHao <dh.hiekn@gmail.com>
2025-01-17 18:57:08 -06:00
5462b4c358
webauthnWhenConfiguredMessageConverter uses mock
...
Issue gh-16397
2025-01-17 18:29:23 -06:00
0d4f786484
Fix WebAuthnConfigurer Javadoc
...
Issue gh-16397
2025-01-17 18:29:23 -06:00
8181cec06c
Set HttpMessageConverter by DSL
...
Closes gh-16369
Signed-off-by: DingHao <dh.hiekn@gmail.com>
2025-01-17 18:29:23 -06:00
c2a5709e0f
Merge branch '6.4.x'
2025-01-17 16:09:01 -07:00
bbe4f87641
Mark Serialization Support for Events
...
Issue gh-16276
2025-01-17 16:08:31 -07:00
17fb4d1c0d
Fixed typo in WebAuthnDsl
...
Signed-off-by: Max Batischev <mblancer@mail.ru>
2025-01-16 14:33:57 -07:00
443af32314
Move Servlet Mocks to Web
...
Issue gh-13551
2025-01-15 17:32:58 -07:00
8827b2e564
Polish Using Request ServletContext
...
Issue gh-14418
2025-01-15 17:27:08 -07:00
75a35793dc
Polish requestMatchers Logic
...
Issue gh-13551
2025-01-15 17:27:00 -07:00
6019803064
Merge branch '6.4.x'
2025-01-14 18:38:14 -07:00
244fd2eb51
Support Serialization in Exceptions
...
Issue gh-16276
2025-01-14 18:37:53 -07:00
8035815e56
Merge branch '6.4.x'
2025-01-14 16:29:06 -07:00
feea103050
Formatting
...
Issue gh-16276
2025-01-14 16:28:53 -07:00
28644aa966
Merge branch '6.4.x'
2025-01-14 16:17:34 -07:00
6f379aa907
Add Serializable to Csrf Components
...
Issue gh-16276
2025-01-14 16:07:20 -07:00
7fae738a9b
Add support fullyAuthenticated to Kotlin DSL
...
Closes gh-16162
2025-01-13 17:03:14 -07:00
85b854c61c
Merge branch '6.4.x'
...
- Fix Kotlin DSL webAuthn { }
- Add Support disableDefaultRegistrationPage to WebAuthnDsl
Closes gh-16403
Closes gh-16404
2025-01-12 22:17:10 -06:00
decf4def95
Add Support disableDefaultRegistrationPage to WebAuthnDsl
...
Closes gh-16395
Signed-off-by: Max Batischev <mblancer@mail.ru>
2025-01-12 22:16:55 -06:00
882766e54f
Fix Kotlin webAuthn {}
...
Fixes the default configuration for WebAuthn Kotlin DSL
Closes gh-16338
Signed-off-by: Max Batischev <mblancer@mail.ru>
2025-01-12 22:16:55 -06:00
bf9b95a481
Add Support OAuth2AuthorizationRequestResolver As Bean
...
Closes gh-16380
Signed-off-by: Max Batischev <mblancer@mail.ru>
2025-01-10 16:25:03 -06:00
72a2831f76
CustomBeanPostProcessor -> CountHttpSecurityBeanPostProcessor
...
Issue gh-16370
Signed-off-by: Rob Winch <362503+rwinch@users.noreply.github.com>
2025-01-09 17:23:58 -06:00
c631afcf5b
Avoid unnecessary instantiation of HttpSecurity when a SecurityFilterChain bean is provided
...
Signed-off-by: DingHao <dh.hiekn@gmail.com>
2025-01-09 17:23:58 -06:00
6cfc372f70
Polish remove unused code
...
Signed-off-by: DingHao <dh.hiekn@gmail.com>
2025-01-09 14:27:22 -06:00
5937ba9a06
Polish use getBeanProvider instead of getBeanNamesForType
2025-01-07 13:20:39 -06:00
9ae432f0d2
Add Filter Chain Validation Test
...
Issue gh-15982
2024-12-19 15:04:01 -07:00
624a8fb252
Add Alerting About Deprecated Authorize Config
...
Closes gh-16213
2024-12-19 15:04:01 -07:00
e257af8854
Add Support Same Request Matchers Checking
...
Closes gh-15982
2024-12-19 15:04:01 -07:00
e9bdb5b96e
Polish SecurityFilterChain Validation
...
Issue gh-15982
2024-12-19 15:04:01 -07:00
fa58ebbc0c
Merge branch '6.4.x'
2024-12-19 08:55:44 -07:00
05076db53a
Merge branch '6.3.x' into 6.4.x
2024-12-19 08:55:35 -07:00
a9f8a23e50
Merge branch '6.2.x' into 6.3.x
2024-12-19 08:55:25 -07:00
643a3f1206
Test Setting logoutRequestRepository
...
Issue gh-16093
2024-12-19 08:55:18 -07:00
7aafe2ed5a
Set Saml2RelyingPartyInitiatedLogoutSuccessHandler#logoutRequestRepository
...
Closes gh-16093
2024-12-19 08:53:02 -07:00
1104b45832
Polish SessionLimit
...
- Move to the web.authentication.session package since it is only needed
by web.authentication.session elements and does not access any other web
element itself.
- Add Kotlin support
- Add documentation
Issue gh-16206
2024-12-18 18:32:28 -07:00
1864577e98
Address SessionLimitStrategy
...
Closes gh-16206
2024-12-18 18:32:12 -07:00
3eeb4317f6
Add setFavorRelativeUris
...
This places the new functionality behind a setting so that
we can remain passive until we can change the setting in
the next major release.
Issue gh-7273
2024-12-17 22:35:41 -07:00
7848b959da
Use relative URLs in /login redirects
...
Closes gh-7273
2024-12-17 22:35:41 -07:00
25740db819
Merge branch '6.4.x'
2024-12-17 13:10:52 -07:00
27c2a8ad11
Add Serializable Compatibility to Web Authentication Exceptions
...
Issue gh-16276
2024-12-17 13:05:23 -07:00
d233b70285
Merge branch '6.4.x'
2024-12-17 09:37:01 -07:00
841c03fe3b
Add Serializable Compatilibity to Saml 2.0 Exceptions
...
Issue gh-16276
2024-12-17 09:36:29 -07:00
b9f3a28678
Add UserDetailsService Constructor
...
Closes gh-15973
2024-12-16 17:59:16 -07:00
f45cc22e11
Allow configuring custom ServerHttpHeadersWriter for Kotlin DSL
...
Closes gh-16009
2024-12-16 17:54:04 -07:00
a5b0304596
Move AnyRequest Validation
...
This will make way for other adding other checks
Issue gh-15982
2024-12-13 18:24:57 -07:00
c1f5eb3192
Merge branch '6.4.x'
2024-12-13 18:24:39 -07:00
5ee1586a5a
Remove Unexposed Inner Classes from Serialization Test
...
The following inner classes are used only internally by a non-Serializable component
Issue gh-16276
2024-12-13 18:18:09 -07:00
9d02949fa9
Merge branch '6.4.x'
2024-12-13 16:58:17 -07:00
018e1ae1a4
Added Serialization Values
...
Issue gh-16276
2024-12-13 16:41:32 -07:00
b9911fd522
Add serialVersionUID to Authentication classes
...
Issue gh-16276
2024-12-13 16:41:32 -07:00
77f76f8465
Merge branch '6.4.x'
2024-12-13 11:53:51 -07:00
e3cd4339b2
Add Serial Version
...
Closes gh-16163
2024-12-13 11:53:15 -07:00
a6354e5137
Merge branch '6.4.x'
...
Closes gh-16283
2024-12-13 10:10:21 -06:00
fb954063bf
Fix WebAuthnWebdriverTests
...
Closes gh-16279
2024-12-13 10:08:27 -06:00
5a81a1fe66
Merge branch '6.4.x'
2024-12-12 22:21:44 -06:00
2a76a09552
Disable Flaky WebAuthnWebDriverTests
2024-12-12 22:21:36 -06:00
2fcd305509
Increment to 6.5.0-SNAPSHOT
...
Closes gh-16221
2024-12-12 21:47:11 -06:00
7592483654
Add Test to Report Missing serialVersionUID
...
Issue gh-16276
2024-12-12 18:12:11 -07:00
f7b9b7228f
Include Classes Listed in Generator Map
...
This allows testing of classes that are serializable,
but do not use Security's serialVersionUID.
Issue gh-16276
2024-12-12 18:07:53 -07:00
82cc3ad5ec
Arrange Class Generators by Module
...
Issue gh-16276
2024-12-12 18:07:52 -07:00
47b5ab400a
Add 6.4.x Serialization Files
...
Closes gh-16274
2024-12-12 18:07:52 -07:00
99cc65d74c
webauthn: add webdriver test
...
- These tests verify the full end-to-end flow, including the javascript
code bundled in the default login and logout pages. They require a full
web browser, with support for Virtual Authenticators for automated testing.
At this point in time, only Chrome supports virutal authenticators.
2024-12-11 16:53:38 -06:00
4cbaabb239
Added Testing
...
Issue gh-16177
2024-12-10 14:09:46 -07:00
aa85ebc65f
Remove Extraneous Field
...
Issue gh-15678
2024-12-09 08:00:22 -07:00
4dd00fe146
Merge branch '6.3.x'
2024-12-06 15:19:19 -07:00
dd8ee38194
Merge branch '6.2.x' into 6.3.x
...
Closes gh-16229
2024-12-06 15:18:42 -07:00
87de6cea1b
Use Reactive JSON Encoder
...
Closes gh-16177
2024-12-06 15:14:07 -07:00
3d1e4b5f18
Polish Tests
...
Confirm that responses are a valid JSON map
Issue gh-16177
2024-12-06 15:14:07 -07:00
3e20f7b5b5
Polish Error Messages
...
- aligned the grammar
- formatted using gradlew format
- updated copyright year
Issue gh-16193
2024-12-05 17:37:46 -07:00
32e1d4c990
Improve AuthorizationManager configuration error messages
...
Closes gh-16193
2024-12-05 17:37:46 -07:00
39cd8d9faf
Update copyright headers
2024-12-05 14:52:59 -07:00
96b3c77ce0
Merge branch '6.3.x'
2024-12-05 12:30:37 -07:00
ef7b11ac01
Delay initialization UserDetailsService in Global Authentication
2024-12-05 12:26:04 -07:00
5966baf9bf
Update copyright headers
2024-12-04 16:51:05 -07:00
2ed1cafed8
Restore Deprecated ObjectPostProcessor Usage
...
Closes gh-16174
2024-12-04 16:51:05 -07:00
8c0ea3e630
Add Deprecated ObjectPostProcessor constructor
...
Issue gh-16174
2024-12-04 16:51:05 -07:00
2b5a2eef82
Address Observation Bean Name Collisions
...
Closes gh-16161
2024-11-25 13:26:52 -07:00
a55021539a
Add RSocket and WebFlux Observation Tests
...
Issue gh-11989
Issue gh-11990
2024-11-25 13:26:52 -07:00
315aafd464
Merge remote-tracking branch 'origin/6.3.x'
2024-11-22 17:23:43 -07:00
e8ba039a61
Delay initialization AuthenticationProvider in Global Authentication
2024-11-22 17:22:14 -07:00
b896a74669
Resolve Observation Bean Name Collisions
...
Closes gh-16011
2024-11-20 13:28:06 -07:00
91832bfc8e
Add EnableWebSecurity + EnableWebSocketSecurity Test
...
Issue gh-16011
2024-11-20 13:28:06 -07:00
c2cfe92a02
Merge branch '6.3.x'
2024-11-18 05:16:16 -05:00
709103e38c
Merge branch '6.2.x' into 6.3.x
2024-11-18 04:45:38 -05:00
a8c4d6cead
Require Locale argument for toLower/toUpperCase usage
2024-11-18 04:22:26 -05:00
2639ac6545
webauthn: introduce WebAuthnConfigurer#disableDefaultRegistrationPage
2024-11-14 12:11:43 -06:00
de7c452e42
webauthn: use DefaultResourcesFilter#webauthn
...
- Unconditionally use the DefaultResourcesFilter, because the javascript file is required by the
DefaultWebAythnPageGeneratingFilter, which is always registered.
2024-11-14 12:11:43 -06:00
5a95952c95
Merge branch '6.3.x'
...
Closes gh-16063
2024-11-11 15:17:02 -06:00
e1ad989d38
Merge branch '6.2.x' into 6.3.x
...
Closes gh-16062
2024-11-11 14:58:39 -06:00
Rob Winch
Max Batischev
Josh Cummings
tejas-teju
plll0123
Joe Grandja
Daniel Garnier-Moiroux
DingHao
Tran Ngoc Nhan
Steve Riesenberg
Steven Williams
Claudenir Machado
Michal Okosy
Josh Cummings
Evgeniy Cheban
Dmitry Spikhalsky