2078 Commits

Author	SHA1	Message	Date
Josh Cummings	0954638d57	Merge branch '6.3.x' into 6.4.x ... Closes gh-16862	2025-04-01 12:02:25 -06:00
DingHao	857ef6fe08	WithHttpOnlyCookie defaults to false ... Closes gh-16820 Signed-off-by: DingHao <dh.hiekn@gmail.com>	2025-04-01 11:59:51 -06:00
Max Batischev	9a897d0b62	Add Support Postgres To JdbcUserCredentialRepository ... Closes gh-16832 Signed-off-by: Max Batischev <mblancer@mail.ru>	2025-03-31 16:43:36 -06:00
wtigerhyunsu	bdbf6a2be3	Add toString() to IpAddressMatcher.java ... Closes gh-16795 Signed-off-by: wtigerhyunsu <jack951@naver.com>	2025-03-27 16:38:53 -06:00
Josh Cummings	99345537d6	Add RequestMatcher Migration Path for AbstractAuthenticationProcessingFilter ... Issue gh-16417	2025-03-26 16:38:39 -06:00
Josh Cummings	15d9c13984	Add RequestMatcher MigrationPath for SwitchUserFilter ... To simplify migration, the filter's setter methods still use AntPathRequestMatcher. Users can call the equivalent RequestMatcher setter methods to opt-in to the change early. Issue gh-16417	2025-03-26 16:38:38 -06:00
Josh Cummings	1eec51ab6c	Polish SwitchUserFilterTests ... Ensure that the appropriate HTTP Method is specified in tests Issue gh-16417	2025-03-26 16:38:38 -06:00
Josh Cummings	1618963255	Deprecate AntPathRequestMatcher ... Closes gh-16632	2025-03-26 13:40:05 -06:00
Josh Cummings	de07b1108f	Use PathPatternRequestMatcher in Web Components ... This commit changes filters and resolvers that were using AntPathRequestMatcher as their default to using PathPatternRequestMatcher. Issue gh-16632	2025-03-26 13:28:58 -06:00
Josh Cummings	50ad378a29	Polish MockHttpServletRequest Usage ... This commit makes so that the requestURI is set to a value that makes sense with the other properties being mocked. Issue gh-16632	2025-03-26 13:27:17 -06:00
Rob Winch	491d28b6bb	Merge branch '6.4.x' ... - Fix WebAuthn saves Anonymous PublicKeyCredentialUserEntity Closes gh-16821	2025-03-25 16:19:14 -05:00
Rob Winch	1f3dd53bdf	Fix WebAuthn saves Anonymous PublicKeyCredentialUserEntity ... Closes gh-16606	2025-03-25 16:14:58 -05:00
Rob Winch	a6b5c05da9	Additional WebAuthn4jRelyingPartyOperationTests ... - verify that anonymous users not saved - verify that when user found the CredentialRecord is allowed Issue gh-16385	2025-03-25 16:14:25 -05:00
Rob Winch	9c054474a8	Use Test Name Conventions ... Issue gh-16385	2025-03-25 16:14:25 -05:00
Rob Winch	593f7c4490	Use !isAuthenticated ... It's more verbose to see if the user is not null and not anonymous Issue gh-16385	2025-03-25 16:14:25 -05:00
Rob Winch	4e20d56d2d	Fix format for WebAuthn4jRelyingPartyOperations ... Issue gh-16385	2025-03-25 16:14:25 -05:00
Josh Cummings	05fdcd6a08	Deprecate MvcRequestMatcher ... Closes gh-16631	2025-03-24 22:03:22 -06:00
Tomas Borghi	0a084135ec	Delete import unused ... Signed-off-by: Tomas Borghi <137845283+Borghii@users.noreply.github.com>	2025-03-24 16:50:39 -03:00
Tomas Borghi	5571ad1b27	Fix issues identified in PR review ... Signed-off-by: Tomas Borghi <137845283+Borghii@users.noreply.github.com>	2025-03-24 13:18:23 -03:00
Borghi	e3a715b8f5	Fix issues identified in PR review ... Signed-off-by: Borghi <137845283+Borghii@users.noreply.github.com>	2025-03-24 13:00:27 -03:00
Josh Cummings	56e757a2a1	Provide Authentication to AuthenticationExceptions ... Issue gh-16444	2025-03-21 21:54:32 -06:00
Josh Cummings	464e506429	Polish ExceptionTranslateWebFilter ... - Isolated exception construction - Isolated entry point subscription Issue gh-16444	2025-03-21 21:54:32 -06:00
Josh Cummings	bfc12d55eb	Polish Tests ... Issue gh-16771	2025-03-21 14:43:05 -06:00
Josh Cummings	3d96878d43	Cache RequestPath ... In this way PathPatternRequestMatcher won't need to reparse for each request matcher. Issue gh-16771	2025-03-21 14:43:05 -06:00
Josh Cummings	86599afd43	Rename servletPath to basePath ... Closes gh-16765	2025-03-21 12:04:46 -06:00
Josh Cummings	c53bf2befe	PathPatternRequestParser Retains Servlet Path ... Issue gh-16765	2025-03-21 12:04:45 -06:00
Josh Cummings	1966ff3ce8	Parse RequestPath when cache is empty ... Closes gh-16771	2025-03-21 12:03:56 -06:00
Josh Cummings	861a9a914e	OneTimeToken Missing Token Propagates Request ... Closes gh-16780	2025-03-20 17:23:06 -06:00
Josh Cummings	8199015e79	Add Support for AuthenticationConverter ... Closes gh-16793	2025-03-20 17:22:53 -06:00
Daeho Kwon	24b7287d55	Replace dynamic error message with static "Access Denied" ... Closes gh-16514 Signed-off-by: Daeho Kwon <trewq231@naver.com>	2025-03-20 15:20:54 -05:00
mmck328	5ded04da6c	Fix javadocs on WebFlux CSRF classes ... Signed-off-by: mmck328 <20348295+mmck328@users.noreply.github.com>	2025-03-20 14:59:42 -05:00
Steve Riesenberg	3ebcbd4375	Merge branch '6.4.x' ... Closes gh-16788 Closes gh-16789 Closes gh-16790 Closes gh-16791 Closes gh-16792	2025-03-20 14:47:07 -05:00
Steve Riesenberg	96cfbd1e6c	Merge branch '6.3.x' into 6.4.x ... Closes gh-16782 Closes gh-16783 Closes gh-16784 Closes gh-16785 Closes gh-16786	2025-03-20 14:46:18 -05:00
Tran Ngoc Nhan	ab6e9d2d1f	Clarify WebInvocationPrivilegeEvaluator JavaDoc ... Closes gh-16529 Signed-off-by: Tran Ngoc Nhan <ngocnhan.tran1996@gmail.com>	2025-03-20 14:38:10 -05:00
Max Batischev	a50a8b2f17	Improve JdbcPublicKeyCredentialUserEntityRepository save ... Closes gh-16726 Signed-off-by: Max Batischev <mblancer@mail.ru>	2025-03-19 18:13:54 -06:00
Josh Cummings	1120733e27	Update Copyright	2025-03-19 17:43:01 -06:00
Josh Cummings	8e9634d25c	Deprecate ConfigAttribute ... Closes gh-16774	2025-03-19 17:39:38 -06:00
Josh Cummings	989aee244b	Deprecate SecurityMetadataSource ... Closes gh-16772	2025-03-19 15:26:05 -06:00
Josh Cummings	ece7489f5b	Merge branch '6.4.x'	2025-03-18 16:35:23 -06:00
AB	d9a937f0c1	Correct Closing Tag ... Closes gh-16600 Signed-off-by: AB <a.bierler@xdev-software.de>	2025-03-18 16:35:15 -06:00
Rob Winch	e6223dede3	Merge branch '6.4.x' ... - adb303e Add testRuntimeOnly junit-platform-launcher Closes gh-16757	2025-03-17 14:34:18 -05:00
Rob Winch	05116eabbd	Merge branch '6.3.x' into 6.4.x ... - adb303e Add testRuntimeOnly junit-platform-launcher Closes gh-16756	2025-03-17 14:18:49 -05:00
Rob Winch	adb303e152	Add testRuntimeOnly junit-platform-launcher ... Closes gh-16755	2025-03-17 14:16:44 -05:00
Steve Riesenberg	0938ca01a4	Add support for automatic context-propagation with Micrometer ... Closes gh-16665	2025-03-13 15:29:08 -05:00
Max Batischev	c7673e8f2f	Polish AbstractAuthenticationTargetUrlRequestHandler ... PR gh-16557 Signed-off-by: Max Batischev <mblancer@mail.ru>	2025-03-07 14:03:13 -07:00
Max Batischev	47630ca354	Fix JdbcUserCredentialRepository Save ... Closes gh-16620 Signed-off-by: Max Batischev <mblancer@mail.ru>	2025-03-07 13:57:41 -07:00
Max Batischev	58a665e5aa	Add Support SingleResultAuthorizationManager ... Closes gh-16590 Signed-off-by: Max Batischev <mblancer@mail.ru>	2025-03-07 13:46:23 -07:00
yelm-212	cfefccad1f	Update Http403ForbiddenEntryPoint to Use HttpStatus ... Closes gh-16615 Signed-off-by: yelm-212 <21yrshin@naver.com>	2025-03-07 12:17:14 -05:00
Josh Cummings	ab52fd858a	Deprecate ChannelDecisionManager ... Closes gh-16681	2025-02-28 12:35:21 -07:00
Josh Cummings	2d96fba5cf	Add HttpsRedirectFilter ... Closes gh-16678	2025-02-28 09:30:53 -07:00
Josh Cummings	e569c7a39e	Fix Tests ... Issue gh-16517	2025-02-27 14:07:49 -07:00
topiam	85f0f3f34a	Support Custom RequestMatchers for WebAuthn ... Closes gh-16517 Signed-off-by: topiam <support@topiam.cn>	2025-02-27 14:07:49 -07:00
Rob Winch	9417f02790	Deprecate PortResolver ... Closes gh-15972	2025-02-26 16:13:10 -06:00
Rob Winch	5f5427bd03	PortResolver.NO_OP ... Closes gh-16666	2025-02-26 16:13:10 -06:00
Josh Cummings	588220a020	Add PathPatterRequestMatcher ... Closes gh-16429 Clsoes gh-16430	2025-02-21 13:40:23 -07:00
Steve Riesenberg	7fc5d50adf	Polish gh-16551	2025-02-19 13:53:30 -06:00
Max Batischev	0ccbd20f0a	Add Support ServerFormPostRedirectStrategy ... Closes gh-16542 Signed-off-by: Max Batischev <mblancer@mail.ru>	2025-02-19 13:53:30 -06:00
Borghi	0bc9313fdd	Fix bug PublicKeyCredentialUserEntityRepository saves anonymousUser ... Issue gh-16385 Signed-off-by: Borghi <137845283+Borghii@users.noreply.github.com>	2025-02-16 22:50:34 -03:00
tejas-teju	c4b223266c	Return Invalid Credentials message on login error ... Closes gh-16484 Signed-off-by: tejas-teju <tejas8196@gmail.com>	2025-02-14 16:01:22 -07:00
Josh Cummings	e42865b926	Merge branch '6.4.x'	2025-02-14 13:08:17 -07:00
Josh Cummings	946812691e	Make AuthenticatorAttestation Serializable ... Issue gh-16481	2025-02-14 13:07:56 -07:00
Max Batischev	b5a4218a0b	Make WebAuthnAuthenticationRequestToken Serializable ... Closes gh-16481 Signed-off-by: Max Batischev <mblancer@mail.ru>	2025-02-14 11:51:46 -07:00
Max Batischev	879b44f9a1	Make PublicKeyCredentialRequestOptions Serializable ... Closes gh-16432 Signed-off-by: Max Batischev <mblancer@mail.ru>	2025-02-13 17:17:16 -07:00
ying.li	6494ea9b18	fix for typo	2025-02-10 12:22:57 -06:00
Daniel Garnier-Moiroux	238f47ce5e	One Time Token login registers the default login page ... closes gh-16414 Signed-off-by: Daniel Garnier-Moiroux <git@garnier.wf>	2025-02-10 09:55:51 -06:00
Daniel Garnier-Moiroux	5ee6b83953	Introduce OneTimeTokenAuthenticationFilter ... closes gh-16539 Signed-off-by: Daniel Garnier-Moiroux <git@garnier.wf>	2025-02-10 09:55:51 -06:00
Max Batischev	be81377235	Add Support ServerGenerateOneTimeTokenRequestResolver ... Closes gh-16488 Signed-off-by: Max Batischev <mblancer@mail.ru>	2025-02-05 14:14:16 -07:00
Steve Riesenberg	54a6a19e05	Polish gh-16214 ... This commit applies the following changes: * Added local Content-Security-Policy with script-src nonce directive * Removed form-redirect.js and associated changes * Renamed to FormPostRedirectStrategy * Removed HtmlUtils usage * Moved to same package as DefaultRedirectStrategy	2025-02-03 14:52:30 -06:00
Craig Andrews	58534e7f60	Add FormRedirectStrategy to enable POST OIDC Logout ... FormRedirectStrategy redirects using an autosubmitting HTML form using the POST method versus DefaultRedirectStrategy which redirects using the GET method. Can be used to implement POST binding for relying party initiated OIDC logout by setting FormRedirectStrategy as the redirection strategy on OidcClientInitiatedLogoutSuccessHandler. Closes gh-13002 Signed-off-by: Craig Andrews <candrews@integralblue.com>	2025-02-03 14:52:30 -06:00
Max Batischev	61d92e9db9	Fix assertion message in DefaultGenerateOneTimeTokenRequestResolver ... Signed-off-by: Max Batischev <mblancer@mail.ru>	2025-02-03 12:15:20 -07:00
Josh Cummings	0f8e1936ff	Merge branch '6.4.x'	2025-02-03 10:19:31 -07:00
NeoTraveler	e31f04bebc	`withValue` used incorrectly ... Closes gh-16525 Closes gh-16527 Signed-off-by: NeoTraveler <55753029+NeoTraveler@users.noreply.github.com>	2025-02-03 10:18:33 -07:00
Steve Riesenberg	b32f4f1afc	Polish gh-16502	2025-02-03 09:21:53 -06:00
earlgrey02	1fa1848f9f	Add HttpStatusAccessDeniedHandler ... Signed-off-by: earlgrey02 <san06036@naver.com>	2025-02-03 09:21:53 -06:00
Max Batischev	c7bc4c98db	Make PublicKeyCredentialRequestOptions Serializable ... Closes gh-16432 Signed-off-by: Max Batischev <mblancer@mail.ru>	2025-01-23 20:13:10 -06:00
Josh Cummings	e1a42db845	Merge branch '6.4.x'	2025-01-23 17:03:53 -07:00
Josh Cummings	d043884e32	Support Serialization ... Issue gh-16276	2025-01-23 16:44:45 -07:00
Rob Winch	177ce59a4b	Merge branch '6.4.x' ... Implement Serializable for WebAuthnAuthentication Closes gh-16474	2025-01-23 14:12:30 -06:00
Tran Ngoc Nhan	e557c7227b	Implement Serializable for WebAuthnAuthentication ... Closes gh-16273 Closes gh-16285 Signed-off-by: Tran Ngoc Nhan <ngocnhan.tran1996@gmail.com>	2025-01-23 13:53:26 -06:00
Max Batischev	474b5e151a	Add Support GenerateOneTimeTokenRequestResolver ... Closes gh-16291 Signed-off-by: Max Batischev <mblancer@mail.ru>	2025-01-22 17:09:55 -06:00
Rob Winch	dddab8e356	Merge branch '6.4.x' ... Closes gh-16465	2025-01-22 16:04:19 -06:00
Daniel Garnier-Moiroux	bb8e757c4b	Fix GenerateOneTimeTokenWebFilter double publish of chain.filter(...) ... closes gh-16458 Signed-off-by: Daniel Garnier-Moiroux <git@garnier.wf>	2025-01-22 16:00:59 -06:00
Rob Winch	081dee042e	Merge branch '6.4.x' ... Add TestBytes Closes gh-16462	2025-01-21 15:12:49 -06:00
Rob Winch	3209930cca	Add TestBytes ... Closes gh-16461	2025-01-21 15:12:31 -06:00
Max Batischev	80e8e14500	Add GenerateOneTimeTokenFilterTests	2025-01-21 10:59:57 -06:00
DingHao	f4491f388e	Set PublicKeyCredentialCreationOptionsRepository by DSL or Bean ... Closes gh-16369 Signed-off-by: DingHao <dh.hiekn@gmail.com>	2025-01-17 18:57:08 -06:00
DingHao	8181cec06c	Set HttpMessageConverter by DSL ... Closes gh-16369 Signed-off-by: DingHao <dh.hiekn@gmail.com>	2025-01-17 18:29:23 -06:00
Josh Cummings	c2a5709e0f	Merge branch '6.4.x'	2025-01-17 16:09:01 -07:00
Josh Cummings	bbe4f87641	Mark Serialization Support for Events ... Issue gh-16276	2025-01-17 16:08:31 -07:00
DingHao	45f22a46e3	Use spring.security prefix instead of security.security ... Closes gh-16422 Signed-off-by: DingHao <dh.hiekn@gmail.com>	2025-01-16 14:29:25 -07:00
Josh Cummings	443af32314	Move Servlet Mocks to Web ... Issue gh-13551	2025-01-15 17:32:58 -07:00
Josh Cummings	6019803064	Merge branch '6.4.x'	2025-01-14 18:38:14 -07:00
Josh Cummings	244fd2eb51	Support Serialization in Exceptions ... Issue gh-16276	2025-01-14 18:37:53 -07:00
Josh Cummings	acd1bb1777	Merge branch '6.4.x'	2025-01-14 17:35:45 -07:00
Josh Cummings	8e59fa1719	Don't Support Serialization for Jackson (De)serializers ... Issue gh-16276	2025-01-14 17:35:33 -07:00
Josh Cummings	0af4cdbf5c	Merge branch '6.4.x'	2025-01-14 17:05:21 -07:00
Josh Cummings	8735368d9e	Don't Support Serialization of Jackson Modules ... Issu gh-16276	2025-01-14 17:04:36 -07:00
Josh Cummings	28644aa966	Merge branch '6.4.x'	2025-01-14 16:17:34 -07:00
Josh Cummings	6f379aa907	Add Serializable to Csrf Components ... Issue gh-16276	2025-01-14 16:07:20 -07:00
Max Batischev	fd267dfb71	Add Support JdbcPublicKeyCredentialUserEntityRepository ... Closes gh-16224	2024-12-20 16:54:51 -06:00
Max Batischev	7b07ef5ff3	Add Support JdbcUserCredentialRepository ... Closes gh-16224	2024-12-20 16:54:51 -06:00
Max Batischev	38523faaa0	Remove Unused loggers ... Closes gh-16319	2024-12-20 16:51:38 -06:00
Max Batischev	e9bdb5b96e	Polish SecurityFilterChain Validation ... Issue gh-15982	2024-12-19 15:04:01 -07:00
Josh Cummings	1104b45832	Polish SessionLimit ... - Move to the web.authentication.session package since it is only needed by web.authentication.session elements and does not access any other web element itself. - Add Kotlin support - Add documentation Issue gh-16206	2024-12-18 18:32:28 -07:00
Claudenir Machado	1864577e98	Address SessionLimitStrategy ... Closes gh-16206	2024-12-18 18:32:12 -07:00
Josh Cummings	3eeb4317f6	Add setFavorRelativeUris ... This places the new functionality behind a setting so that we can remain passive until we can change the setting in the next major release. Issue gh-7273	2024-12-17 22:35:41 -07:00
Michal Okosy	7848b959da	Use relative URLs in /login redirects ... Closes gh-7273	2024-12-17 22:35:41 -07:00
Josh Cummings	27c2a8ad11	Add Serializable Compatibility to Web Authentication Exceptions ... Issue gh-16276	2024-12-17 13:05:23 -07:00
Yoshikazu Nojima	d7d5253607	Change attestation in PublicKeyCredentialCreationOptions to none ... The attestation option in PublicKeyCredentialCreationOptions is a parameter that controls whether to request attestation from the security key. However, Spring Security Passkeys currently doesn't implement attestation verification. Therefore, requesting attestation is unnecessary. Specifying `direct` to request attestation may trigger browsers to display additional privacy related dialog to users, so it is best to avoid specifying `direct` unnecessarily.	2024-12-11 17:18:18 -06:00
Rob Winch	cb4c7e5886	Merge branch '6.3.x' ... Closes gh-16261	2024-12-11 15:48:18 -06:00
Rob Winch	6a0b683e60	StrictFirewallHttpRequest.buid returns StrictFirewallHttpRequest ... Closes gh-16069	2024-12-11 15:46:31 -06:00
Josh Cummings	4cbaabb239	Added Testing ... Issue gh-16177	2024-12-10 14:09:46 -07:00
DingHao	f565b23b51	Restore Method Parameter Inheritance Support ... Closes gh-16177	2024-12-10 14:09:46 -07:00
12OneTwo12	d39e329234	Add @inheritDoc to sessionIdChanged method ... Closes gh-16211	2024-12-05 12:31:47 -07:00
Josh Cummings	d3a95c5c1e	Merge branch '6.3.x'	2024-12-05 09:52:55 -07:00
Josh Cummings	0f85da77be	Merge branch '6.2.x' into 6.3.x ... Closes gh-16219	2024-12-05 09:52:32 -07:00
Josh Cummings	96a9cf0d2d	Restore Previous Behavior for Servlet 5 ... Closes gh-16173	2024-12-05 09:52:06 -07:00
Rob Winch	9c3b11914d	webauthn registerCredential returns transports ... The webauthn support previously did not pass the transports to webauthn4j. This meant that the result of Webauthn4jRelyingPartyOperations.registerCredential did not have any transports either. This commit ensures that the transports are passed to the webauth4j lib and then returned in the result of registerCredential. Closes gh-16084	2024-12-04 15:22:26 -06:00
DingHao	dc82a6e97e	Remove the cache since UniqueSecurityAnnotationScanner has cached annotations internally	2024-12-04 09:18:12 -07:00
Daniel Garnier-Moiroux	46fe0124ba	Add RuntimeHints for webauthn Javascript resource	2024-11-25 13:06:50 -06:00
Joe Grandja	c2cfe92a02	Merge branch '6.3.x'	2024-11-18 05:16:16 -05:00
Joe Grandja	fa5fc6dd62	Fix checkstyle errors for toLower/toUpperCase usage	2024-11-18 04:56:17 -05:00
Joe Grandja	709103e38c	Merge branch '6.2.x' into 6.3.x	2024-11-18 04:45:38 -05:00
Joe Grandja	a8c4d6cead	Require Locale argument for toLower/toUpperCase usage	2024-11-18 04:22:26 -05:00
Steve Riesenberg	285d16b046	Polish IpAddressMatcher ... (cherry picked from commit 83a79159b8)	2024-11-15 10:17:39 -06:00
Steve Riesenberg	ddf4542a9e	Add hasText assertion to IpAddressMatcher constructor ... Issue gh-15527 (cherry picked from commit 3a29819651)	2024-11-15 10:17:39 -06:00
Steve Riesenberg	554df6fab6	Fix NPE in IpAddressMatcher ... Closes gh-15527 (cherry picked from commit 52de894c3c)	2024-11-15 10:17:38 -06:00
Steve Riesenberg	83a79159b8	Polish IpAddressMatcher	2024-11-15 09:33:31 -06:00
Steve Riesenberg	3a29819651	Add hasText assertion to IpAddressMatcher constructor ... Issue gh-15527	2024-11-15 09:33:31 -06:00
Steve Riesenberg	52de894c3c	Fix NPE in IpAddressMatcher ... Closes gh-15527	2024-11-15 09:33:30 -06:00
Daniel Garnier-Moiroux	a1526361b6	webauthn: introduce DefaultResourcesFilter#webauthn	2024-11-14 12:11:43 -06:00
nomoreFt	8f1c892fb7	Remove unnecessary parentheses and add static final field	2024-11-13 15:06:58 -06:00
DingHao	055ec57737	Fix not exist class in WebFilterChainProxy java doc	2024-11-07 13:03:49 -07:00
Josh Cummings	f46e56de78	Improve Error Message for Conflicting Filter Chains ... Closes gh-15874	2024-11-07 13:01:16 -07:00
Tran Ngoc Nhan	571c7c81a4	Fix typo	2024-11-04 10:23:38 -06:00
Tran Ngoc Nhan	ab93541926	Simplify condition in some methods	2024-10-25 13:42:33 -07:00
Tran Ngoc Nhan	e76de931ce	Polish Optional usage	2024-10-25 13:42:33 -07:00
Tran Ngoc Nhan	ffed4ea1dc	Polish diamond usage	2024-10-25 13:42:33 -07:00
Josh Cummings	981fbd5c2c	Polish Tests ... Closes gh-14768	2024-10-24 20:51:34 -07:00
Josh Cummings	6dbbe89b83	Merge remote-tracking branch 'origin/6.3.x'	2024-10-24 21:48:10 -06:00
DingHao	308e408b13	Polish DelegatingAuthenticationConverter	2024-10-24 20:47:46 -07:00
Josh Cummings	cf03f2fed9	Merge branch '6.3.x'	2024-10-24 11:57:13 -06:00
Josh Cummings	5048a68ab7	Merge branch '6.2.x' into 6.3.x ... Closes gh-15986	2024-10-24 11:56:41 -06:00
Josh Cummings	addc7c53b2	Merge branch '5.8.x' into 6.2.x ... Closes gh-15985	2024-10-24 11:56:16 -06:00
DingHao	1399a82ea9	Return Null Request When Cookie Is Malformed ... Closes gh-15905	2024-10-24 10:55:36 -07:00
Rob Winch	fc5719d8d6	Merge branch '6.3.x' ... Add Firewall for WebFlux Closes gh-15967	2024-10-21 12:11:42 -05:00
Joe Grandja	ec38848b20	Fix invalid windows character	2024-10-21 11:34:56 -04:00
Rob Winch	1528c421bd	Merge branch '6.2.x' into 6.3.x ... Add Firewall for WebFlux Closes gh-15967	2024-10-21 09:43:48 -05:00
Rob Winch	0e257b56ce	Add Firewall for WebFlux ... Closes gh-15967	2024-10-21 09:42:24 -05:00
Rob Winch	542071b1f8	Merge Add Firewall for WebFlux ... Closes gh-15967	2024-10-21 08:56:42 -05:00
Rob Winch	4ce7cde155	Add Firewall for WebFlux ... Closes gh-15967	2024-10-21 08:46:13 -05:00
Rob Winch	f689257dc4	Fix unused import	2024-10-21 00:28:57 -05:00
Rob Winch	8a0a5e2647	Format	2024-10-21 00:17:51 -05:00
Rob Winch	c461abd5da	Remove unnecessary WebauthnJackson2Module usage ... HttpMessageConverterAuthenticationSuccessHandler does not need to use WebauthnJacksonModule	2024-10-21 00:16:31 -05:00
Rob Winch	6d7df007dd	Remove non-ascii characters ... Attempt fix windows format error	2024-10-21 00:15:58 -05:00
Rob Winch	5736f0897e	Remove imports for Javadoc Only Usage	2024-10-21 00:08:12 -05:00
Rob Winch	0bb406aaab	Run format again	2024-10-20 23:35:50 -05:00
Rob Winch	7f26e54d07	Remove § ... See if this fixes format in windows	2024-10-20 23:30:40 -05:00
Rob Winch	b0e8730d70	Add Passkeys Support ... Closes gh-13305	2024-10-20 22:54:53 -05:00
Josh Cummings	472c315ac3	Add Since to setSessionAuthenticaitonStrategy ... Issue gh-2253	2024-10-15 15:09:36 -06:00
xhaggi	7f537241e7	Use SessionAuthenticationStrategy for Remember-Me authentication ... Closes gh-2253	2024-10-15 14:07:07 -07:00
Max Batischev	d37d41c130	Polish One-Time Token API Names and Doc ... The names of variables and methods have been adjusted in accordance with the names of the one-time token login API components. Issue gh-15114	2024-10-15 14:04:56 -07:00
Josh Cummings	c40334317d	Polish One-Time Token Component Names ... Aligning parts of speech so that names are using nouns/verbs where comparable components are using nouns/verbs. Issue gh-15114	2024-10-14 14:07:47 -06:00
kwonyonghyun	b8aa78829c	Improve readability of empty collection checks	2024-10-14 12:16:39 -07:00
Tran Ngoc Nhan	31bdaf720d	Remove redundant keyword	2024-10-14 11:51:35 -07:00
Tran Ngoc Nhan	31f8caec5f	Polish diamond operator usage	2024-10-14 11:51:35 -07:00
Josh Cummings	9ce5a76e8c	Polish AuthorizationManager#authorize ... Issue gh-14843	2024-10-14 11:48:57 -07:00
Max Batischev	e7644925f8	Add AuthorizationResult support for AuthorizationManager ... Closes gh-14843	2024-10-14 11:48:57 -07:00
Josh Cummings	702538ebce	AuthorizationEventPublisher Accepts AuthorizationResult ... Closes gh-15915 Co-authored-by: Max Batischev <mblancer@mail.ru>	2024-10-14 11:48:57 -07:00
Josh Cummings	b26f2af5d5	Polish ... Formatting as well as adding a missing defer Issue gh-15699	2024-10-07 16:39:54 -07:00
Max Batischev	2ca2e56383	Add Reactive One-Time Token Login support ... Closes gh-15699	2024-10-07 16:39:54 -07:00
Max Batischev	de104e22b7	Update javaDoc for DefaultOneTimeTokenSubmitPageGeneratingFilter	2024-10-02 15:31:43 -05:00
John Niang	7fcb42b537	Fix typo of createDefaultRequestMacher in WebSessionServerRequestCache ... createDefaultRequestMacher -> createDefaultRequestMatcher	2024-09-30 15:24:40 -07:00
Marcus Hert Da Coregio	a88a7744ed	Require GeneratedOneTimeTokenHandler on constructor ... Issue gh-15114	2024-09-17 08:21:26 -03:00
Daniel Garnier-Moiroux	7e41785dfc	Remove trailing spaces in default UIs ... - Default UIs had blank lines with only spaces. These get deleted by the spring-javaformat plugin. In order to avoid this behavior, an extra \s had been inserted in the tests. The reason for those \s is not obvious. - This commit cleans up the \s but changing the HTML templates.	2024-09-11 10:44:45 -07:00
Daniel Garnier-Moiroux	98975a9b83	Add runtime hints for CSS resource	2024-09-10 12:46:13 -07:00
Daniel Garnier-Moiroux	2405a5b680	Remove CssUtils	2024-09-10 12:46:13 -07:00
Daniel Garnier-Moiroux	c1b9035544	Use static CSS in OneTimeToken default UI	2024-09-10 12:46:13 -07:00
Daniel Garnier-Moiroux	e958ff2d4a	Use static CSS in reactive default UI	2024-09-10 12:46:13 -07:00
Daniel Garnier-Moiroux	45d53973ab	Serve static content (css, js) for reactive default UIs from DefaultResourcesWebFilter	2024-09-10 12:46:13 -07:00
Daniel Garnier-Moiroux	11616a1d78	Use static CSS in servlet default UI	2024-09-10 12:46:13 -07:00
Daniel Garnier-Moiroux	c5c5cd5ed0	Serve static content (css, js) for default UIs from DefaultResourcesFilter	2024-09-10 12:46:13 -07:00
Marcus Hert Da Coregio	2ff29dc229	Throw AuthorizationDeniedException when AuthorizationResult is available ... Closes gh-15706	2024-09-10 09:14:50 -03:00
Daniel Garnier-Moiroux	4660e042d9	Remove unused <script> and <noscript> tags in One-Time-Token submit page	2024-09-06 09:13:30 -03:00
Daniel Garnier-Moiroux	528d739a60	Use contextPath in One-Time-Token default submit UI	2024-09-06 09:13:30 -03:00
Daniel Garnier-Moiroux	ef31ae1a98	Render One Time Token UIs using lightweight templates	2024-09-05 15:02:42 -07:00
Daniel Garnier-Moiroux	a642a1bb66	Render reactive default UIs using lightweight templates	2024-09-05 15:02:42 -07:00
Daniel Garnier-Moiroux	8d47906191	Render default UIs using lightweight templates	2024-09-05 15:02:42 -07:00
Daniel Garnier-Moiroux	33495441b5	Hardcode ott-username input name in DefaultLoginPageGeneratingFilter ... - GenerateOneTimeTokenFilter uses `"username"`, the default UI should use the same parameter name	2024-09-05 09:42:45 -03:00
Marcus Hert Da Coregio	00e4a8fb54	Add support for One-Time Token Login ... Closes gh-15114	2024-09-03 10:07:56 -03:00
Marcus Hert Da Coregio	5c56bddbdd	Polish log message	2024-09-03 09:43:37 -03:00
Florian Bernard	008cbc2cae	Add cookie customizer to CookieRequestCache and CookieServerRequestCache ... Issue gh-15204	2024-09-03 09:41:30 -03:00
Josh Cummings	626610a975	Polish Annotation API ... Rename to a class that isn't focused on the synthesis implementation detail. Also add Security to the front of the name to clarify that it is only intended for security annotations, reminiscent of SecurityMetadataSource. Refine method signatures to better articulate supported use cases. Issue gh-15286	2024-08-30 08:51:49 -06:00
Ilpyo-Yang	095929f6e8	Include FilterChain in SessionInformationExpiredEvent ... Closes gh-14077	2024-08-29 13:12:27 -03:00
DingHao	ed16c86115	Improve @CurrentSecurityContext meta-annotations ... Closes gh-15551	2024-08-13 13:18:15 -06:00
Josh Cummings	08b8b09066	Update Copyright ... Issue gh-15286	2024-08-10 11:48:14 -06:00
DingHao	2c02d8aec7	Update Copyright	2024-08-10 11:46:51 -06:00
DingHao	9aaf959400	Improve @AuthenticationPrincipal meta-annotations ... Closes gh-15286	2024-08-10 11:46:51 -06:00
Daniel Garnier-Moiroux	bc8ba7f3b7	Inline CSS for default login and logout page ... - Remove the dependency on Bootstrap CSS. Results in faster load times, no failures in air-gapped or offline scenarios, and no dependency on an external CDN that may go away some day.	2024-08-05 09:27:18 -05:00
baezzys	4169c0cf36	Publish Constants for Firewall Header and Parameter Predicates ... Introduced public static final Predicates for allowed header names, header values, parameter names, and parameter values for building expressions. Closes gh-13639	2024-07-18 17:24:38 -07:00