3226 Commits

Author	SHA1	Message	Date
Josh Cummings	c8b843c4c5	Merge branch '6.5.x'	2025-06-05 12:36:53 -06:00
damable-nuvolex	3b12e758d3	Fix inconsistent constructor declaration ... Closes gh-16325 Signed-off-by: damable-nuvolex <damable@nuvolex.com>	2025-06-05 12:36:27 -06:00
damable-nuvolex	a0c5504eca	Fix inconsistent constructor declaration ... Closes gh-16325 Signed-off-by: damable-nuvolex <damable@nuvolex.com>	2025-06-05 12:34:35 -06:00
Josh Cummings	eaab42a73c	Polish BearerTokenAuthenticationConverter Support ... - Moved to BearerTokenAuthenticationFilter constructor to align with AuthenticationFilter - Undeprecated BearerTokenResolver to reduce number of migration scenarios - Updated to 7.0 schema - Added migration docs Issue gh-14750	2025-06-04 18:17:17 -06:00
Max Batischev	4967f3feee	Add Support BearerTokenAuthenticationConverter ... Closes gh-14750 Signed-off-by: Max Batischev <mblancer@mail.ru>	2025-06-04 18:17:17 -06:00
Josh Cummings	3f0326d3f1	Merge remote-tracking branch 'origin/6.5.x'	2025-06-04 12:49:12 -06:00
Evgeniy Cheban	33ae1711a7	Set Precedence Order for Spring MVC TargetVisitor ... Closes gh-17185 Signed-off-by: Evgeniy Cheban <mister.cheban@gmail.com>	2025-06-04 12:47:36 -06:00
Josh Cummings	195f933438	Allow Default Ordering for TargetVisitor ... In tests, we want to both test that functionality works and also demonstrate common or expected usage, where possible. It is likely incorrect to use @Order(0) for a target visitor as this states that it should take precedence over all Spring Security visitors defined at a lower precedence. Also, it appears this may have been added this way because of a mock visitor that appears to be unused by any tests. Further, when an application has multiple visitors, they should use the TargetVisitor.of method to publish one bean with the order determined by the order of the method parameters instead of having two separate beans. This commit removes the @Order(0) annotation and also the mock visitor, deferring to the natural ordering afforded by the framework. Issue gh-15994	2025-06-02 13:41:21 -06:00
Evgeniy Cheban	fd4f06a66e	Support Spring Data container types for AuthorizeReturnObject ... Closes gh-15994 Signed-off-by: Evgeniy Cheban <mister.cheban@gmail.com>	2025-05-29 17:05:27 -06:00
Josh Cummings	6d3b54df21	Change Type Validation Default ... NimbusJwtDecoder and NimbusReactiveJwtDecoder now use Spring Security's JwtTypeValidator by default instead of Nimbus's type validator. Closes gh-17181	2025-05-28 16:11:13 -06:00
Yanming Zhou	42790403da	Use SpringReactiveOpaqueTokenIntrospector ... Now that NimbusReactiveOpaqueTokenIntrospector is deprecated, this commit changes the Spring Security default to now use SpringReactiveOpaqueTokenIntrospector. Issue gh-15988 Signed-off-by: Yanming Zhou <zhouyanming@gmail.com>	2025-05-27 14:25:31 -06:00
Josh Cummings	596449d882	Polish ... Issue gh-14149	2025-05-27 11:44:33 -06:00
Felix Hagemans	1a4de49977	Create CsrfCustomizer for SPA configuration ... Closes gh-14149 Signed-off-by: Felix Hagemans <felixhagemans@gmail.com>	2025-05-27 11:44:33 -06:00
Josh Cummings	52394c1f07	Propagate Any AccessDeniedException ... Any time a response handler throws an exception, we want to propagate an underlying AccessDeniedException if their is one. Issue gh-16058	2025-05-23 15:18:01 -06:00
Evgeniy Cheban	fae61b9426	Propagate AccessDeniedException for Authorized Objects Returned from a Controller ... Closes gh-16058 Signed-off-by: Evgeniy Cheban <mister.cheban@gmail.com>	2025-05-23 15:18:01 -06:00
dae won	8612e952fe	Make AuthorizationProxyFactory#proxy Generic ... Closes gh-16706 Signed-off-by: dae won <eodnjs01477@gmail.com>	2025-05-23 14:48:11 -06:00
Max Batischev	f4b8e2421a	Add Support Credentialless COEP Header ... Closes gh-16991 Signed-off-by: Max Batischev <mblancer@mail.ru>	2025-05-23 14:45:59 -06:00
Josh Cummings	97923ebfaf	Merge branch '6.5.x'	2025-05-21 16:47:45 -06:00
Josh Cummings	4bf03bde5b	Merge branch '6.4.x' into 6.5.x	2025-05-21 16:47:25 -06:00
Josh Cummings	3186e8df84	Merge remote-tracking branch 'origin/6.3.x' into 6.4.x	2025-05-21 16:46:54 -06:00
Andrey Litvitski	4048b2bd7d	Use `HttpStatus` in BackChannel Logout Filters ... Closes gh-17125 Signed-off-by: Andrey Litvitski <andrey1010102008@gmail.com>	2025-05-21 16:45:46 -06:00
Tran Ngoc Nhan	a511171309	Add test and update javadoc for CommonOAuth2Provider ... Signed-off-by: Tran Ngoc Nhan <ngocnhan.tran1996@gmail.com>	2025-05-13 12:45:38 -06:00
Joe Grandja	44303d2c80	Polish gh-17080	2025-05-13 14:36:44 -04:00
Joe Grandja	a265ac6ae7	Polish gh-17080	2025-05-13 14:35:23 -04:00
Joe Grandja	ba7be9c8b9	Merge branch '6.5.x'	2025-05-09 16:14:34 -04:00
Joe Grandja	e3c39f02bc	Add documentation for DPoP support ... Closes gh-17072	2025-05-09 16:02:14 -04:00
Rob Winch	693a5beb24	Format CommonOAuth2Provider	2025-05-07 14:55:04 -05:00
kiruthiga1793	23e7c9eeaa	Add Twitter/X to CommonOAuth2Provider ... Signed-off-by: kiruthiga1793 <pkiruthiga93@gmail.com>	2025-05-07 11:24:29 -05:00
Rob Winch	506a801f29	Merge branch '6.5.x' ... - WebAuthnConfigurer Code Cleanup Closes gh-17063	2025-05-06 15:22:36 -05:00
Max Batischev	66e614cb0b	WebAuthnConfigurer Code Cleanup ... Signed-off-by: Max Batischev <mblancer@mail.ru>	2025-05-06 15:20:08 -05:00
Max Batischev	421fcaee12	Add Assertions To WebAuthnConfigurer ... Signed-off-by: Max Batischev <mblancer@mail.ru>	2025-05-06 15:20:08 -05:00
Rob Winch	b453840c0a	HttpHeaders no longer a MultiValueMap ... Closes gh-17060	2025-05-06 13:27:13 -05:00
Rob Winch	3976e7d456	BodyInserters.fromObject -> fromProducer ... Closes gh-17055	2025-05-06 13:26:16 -05:00
Rob Winch	b467c47ed5	ClientRequest.method->create ... ClientRequest.method was deprecated in favor of the create method Closes gh-17054	2025-05-06 13:26:15 -05:00
Rob Winch	11105a5c51	UriComponentsBuilder.fromHttpUrl->fromUriString ... The fromHttpUrl method is deprecated and replaced with fromUriString Closes gh-	2025-05-06 13:26:15 -05:00
Rob Winch	38a9aa1da9	Remove Deprecated PathMatchConfigurer usage ... Closes gh-17052	2025-05-06 13:26:15 -05:00
Rob Winch	222faae1cb	Add junit-jupiter-engine ... This fixes some of the compatability problems that can happen with newer versions of junit	2025-05-06 13:26:15 -05:00
Rob Winch	5abbcecccc	Update to 7.0.0-SNAPSHOT ... Signed-off-by: Rob Winch <362503+rwinch@users.noreply.github.com>	2025-05-06 13:26:14 -05:00
Josh Cummings	1a9f62dce4	Merge branch '6.4.x'	2025-05-05 16:00:59 -06:00
Josh Cummings	0220e471bb	Move Serialization Samples ... To make SpringSecurityCoreVersionSerializableTests more manageable, this commit moves the sample class constructions to a separate file. In this way, the tests file only changes when serialization tests are added. When classes are introduced, they can be added to SerializationSamples, separating the two concerns	2025-05-05 15:51:10 -06:00
Josh Cummings	12a18c3792	Polish Serialization Tests ... If Instancio fails to instatiate the class sample, it will now also delete the serialized sample file. Otherwise, it will leave a zero-byte file on the filesystem, confusing future test runs	2025-05-05 15:39:33 -06:00
Josh Cummings	d04f7071c2	Add Missing Serialization Samples ... Closes gh-17038	2025-05-05 15:34:24 -06:00
Josh Cummings	8726e547d5	Add Serialization Samples for 6.5 ... Issue gh-16221	2025-05-05 15:31:51 -06:00
Josh Cummings	2949b5d5a4	Regenerate Incorrect Serialization Files ... Given that these classes each have a consistent serialization UID across minor versions, but that the 6.5.x serialized version is using a different UID, these serialized files were likely generated in error. As such, this commit replaces the serialized files with correct ones. Issue gh-16432	2025-05-05 15:30:15 -06:00
Josh Cummings	34a9f57aa6	Merge branch '6.4.x'	2025-05-05 15:29:44 -06:00
Josh Cummings	c3c2bcd6b7	Ignore Serialization in Test Components ... Since we don't need to ensure the serializability of test components across versions, we can ignore missing version UIDs when those test components aren't about testing Java serialization. Issue gh-17038	2025-05-05 15:09:50 -06:00
Josh Cummings	39fdceab59	Add Missing Serializable Samples ... Issue gh-17038	2025-05-05 15:09:50 -06:00
Josh Cummings	65d53beff8	Polish Serialization Tests ... - Error when public, non-ignored, serializable file is missing a sample - Provide mechanism for creating an InstancioApi from scratch Issue gh-17038	2025-05-05 15:09:49 -06:00
Josh Cummings	34afa64c0c	Add Current-Version Deserialization Test ... We should test that serialized files from the current minor version can be deserialized. This ensures that serializations remain deserializable in patch releases. Issue gh-3737	2025-05-05 15:09:43 -06:00
Josh Cummings	f44ab7afdf	Update Deprecated Security Usage	2025-04-23 14:16:29 -06:00
Max Batischev	4a12382d2b	Remove unused classes ... Remove DeferringObservationAuthorizationManager.java and DeferringObservationReactiveAuthorizationManager.java Signed-off-by: Max Batischev <mblancer@mail.ru>	2025-04-23 14:09:05 -06:00
Josh Cummings	a683a3a730	Favor PathPatternMessageMatcher when activated ... Issue gh-16500	2025-04-23 12:11:10 -06:00
Josh Cummings	0ab01eac14	Update Deprecated Security Usage	2025-04-23 12:11:08 -06:00
Josh Cummings	834370d8eb	Update Deprecated Spring Web Usage	2025-04-23 11:29:19 -06:00
Josh Cummings	2ad859a63c	Add Missing Deprecation Markers	2025-04-23 11:29:18 -06:00
Josh Cummings	3f7f3dabe7	Correct JavaDoc Class Reference	2025-04-23 11:29:18 -06:00
Josh Cummings	f86c4ad383	Polish Native Support ... - Remove unneeded deprecateion marker - Add missing reflected class Issue gh-16536	2025-04-14 14:08:57 -06:00
Josh Cummings	178ca73673	Fix Type Check ... Issue gh-16536	2025-04-14 13:42:44 -06:00
Josh Cummings	ae82be70c3	Add Needed Runtime Hints ... Issue gh-16536	2025-04-14 11:06:18 -06:00
Josh Cummings	0e70482725	Fix Formatting	2025-04-10 15:55:00 -06:00
Josh Cummings	09ba5397fb	Add Support for Authorizing Spring MVC Return Types ... Closes gh-16059	2025-04-10 15:48:10 -06:00
Josh Cummings	6438603cb6	Pick Up TargetVisitor Beans ... Closes gh-16923	2025-04-10 15:48:09 -06:00
Josh Cummings	5841e35cae	Invert AuthorizeReturnObjectMethodInterceptor Dependency ... Closes gh-16922	2025-04-10 15:48:09 -06:00
Daeho Kwon	9908d96644	DeferredCsrfToken Implements Supplier ... Closes gh-16870 Signed-off-by: Daeho Kwon <trewq231@naver.com>	2025-04-09 14:24:11 -06:00
Josh Cummings	f93a7a2f85	Deprecate HandlerMappingIntrospectorRequestTransformer ... Closes gh-16536	2025-04-07 13:56:18 -06:00
Steve Riesenberg	03e090c2d7	Merge branch '6.4.x' ... Closes gh-16902	2025-04-07 10:57:12 -05:00
Steve Riesenberg	db34de59bc	Merge branch '6.3.x' into 6.4.x ... Closes gh-16901	2025-04-07 10:55:51 -05:00
Steve Riesenberg	3c0fef59b5	Polish gh-16039 ... Closes gh-16038	2025-04-07 10:54:09 -05:00
Jonah Klöckner	da94fbe431	Evaluate URI query parameter only if enabled ... Issue gh-16038	2025-04-07 10:54:07 -05:00
Joe Grandja	9c073dbcde	Add AuthenticationEntryPoint for DPoP ... Issue gh-16574 Closes gh-16900	2025-04-07 09:38:51 -04:00
chu3la	8cbe02e3aa	Update WebAuthn Test Objects Class Names ... Closes gh-16604 Signed-off-by: chu3la <elmansouri.houssam@gmail.com>	2025-04-03 16:33:34 -06:00
Josh Cummings	4cdc6dab21	Fix Formatting ... Issue gh-16604	2025-04-03 12:55:51 -06:00
Vasanth	04d7130975	Update WebAuthn Test Objects Class Names ... Renamed the WebAuthn test object class names Closes gh-16604 Signed-off-by: Vasanth <76898064+vasanth-79@users.noreply.github.com>	2025-04-03 12:55:50 -06:00
Josh Cummings	2885b0f75f	Add valueOf ... This commit adds a static factory for returning a constant ClientAuthenticationMethod or creating a new one when there is no match. Issue gh-16825	2025-04-02 11:16:30 -06:00
Steve Riesenberg	7a937ca369	Merge branch '6.4.x' ... Closes gh-16845	2025-03-28 16:34:35 -05:00
Steve Riesenberg	26c63aeb01	Merge branch '6.3.x' into 6.4.x ... Closes gh-16844	2025-03-28 16:34:01 -05:00
Steve Riesenberg	b7df86197c	Apply request-handler-ref to CsrfAuthenticationStrategy ... Closes gh-16801	2025-03-28 16:25:52 -05:00
Steve Riesenberg	c84c438075	Apply request-handler-ref to CsrfAuthenticationStrategy ... Closes gh-16801	2025-03-28 16:08:36 -05:00
Josh Cummings	40b84d3e44	Merge branch '6.4.x'	2025-03-27 16:34:39 -06:00
Josh Cummings	6c5b6d1c51	Merge branch '6.3.x' into 6.4.x ... Closes gh-16837	2025-03-27 16:32:12 -06:00
Josh Cummings	15b9a50060	Add Test ... Issue gh-16819	2025-03-27 16:18:00 -06:00
Josh Cummings	37b8d019fa	Polish RequestMatcher Migration Path for OAuth 2.0 Login DSL ... Issue gh-16573	2025-03-26 16:38:39 -06:00
Steve Riesenberg	860f130bc4	Add additional validation when refreshing ID tokens ... Issue gh-16589	2025-03-26 15:34:17 -05:00
Steve Riesenberg	5f98ce5ecc	Polish gh-16589	2025-03-26 15:34:17 -05:00
Josh Cummings	d2d9da0a39	Favor PathPatternRequestMatcher ... Issue gh-16828	2025-03-26 14:33:46 -06:00
Josh Cummings	e65e32bb42	Polish CorsConfigurationSource Selection Logic ... Issue gh-16501	2025-03-26 13:44:47 -06:00
Josh Cummings	59f08e861e	Use PathPatternRequestMatcher in Docs ... Update documenation references from PathPatternRequestMatcher to AntPathRequestMatcher Issue gh-16632	2025-03-26 13:40:04 -06:00
Josh Cummings	ff52e05b24	Favor PathPatternRequestMatcher in XML Configuration ... Update BeanDefinitionParsers to use PathPatternRequestMatcher conditionally on the presence of a PathPatternRequestMatcher.Builder bean Closes gh-16828	2025-03-26 13:40:04 -06:00
Josh Cummings	de07b1108f	Use PathPatternRequestMatcher in Web Components ... This commit changes filters and resolvers that were using AntPathRequestMatcher as their default to using PathPatternRequestMatcher. Issue gh-16632	2025-03-26 13:28:58 -06:00
Evgeniy Cheban	ad1ee28f01	Update HandlerMappingIntrospector Usage in CORS support ... Closes gh-16501 Signed-off-by: Evgeniy Cheban <mister.cheban@gmail.com>	2025-03-26 13:11:05 -06:00
Josh Cummings	86599afd43	Rename servletPath to basePath ... Closes gh-16765	2025-03-21 12:04:46 -06:00
Josh Cummings	c91656c27a	Add Authorization Event Tests ... - These ensure that the parameterized version of authorization events can be listened to Issue gh-16700	2025-03-20 13:12:36 -06:00
Josh Cummings	1120733e27	Update Copyright	2025-03-19 17:43:01 -06:00
Josh Cummings	116ef5fd54	Add HttpsRedirectFilter ... - Added missing JavaDoc Issue gh-16678	2025-03-19 17:41:20 -06:00
Josh Cummings	8e9634d25c	Deprecate ConfigAttribute ... Closes gh-16774	2025-03-19 17:39:38 -06:00
Josh Cummings	89bd670fb1	Deprecate SecurityConfig ... Closes gh-16773	2025-03-19 17:39:26 -06:00
Josh Cummings	a884c3c906	Address XsdDocumentedTests Errors ... Issue gh-16775	2025-03-19 16:39:27 -06:00
Josh Cummings	e6008b6067	Add RedirectToHttps to XML ... Closes gh-16775	2025-03-19 15:26:05 -06:00
Josh Cummings	44d553946e	PathPatternMessageMatcher Polish ... Issue gh-16500 Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>	2025-03-19 08:48:54 -06:00
Pat McCusker	33272ef0f4	Add PathPatternMessageMatcher ... Closes gh-16500 Signed-off-by: Pat McCusker <patmccusker14@gmail.com>	2025-03-19 08:48:54 -06:00
Steve Riesenberg	5bb5d0f6be	Polish gh-16589	2025-03-18 18:07:56 -05:00
Hao	fc1469ad5e	Ensure ID Token is updated after refresh token ... Signed-off-by: Hao <kyrieeeee2@gmail.com>	2025-03-18 18:07:56 -05:00
Rob Winch	e6223dede3	Merge branch '6.4.x' ... - adb303e Add testRuntimeOnly junit-platform-launcher Closes gh-16757	2025-03-17 14:34:18 -05:00
Rob Winch	05116eabbd	Merge branch '6.3.x' into 6.4.x ... - adb303e Add testRuntimeOnly junit-platform-launcher Closes gh-16756	2025-03-17 14:18:49 -05:00
Rob Winch	adb303e152	Add testRuntimeOnly junit-platform-launcher ... Closes gh-16755	2025-03-17 14:16:44 -05:00
Rob Winch	3a11d1529d	Merge branch '6.4.x' ... - Disable Flaky WebAuthnWebDriverTests Closes gh-16754	2025-03-17 13:57:37 -05:00
Rob Winch	f2f9d8282a	Disable Flaky WebAuthnWebDriverTests ... Closes gh-16753	2025-03-17 13:54:17 -05:00
Max Batischev	58a665e5aa	Add Support SingleResultAuthorizationManager ... Closes gh-16590 Signed-off-by: Max Batischev <mblancer@mail.ru>	2025-03-07 13:46:23 -07:00
Josh Cummings	72070cd191	Deprecate ChannelSecurityConfigurer ... Closes gh-16680	2025-02-28 09:38:45 -07:00
Josh Cummings	be23268c37	Add redirectToHttps DSL Configurer ... Closes gh-16679	2025-02-28 09:38:07 -07:00
Max Batischev	fa35c5b4d8	Make DefaultOneTimeToken Serializable ... Closes gh-16617 Signed-off-by: Max Batischev <mblancer@mail.ru>	2025-02-27 12:49:48 -07:00
Rob Winch	76a566265c	Use PortResolver Beans by Default ... Closes gh-16664	2025-02-26 16:13:10 -06:00
Josh Cummings	7d301f87d6	Add Opt-in PathPattern Strategy ... Closes gh-16573	2025-02-21 13:40:24 -07:00
Josh Cummings	588220a020	Add PathPatterRequestMatcher ... Closes gh-16429 Clsoes gh-16430	2025-02-21 13:40:23 -07:00
Josh Cummings	51ce91f07b	Merge branch '6.4.x'	2025-02-18 15:11:08 -07:00
Josh Cummings	cc2cfc62b0	Add Test Requiring serialVersionUID ... Issue gh-16276	2025-02-18 15:06:50 -07:00
tejas-teju	c4b223266c	Return Invalid Credentials message on login error ... Closes gh-16484 Signed-off-by: tejas-teju <tejas8196@gmail.com>	2025-02-14 16:01:22 -07:00
Josh Cummings	e42865b926	Merge branch '6.4.x'	2025-02-14 13:08:17 -07:00
Josh Cummings	946812691e	Make AuthenticatorAttestation Serializable ... Issue gh-16481	2025-02-14 13:07:56 -07:00
Max Batischev	b5a4218a0b	Make WebAuthnAuthenticationRequestToken Serializable ... Closes gh-16481 Signed-off-by: Max Batischev <mblancer@mail.ru>	2025-02-14 11:51:46 -07:00
plll0123	f9e04594a7	Refactor authorization manager variable naming ... - Renamed PERMIT_ALL_AUTHORIZATION_MANAGER to snake_case style - Introduced AUTHORIZATION_DECISION for reuse Signed-off-by: plll0123 <jsh951227@gmail.com>	2025-02-14 10:02:55 -07:00
Josh Cummings	666d3a4af6	Merge branch '6.4.x'	2025-02-13 17:25:39 -07:00
Max Batischev	879b44f9a1	Make PublicKeyCredentialRequestOptions Serializable ... Closes gh-16432 Signed-off-by: Max Batischev <mblancer@mail.ru>	2025-02-13 17:17:16 -07:00
Joe Grandja	2480d41981	Add support for OAuth 2.0 Demonstrating Proof of Possession (DPoP) ... Signed-off-by: Joe Grandja <10884212+jgrandja@users.noreply.github.com>	2025-02-11 14:10:23 -05:00
Daniel Garnier-Moiroux	238f47ce5e	One Time Token login registers the default login page ... closes gh-16414 Signed-off-by: Daniel Garnier-Moiroux <git@garnier.wf>	2025-02-10 09:55:51 -06:00
Daniel Garnier-Moiroux	5ee6b83953	Introduce OneTimeTokenAuthenticationFilter ... closes gh-16539 Signed-off-by: Daniel Garnier-Moiroux <git@garnier.wf>	2025-02-10 09:55:51 -06:00
Josh Cummings	8e19b8039c	Merge branch '6.4.x'	2025-02-05 15:49:20 -07:00
Josh Cummings	4776446b14	Add Missing Serialzed AuthorizationDeniedException ... Issue gh-16544	2025-02-05 15:48:55 -07:00
Max Batischev	9676739c88	TestServerOneTimeTokenGenerationSuccessHandler.lastToken to non-static variable ... Signed-off-by: Max Batischev <mblancer@mail.ru>	2025-02-05 14:14:16 -07:00
Max Batischev	be81377235	Add Support ServerGenerateOneTimeTokenRequestResolver ... Closes gh-16488 Signed-off-by: Max Batischev <mblancer@mail.ru>	2025-02-05 14:14:16 -07:00
Josh Cummings	981e3fd779	Merge branch '6.4.x'	2025-02-05 13:59:12 -07:00
Josh Cummings	b4c7795699	Support Serialization for Authorization Components ... Closes gh-16544	2025-02-05 13:58:32 -07:00
DingHao	f7e0f7fa8a	Polish OneTimeTokenLoginConfigurer ... Signed-off-by: DingHao <dh.hiekn@gmail.com>	2025-02-04 12:38:27 -07:00
Josh Cummings	5ff87128b1	Make Saml2AuthenticationToken Serializable ... Issue gh-16286	2025-02-03 10:13:14 -07:00
Tran Ngoc Nhan	bcc4b415b3	Make RelyingPartyRegistration Serializable ... Closes gh-16286	2025-02-03 10:13:13 -07:00
Rob Winch	10394c8f2a	OTT Tests use Mocks Instead of Comparing Expires ... Previously, expires was compared to test if a custom implementations were used. Now the tests verify this through mocks. Closes gh-16515	2025-01-31 16:47:50 -06:00
Josh Cummings	5af4b9a2ad	Merge branch '6.4.x'	2025-01-30 18:06:01 -07:00
Josh Cummings	4b5bacf71a	Make Saml2AuthenticationToken Serializable ... Issue gh-16286	2025-01-30 18:05:17 -07:00
Tran Ngoc Nhan	e50415de85	Make RelyingPartyRegistration Serializable ... Closes gh-16286	2025-01-30 17:45:41 -07:00
Josh Cummings	28615e7f64	Remove Stray Import	2025-01-24 11:47:40 -07:00
Rob Winch	a841737941	Use credPropsField.getType() ... Using the type from a field retains generics information. Issue gh-16432	2025-01-23 20:13:11 -06:00
Max Batischev	c7bc4c98db	Make PublicKeyCredentialRequestOptions Serializable ... Closes gh-16432 Signed-off-by: Max Batischev <mblancer@mail.ru>	2025-01-23 20:13:10 -06:00
Josh Cummings	e1a42db845	Merge branch '6.4.x'	2025-01-23 17:03:53 -07:00
Josh Cummings	e1e5970a24	Support Serialization for LDAP Components ... Issue gh-16276	2025-01-23 16:55:30 -07:00
Josh Cummings	36716d12ba	Serialization Support of Core Components ... Issue gh-16276	2025-01-23 16:50:30 -07:00
Josh Cummings	d7921daa13	Support Serialization for SecurityConfig ... Issue gh-16276	2025-01-23 16:44:53 -07:00
Josh Cummings	d043884e32	Support Serialization ... Issue gh-16276	2025-01-23 16:44:45 -07:00
Rob Winch	177ce59a4b	Merge branch '6.4.x' ... Implement Serializable for WebAuthnAuthentication Closes gh-16474	2025-01-23 14:12:30 -06:00
Tran Ngoc Nhan	e557c7227b	Implement Serializable for WebAuthnAuthentication ... Closes gh-16273 Closes gh-16285 Signed-off-by: Tran Ngoc Nhan <ngocnhan.tran1996@gmail.com>	2025-01-23 13:53:26 -06:00
Rob Winch	f8132018d5	Merge branch '6.4.x' ... TestOneTimeTokenGenerationSuccessHandler.lastToken to non-static variable Closes gh-16472	2025-01-23 12:45:09 -06:00
Rob Winch	751b5580a1	TestOneTimeTokenGenerationSuccessHandler.lastToken to non-static variable ... Previously there were race conditions on the static member lastToken of TestOneTimeTokenGenerationSuccessHandler. This is because the tests run in parallel and one test may override the other tests lastToken and thus make the assertion on it incorrect. This commit changes lastToken to be a non-static variable to ensure that each test has it's own lastToken for asserting the expected value. Closes gh-16471	2025-01-23 12:43:22 -06:00
Steve Riesenberg	4f860a5481	Merge branch '6.4.x' ... # Conflicts: # config/src/main/java/org/springframework/security/config/annotation/web/configurers/oauth2/client/OAuth2LoginConfigurer.java	2025-01-22 17:30:29 -06:00
Max Batischev	474b5e151a	Add Support GenerateOneTimeTokenRequestResolver ... Closes gh-16291 Signed-off-by: Max Batischev <mblancer@mail.ru>	2025-01-22 17:09:55 -06:00
Steve Riesenberg	d97e01d1de	Merge branch '6.3.x' into 6.4.x ... Closes gh-16466	2025-01-22 17:09:34 -06:00
Steve Riesenberg	211fa52649	Favor provided instances over shared objects ... Prior to this commit, providing oauth2Login() and oauth2Client() with clientRegistrationRepository() and authorizedClientRepository() caused objects to be shared across both configurers. These configurers will now prefer explicitly provided instances of those objects when they are available. Closes gh-16105	2025-01-22 17:07:44 -06:00
Rob Winch	68c8a5ad99	Remove debug test ... Issue gh-16443	2025-01-22 16:11:25 -06:00
Rob Winch	6149489b70	Merge branch '6.4.x' ... fix flakey test in WebAuthnWebDriverTests Closes gh-16464	2025-01-22 14:46:05 -06:00
Daniel Garnier-Moiroux	028c212be4	fix flakey test in WebAuthnWebDriverTests ... Closes gh-16463 Signed-off-by: Daniel Garnier-Moiroux <git@garnier.wf>	2025-01-22 14:45:44 -06:00
Rob Winch	4ee9358900	Add serializeAndDeserializeAreEqual ... Checks that serialization/deserialization can be performed. Issue gh-16443	2025-01-22 14:06:11 -06:00
Tran Ngoc Nhan	e5ea75f7f4	Implement Serial ... Signed-off-by: Tran Ngoc Nhan <ngocnhan.tran1996@gmail.com>	2025-01-21 18:14:52 -06:00
Rob Winch	a2abe3c33e	Add HttpMessageConverter WebAuthnDsl Support ... Issue gh-16397	2025-01-17 21:07:46 -06:00
Rob Winch	4314e68329	Add WebAuthenticationDsl.creationOptionsRepository ... Issue gh-16396	2025-01-17 20:51:43 -06:00
Rob Winch	bea232237f	Fix whitespace	2025-01-17 20:51:43 -06:00
DingHao	f4491f388e	Set PublicKeyCredentialCreationOptionsRepository by DSL or Bean ... Closes gh-16369 Signed-off-by: DingHao <dh.hiekn@gmail.com>	2025-01-17 18:57:08 -06:00
Rob Winch	5462b4c358	webauthnWhenConfiguredMessageConverter uses mock ... Issue gh-16397	2025-01-17 18:29:23 -06:00
Rob Winch	0d4f786484	Fix WebAuthnConfigurer Javadoc ... Issue gh-16397	2025-01-17 18:29:23 -06:00
DingHao	8181cec06c	Set HttpMessageConverter by DSL ... Closes gh-16369 Signed-off-by: DingHao <dh.hiekn@gmail.com>	2025-01-17 18:29:23 -06:00
Josh Cummings	c2a5709e0f	Merge branch '6.4.x'	2025-01-17 16:09:01 -07:00
Josh Cummings	bbe4f87641	Mark Serialization Support for Events ... Issue gh-16276	2025-01-17 16:08:31 -07:00
Max Batischev	17fb4d1c0d	Fixed typo in WebAuthnDsl ... Signed-off-by: Max Batischev <mblancer@mail.ru>	2025-01-16 14:33:57 -07:00
Josh Cummings	443af32314	Move Servlet Mocks to Web ... Issue gh-13551	2025-01-15 17:32:58 -07:00
Josh Cummings	8827b2e564	Polish Using Request ServletContext ... Issue gh-14418	2025-01-15 17:27:08 -07:00
Josh Cummings	75a35793dc	Polish requestMatchers Logic ... Issue gh-13551	2025-01-15 17:27:00 -07:00
Josh Cummings	6019803064	Merge branch '6.4.x'	2025-01-14 18:38:14 -07:00
Josh Cummings	244fd2eb51	Support Serialization in Exceptions ... Issue gh-16276	2025-01-14 18:37:53 -07:00
Josh Cummings	8035815e56	Merge branch '6.4.x'	2025-01-14 16:29:06 -07:00
Josh Cummings	feea103050	Formatting ... Issue gh-16276	2025-01-14 16:28:53 -07:00
Josh Cummings	28644aa966	Merge branch '6.4.x'	2025-01-14 16:17:34 -07:00
Josh Cummings	6f379aa907	Add Serializable to Csrf Components ... Issue gh-16276	2025-01-14 16:07:20 -07:00
Max Batischev	7fae738a9b	Add support fullyAuthenticated to Kotlin DSL ... Closes gh-16162	2025-01-13 17:03:14 -07:00
Rob Winch	85b854c61c	Merge branch '6.4.x' ... - Fix Kotlin DSL webAuthn { } - Add Support disableDefaultRegistrationPage to WebAuthnDsl Closes gh-16403 Closes gh-16404	2025-01-12 22:17:10 -06:00
Max Batischev	decf4def95	Add Support disableDefaultRegistrationPage to WebAuthnDsl ... Closes gh-16395 Signed-off-by: Max Batischev <mblancer@mail.ru>	2025-01-12 22:16:55 -06:00
Max Batischev	882766e54f	Fix Kotlin webAuthn {} ... Fixes the default configuration for WebAuthn Kotlin DSL Closes gh-16338 Signed-off-by: Max Batischev <mblancer@mail.ru>	2025-01-12 22:16:55 -06:00
Max Batischev	bf9b95a481	Add Support OAuth2AuthorizationRequestResolver As Bean ... Closes gh-16380 Signed-off-by: Max Batischev <mblancer@mail.ru>	2025-01-10 16:25:03 -06:00
Rob Winch	72a2831f76	CustomBeanPostProcessor -> CountHttpSecurityBeanPostProcessor ... Issue gh-16370 Signed-off-by: Rob Winch <362503+rwinch@users.noreply.github.com>	2025-01-09 17:23:58 -06:00
DingHao	c631afcf5b	Avoid unnecessary instantiation of HttpSecurity when a SecurityFilterChain bean is provided ... Signed-off-by: DingHao <dh.hiekn@gmail.com>	2025-01-09 17:23:58 -06:00
DingHao	6cfc372f70	Polish remove unused code ... Signed-off-by: DingHao <dh.hiekn@gmail.com>	2025-01-09 14:27:22 -06:00
DingHao	5937ba9a06	Polish use getBeanProvider instead of getBeanNamesForType	2025-01-07 13:20:39 -06:00
Josh Cummings	9ae432f0d2	Add Filter Chain Validation Test ... Issue gh-15982	2024-12-19 15:04:01 -07:00
Max Batischev	624a8fb252	Add Alerting About Deprecated Authorize Config ... Closes gh-16213	2024-12-19 15:04:01 -07:00
Max Batischev	e257af8854	Add Support Same Request Matchers Checking ... Closes gh-15982	2024-12-19 15:04:01 -07:00
Max Batischev	e9bdb5b96e	Polish SecurityFilterChain Validation ... Issue gh-15982	2024-12-19 15:04:01 -07:00
Josh Cummings	fa58ebbc0c	Merge branch '6.4.x'	2024-12-19 08:55:44 -07:00
Josh Cummings	05076db53a	Merge branch '6.3.x' into 6.4.x	2024-12-19 08:55:35 -07:00
Josh Cummings	a9f8a23e50	Merge branch '6.2.x' into 6.3.x	2024-12-19 08:55:25 -07:00
Josh Cummings	643a3f1206	Test Setting logoutRequestRepository ... Issue gh-16093	2024-12-19 08:55:18 -07:00
Steven Williams	7aafe2ed5a	Set Saml2RelyingPartyInitiatedLogoutSuccessHandler#logoutRequestRepository ... Closes gh-16093	2024-12-19 08:53:02 -07:00
Josh Cummings	1104b45832	Polish SessionLimit ... - Move to the web.authentication.session package since it is only needed by web.authentication.session elements and does not access any other web element itself. - Add Kotlin support - Add documentation Issue gh-16206	2024-12-18 18:32:28 -07:00
Claudenir Machado	1864577e98	Address SessionLimitStrategy ... Closes gh-16206	2024-12-18 18:32:12 -07:00
Josh Cummings	3eeb4317f6	Add setFavorRelativeUris ... This places the new functionality behind a setting so that we can remain passive until we can change the setting in the next major release. Issue gh-7273	2024-12-17 22:35:41 -07:00
Michal Okosy	7848b959da	Use relative URLs in /login redirects ... Closes gh-7273	2024-12-17 22:35:41 -07:00
Josh Cummings	25740db819	Merge branch '6.4.x'	2024-12-17 13:10:52 -07:00
Josh Cummings	27c2a8ad11	Add Serializable Compatibility to Web Authentication Exceptions ... Issue gh-16276	2024-12-17 13:05:23 -07:00
Josh Cummings	d233b70285	Merge branch '6.4.x'	2024-12-17 09:37:01 -07:00
Josh Cummings	841c03fe3b	Add Serializable Compatilibity to Saml 2.0 Exceptions ... Issue gh-16276	2024-12-17 09:36:29 -07:00
Josh Cummings	b9f3a28678	Add UserDetailsService Constructor ... Closes gh-15973	2024-12-16 17:59:16 -07:00
Evgeniy Cheban	f45cc22e11	Allow configuring custom ServerHttpHeadersWriter for Kotlin DSL ... Closes gh-16009	2024-12-16 17:54:04 -07:00
Josh Cummings	a5b0304596	Move AnyRequest Validation ... This will make way for other adding other checks Issue gh-15982	2024-12-13 18:24:57 -07:00
Josh Cummings	c1f5eb3192	Merge branch '6.4.x'	2024-12-13 18:24:39 -07:00
Josh Cummings	5ee1586a5a	Remove Unexposed Inner Classes from Serialization Test ... The following inner classes are used only internally by a non-Serializable component Issue gh-16276	2024-12-13 18:18:09 -07:00
Josh Cummings	9d02949fa9	Merge branch '6.4.x'	2024-12-13 16:58:17 -07:00
Josh Cummings	018e1ae1a4	Added Serialization Values ... Issue gh-16276	2024-12-13 16:41:32 -07:00
Josh Cummings	b9911fd522	Add serialVersionUID to Authentication classes ... Issue gh-16276	2024-12-13 16:41:32 -07:00
Josh Cummings	77f76f8465	Merge branch '6.4.x'	2024-12-13 11:53:51 -07:00
Josh Cummings	e3cd4339b2	Add Serial Version ... Closes gh-16163	2024-12-13 11:53:15 -07:00
Rob Winch	a6354e5137	Merge branch '6.4.x' ... Closes gh-16283	2024-12-13 10:10:21 -06:00
Daniel Garnier-Moiroux	fb954063bf	Fix WebAuthnWebdriverTests ... Closes gh-16279	2024-12-13 10:08:27 -06:00
Rob Winch	5a81a1fe66	Merge branch '6.4.x'	2024-12-12 22:21:44 -06:00
Rob Winch	2a76a09552	Disable Flaky WebAuthnWebDriverTests	2024-12-12 22:21:36 -06:00
Rob Winch	2fcd305509	Increment to 6.5.0-SNAPSHOT ... Closes gh-16221	2024-12-12 21:47:11 -06:00
Josh Cummings	7592483654	Add Test to Report Missing serialVersionUID ... Issue gh-16276	2024-12-12 18:12:11 -07:00
Josh Cummings	f7b9b7228f	Include Classes Listed in Generator Map ... This allows testing of classes that are serializable, but do not use Security's serialVersionUID. Issue gh-16276	2024-12-12 18:07:53 -07:00
Josh Cummings	82cc3ad5ec	Arrange Class Generators by Module ... Issue gh-16276	2024-12-12 18:07:52 -07:00
Josh Cummings	47b5ab400a	Add 6.4.x Serialization Files ... Closes gh-16274	2024-12-12 18:07:52 -07:00
Daniel Garnier-Moiroux	99cc65d74c	webauthn: add webdriver test ... - These tests verify the full end-to-end flow, including the javascript code bundled in the default login and logout pages. They require a full web browser, with support for Virtual Authenticators for automated testing. At this point in time, only Chrome supports virutal authenticators.	2024-12-11 16:53:38 -06:00
Josh Cummings	4cbaabb239	Added Testing ... Issue gh-16177	2024-12-10 14:09:46 -07:00
Josh Cummings	aa85ebc65f	Remove Extraneous Field ... Issue gh-15678	2024-12-09 08:00:22 -07:00
Josh Cummings	4dd00fe146	Merge branch '6.3.x'	2024-12-06 15:19:19 -07:00
Josh Cummings	dd8ee38194	Merge branch '6.2.x' into 6.3.x ... Closes gh-16229	2024-12-06 15:18:42 -07:00
Josh Cummings	87de6cea1b	Use Reactive JSON Encoder ... Closes gh-16177	2024-12-06 15:14:07 -07:00
Josh Cummings	3d1e4b5f18	Polish Tests ... Confirm that responses are a valid JSON map Issue gh-16177	2024-12-06 15:14:07 -07:00
Josh Cummings	3e20f7b5b5	Polish Error Messages ... - aligned the grammar - formatted using gradlew format - updated copyright year Issue gh-16193	2024-12-05 17:37:46 -07:00
Dmitry Spikhalsky	32e1d4c990	Improve AuthorizationManager configuration error messages ... Closes gh-16193	2024-12-05 17:37:46 -07:00
Tran Ngoc Nhan	39cd8d9faf	Update copyright headers	2024-12-05 14:52:59 -07:00
Josh Cummings	96b3c77ce0	Merge branch '6.3.x'	2024-12-05 12:30:37 -07:00
DingHao	ef7b11ac01	Delay initialization UserDetailsService in Global Authentication	2024-12-05 12:26:04 -07:00
Tran Ngoc Nhan	5966baf9bf	Update copyright headers	2024-12-04 16:51:05 -07:00
Josh Cummings	2ed1cafed8	Restore Deprecated ObjectPostProcessor Usage ... Closes gh-16174	2024-12-04 16:51:05 -07:00
Tran Ngoc Nhan	8c0ea3e630	Add Deprecated ObjectPostProcessor constructor ... Issue gh-16174	2024-12-04 16:51:05 -07:00
Josh Cummings	2b5a2eef82	Address Observation Bean Name Collisions ... Closes gh-16161	2024-11-25 13:26:52 -07:00
Josh Cummings	a55021539a	Add RSocket and WebFlux Observation Tests ... Issue gh-11989 Issue gh-11990	2024-11-25 13:26:52 -07:00
Josh Cummings	315aafd464	Merge remote-tracking branch 'origin/6.3.x'	2024-11-22 17:23:43 -07:00
DingHao	e8ba039a61	Delay initialization AuthenticationProvider in Global Authentication	2024-11-22 17:22:14 -07:00
Tran Ngoc Nhan	b896a74669	Resolve Observation Bean Name Collisions ... Closes gh-16011	2024-11-20 13:28:06 -07:00
Josh Cummings	91832bfc8e	Add EnableWebSecurity + EnableWebSocketSecurity Test ... Issue gh-16011	2024-11-20 13:28:06 -07:00
Joe Grandja	c2cfe92a02	Merge branch '6.3.x'	2024-11-18 05:16:16 -05:00
Joe Grandja	709103e38c	Merge branch '6.2.x' into 6.3.x	2024-11-18 04:45:38 -05:00
Joe Grandja	a8c4d6cead	Require Locale argument for toLower/toUpperCase usage	2024-11-18 04:22:26 -05:00
Daniel Garnier-Moiroux	2639ac6545	webauthn: introduce WebAuthnConfigurer#disableDefaultRegistrationPage	2024-11-14 12:11:43 -06:00
Daniel Garnier-Moiroux	de7c452e42	webauthn: use DefaultResourcesFilter#webauthn ... - Unconditionally use the DefaultResourcesFilter, because the javascript file is required by the DefaultWebAythnPageGeneratingFilter, which is always registered.	2024-11-14 12:11:43 -06:00