e569c7a39e
Fix Tests
...
Issue gh-16517
2025-02-27 14:07:49 -07:00
85f0f3f34a
Support Custom RequestMatchers for WebAuthn
...
Closes gh-16517
Signed-off-by: topiam <support@topiam.cn>
2025-02-27 14:07:49 -07:00
9417f02790
Deprecate PortResolver
...
Closes gh-15972
2025-02-26 16:13:10 -06:00
5f5427bd03
PortResolver.NO_OP
...
Closes gh-16666
2025-02-26 16:13:10 -06:00
588220a020
Add PathPatterRequestMatcher
...
Closes gh-16429
Clsoes gh-16430
2025-02-21 13:40:23 -07:00
7fc5d50adf
Polish gh-16551
2025-02-19 13:53:30 -06:00
0ccbd20f0a
Add Support ServerFormPostRedirectStrategy
...
Closes gh-16542
Signed-off-by: Max Batischev <mblancer@mail.ru>
2025-02-19 13:53:30 -06:00
0bc9313fdd
Fix bug PublicKeyCredentialUserEntityRepository saves anonymousUser
...
Issue gh-16385
Signed-off-by: Borghi <137845283+Borghii@users.noreply.github.com>
2025-02-16 22:50:34 -03:00
c4b223266c
Return Invalid Credentials message on login error
...
Closes gh-16484
Signed-off-by: tejas-teju <tejas8196@gmail.com>
2025-02-14 16:01:22 -07:00
e42865b926
Merge branch '6.4.x'
2025-02-14 13:08:17 -07:00
946812691e
Make AuthenticatorAttestation Serializable
...
Issue gh-16481
2025-02-14 13:07:56 -07:00
b5a4218a0b
Make WebAuthnAuthenticationRequestToken Serializable
...
Closes gh-16481
Signed-off-by: Max Batischev <mblancer@mail.ru>
2025-02-14 11:51:46 -07:00
879b44f9a1
Make PublicKeyCredentialRequestOptions Serializable
...
Closes gh-16432
Signed-off-by: Max Batischev <mblancer@mail.ru>
2025-02-13 17:17:16 -07:00
6494ea9b18
fix for typo
2025-02-10 12:22:57 -06:00
238f47ce5e
One Time Token login registers the default login page
...
closes gh-16414
Signed-off-by: Daniel Garnier-Moiroux <git@garnier.wf>
2025-02-10 09:55:51 -06:00
5ee6b83953
Introduce OneTimeTokenAuthenticationFilter
...
closes gh-16539
Signed-off-by: Daniel Garnier-Moiroux <git@garnier.wf>
2025-02-10 09:55:51 -06:00
be81377235
Add Support ServerGenerateOneTimeTokenRequestResolver
...
Closes gh-16488
Signed-off-by: Max Batischev <mblancer@mail.ru>
2025-02-05 14:14:16 -07:00
54a6a19e05
Polish gh-16214
...
This commit applies the following changes:
* Added local Content-Security-Policy with script-src nonce directive
* Removed form-redirect.js and associated changes
* Renamed to FormPostRedirectStrategy
* Removed HtmlUtils usage
* Moved to same package as DefaultRedirectStrategy
2025-02-03 14:52:30 -06:00
58534e7f60
Add FormRedirectStrategy to enable POST OIDC Logout
...
FormRedirectStrategy redirects using an autosubmitting HTML form using the POST method versus DefaultRedirectStrategy which redirects using the GET method.
Can be used to implement POST binding for relying party initiated OIDC logout by setting FormRedirectStrategy as the redirection strategy on OidcClientInitiatedLogoutSuccessHandler.
Closes gh-13002
Signed-off-by: Craig Andrews <candrews@integralblue.com>
2025-02-03 14:52:30 -06:00
61d92e9db9
Fix assertion message in DefaultGenerateOneTimeTokenRequestResolver
...
Signed-off-by: Max Batischev <mblancer@mail.ru>
2025-02-03 12:15:20 -07:00
0f8e1936ff
Merge branch '6.4.x'
2025-02-03 10:19:31 -07:00
e31f04bebc
`withValue` used incorrectly
...
Closes gh-16525
Closes gh-16527
Signed-off-by: NeoTraveler <55753029+NeoTraveler@users.noreply.github.com>
2025-02-03 10:18:33 -07:00
b32f4f1afc
Polish gh-16502
2025-02-03 09:21:53 -06:00
1fa1848f9f
Add HttpStatusAccessDeniedHandler
...
Signed-off-by: earlgrey02 <san06036@naver.com>
2025-02-03 09:21:53 -06:00
c7bc4c98db
Make PublicKeyCredentialRequestOptions Serializable
...
Closes gh-16432
Signed-off-by: Max Batischev <mblancer@mail.ru>
2025-01-23 20:13:10 -06:00
e1a42db845
Merge branch '6.4.x'
2025-01-23 17:03:53 -07:00
d043884e32
Support Serialization
...
Issue gh-16276
2025-01-23 16:44:45 -07:00
177ce59a4b
Merge branch '6.4.x'
...
Implement Serializable for WebAuthnAuthentication
Closes gh-16474
2025-01-23 14:12:30 -06:00
e557c7227b
Implement Serializable for WebAuthnAuthentication
...
Closes gh-16273
Closes gh-16285
Signed-off-by: Tran Ngoc Nhan <ngocnhan.tran1996@gmail.com>
2025-01-23 13:53:26 -06:00
474b5e151a
Add Support GenerateOneTimeTokenRequestResolver
...
Closes gh-16291
Signed-off-by: Max Batischev <mblancer@mail.ru>
2025-01-22 17:09:55 -06:00
dddab8e356
Merge branch '6.4.x'
...
Closes gh-16465
2025-01-22 16:04:19 -06:00
bb8e757c4b
Fix GenerateOneTimeTokenWebFilter double publish of chain.filter(...)
...
closes gh-16458
Signed-off-by: Daniel Garnier-Moiroux <git@garnier.wf>
2025-01-22 16:00:59 -06:00
081dee042e
Merge branch '6.4.x'
...
Add TestBytes
Closes gh-16462
2025-01-21 15:12:49 -06:00
3209930cca
Add TestBytes
...
Closes gh-16461
2025-01-21 15:12:31 -06:00
80e8e14500
Add GenerateOneTimeTokenFilterTests
2025-01-21 10:59:57 -06:00
f4491f388e
Set PublicKeyCredentialCreationOptionsRepository by DSL or Bean
...
Closes gh-16369
Signed-off-by: DingHao <dh.hiekn@gmail.com>
2025-01-17 18:57:08 -06:00
8181cec06c
Set HttpMessageConverter by DSL
...
Closes gh-16369
Signed-off-by: DingHao <dh.hiekn@gmail.com>
2025-01-17 18:29:23 -06:00
c2a5709e0f
Merge branch '6.4.x'
2025-01-17 16:09:01 -07:00
bbe4f87641
Mark Serialization Support for Events
...
Issue gh-16276
2025-01-17 16:08:31 -07:00
45f22a46e3
Use spring.security prefix instead of security.security
...
Closes gh-16422
Signed-off-by: DingHao <dh.hiekn@gmail.com>
2025-01-16 14:29:25 -07:00
443af32314
Move Servlet Mocks to Web
...
Issue gh-13551
2025-01-15 17:32:58 -07:00
6019803064
Merge branch '6.4.x'
2025-01-14 18:38:14 -07:00
244fd2eb51
Support Serialization in Exceptions
...
Issue gh-16276
2025-01-14 18:37:53 -07:00
acd1bb1777
Merge branch '6.4.x'
2025-01-14 17:35:45 -07:00
8e59fa1719
Don't Support Serialization for Jackson (De)serializers
...
Issue gh-16276
2025-01-14 17:35:33 -07:00
0af4cdbf5c
Merge branch '6.4.x'
2025-01-14 17:05:21 -07:00
8735368d9e
Don't Support Serialization of Jackson Modules
...
Issu gh-16276
2025-01-14 17:04:36 -07:00
28644aa966
Merge branch '6.4.x'
2025-01-14 16:17:34 -07:00
6f379aa907
Add Serializable to Csrf Components
...
Issue gh-16276
2025-01-14 16:07:20 -07:00
fd267dfb71
Add Support JdbcPublicKeyCredentialUserEntityRepository
...
Closes gh-16224
2024-12-20 16:54:51 -06:00
7b07ef5ff3
Add Support JdbcUserCredentialRepository
...
Closes gh-16224
2024-12-20 16:54:51 -06:00
38523faaa0
Remove Unused loggers
...
Closes gh-16319
2024-12-20 16:51:38 -06:00
e9bdb5b96e
Polish SecurityFilterChain Validation
...
Issue gh-15982
2024-12-19 15:04:01 -07:00
1104b45832
Polish SessionLimit
...
- Move to the web.authentication.session package since it is only needed
by web.authentication.session elements and does not access any other web
element itself.
- Add Kotlin support
- Add documentation
Issue gh-16206
2024-12-18 18:32:28 -07:00
1864577e98
Address SessionLimitStrategy
...
Closes gh-16206
2024-12-18 18:32:12 -07:00
3eeb4317f6
Add setFavorRelativeUris
...
This places the new functionality behind a setting so that
we can remain passive until we can change the setting in
the next major release.
Issue gh-7273
2024-12-17 22:35:41 -07:00
7848b959da
Use relative URLs in /login redirects
...
Closes gh-7273
2024-12-17 22:35:41 -07:00
27c2a8ad11
Add Serializable Compatibility to Web Authentication Exceptions
...
Issue gh-16276
2024-12-17 13:05:23 -07:00
d7d5253607
Change attestation in PublicKeyCredentialCreationOptions to none
...
The attestation option in PublicKeyCredentialCreationOptions is a
parameter that controls whether to request attestation from the security key.
However, Spring Security Passkeys currently doesn't implement attestation verification.
Therefore, requesting attestation is unnecessary.
Specifying `direct` to request attestation may trigger browsers to
display additional privacy related dialog to users, so it is best to
avoid specifying `direct` unnecessarily.
2024-12-11 17:18:18 -06:00
cb4c7e5886
Merge branch '6.3.x'
...
Closes gh-16261
2024-12-11 15:48:18 -06:00
6a0b683e60
StrictFirewallHttpRequest.buid returns StrictFirewallHttpRequest
...
Closes gh-16069
2024-12-11 15:46:31 -06:00
4cbaabb239
Added Testing
...
Issue gh-16177
2024-12-10 14:09:46 -07:00
f565b23b51
Restore Method Parameter Inheritance Support
...
Closes gh-16177
2024-12-10 14:09:46 -07:00
d39e329234
Add @inheritDoc to sessionIdChanged method
...
Closes gh-16211
2024-12-05 12:31:47 -07:00
d3a95c5c1e
Merge branch '6.3.x'
2024-12-05 09:52:55 -07:00
0f85da77be
Merge branch '6.2.x' into 6.3.x
...
Closes gh-16219
2024-12-05 09:52:32 -07:00
96a9cf0d2d
Restore Previous Behavior for Servlet 5
...
Closes gh-16173
2024-12-05 09:52:06 -07:00
9c3b11914d
webauthn registerCredential returns transports
...
The webauthn support previously did not pass the transports to webauthn4j.
This meant that the result of
Webauthn4jRelyingPartyOperations.registerCredential did not have any
transports either.
This commit ensures that the transports are passed to the webauth4j lib
and then returned in the result of registerCredential.
Closes gh-16084
2024-12-04 15:22:26 -06:00
dc82a6e97e
Remove the cache since UniqueSecurityAnnotationScanner has cached annotations internally
2024-12-04 09:18:12 -07:00
46fe0124ba
Add RuntimeHints for webauthn Javascript resource
2024-11-25 13:06:50 -06:00
c2cfe92a02
Merge branch '6.3.x'
2024-11-18 05:16:16 -05:00
fa5fc6dd62
Fix checkstyle errors for toLower/toUpperCase usage
2024-11-18 04:56:17 -05:00
709103e38c
Merge branch '6.2.x' into 6.3.x
2024-11-18 04:45:38 -05:00
a8c4d6cead
Require Locale argument for toLower/toUpperCase usage
2024-11-18 04:22:26 -05:00
285d16b046
Polish IpAddressMatcher
...
(cherry picked from commit 83a79159b8
2024-11-15 10:17:39 -06:00
ddf4542a9e
Add hasText assertion to IpAddressMatcher constructor
...
Issue gh-15527
(cherry picked from commit 3a29819651
2024-11-15 10:17:39 -06:00
554df6fab6
Fix NPE in IpAddressMatcher
...
Closes gh-15527
(cherry picked from commit 52de894c3c
2024-11-15 10:17:38 -06:00
83a79159b8
Polish IpAddressMatcher
2024-11-15 09:33:31 -06:00
3a29819651
Add hasText assertion to IpAddressMatcher constructor
...
Issue gh-15527
2024-11-15 09:33:31 -06:00
52de894c3c
Fix NPE in IpAddressMatcher
...
Closes gh-15527
2024-11-15 09:33:30 -06:00
a1526361b6
webauthn: introduce DefaultResourcesFilter#webauthn
2024-11-14 12:11:43 -06:00
8f1c892fb7
Remove unnecessary parentheses and add static final field
2024-11-13 15:06:58 -06:00
055ec57737
Fix not exist class in WebFilterChainProxy java doc
2024-11-07 13:03:49 -07:00
f46e56de78
Improve Error Message for Conflicting Filter Chains
...
Closes gh-15874
2024-11-07 13:01:16 -07:00
571c7c81a4
Fix typo
2024-11-04 10:23:38 -06:00
ab93541926
Simplify condition in some methods
2024-10-25 13:42:33 -07:00
e76de931ce
Polish Optional usage
2024-10-25 13:42:33 -07:00
ffed4ea1dc
Polish diamond usage
2024-10-25 13:42:33 -07:00
981fbd5c2c
Polish Tests
...
Closes gh-14768
2024-10-24 20:51:34 -07:00
6dbbe89b83
Merge remote-tracking branch 'origin/6.3.x'
2024-10-24 21:48:10 -06:00
308e408b13
Polish DelegatingAuthenticationConverter
2024-10-24 20:47:46 -07:00
cf03f2fed9
Merge branch '6.3.x'
2024-10-24 11:57:13 -06:00
5048a68ab7
Merge branch '6.2.x' into 6.3.x
...
Closes gh-15986
2024-10-24 11:56:41 -06:00
addc7c53b2
Merge branch '5.8.x' into 6.2.x
...
Closes gh-15985
2024-10-24 11:56:16 -06:00
1399a82ea9
Return Null Request When Cookie Is Malformed
...
Closes gh-15905
2024-10-24 10:55:36 -07:00
fc5719d8d6
Merge branch '6.3.x'
...
Add Firewall for WebFlux
Closes gh-15967
2024-10-21 12:11:42 -05:00
ec38848b20
Fix invalid windows character
2024-10-21 11:34:56 -04:00
1528c421bd
Merge branch '6.2.x' into 6.3.x
...
Add Firewall for WebFlux
Closes gh-15967
2024-10-21 09:43:48 -05:00
0e257b56ce
Add Firewall for WebFlux
...
Closes gh-15967
2024-10-21 09:42:24 -05:00
542071b1f8
Merge Add Firewall for WebFlux
...
Closes gh-15967
2024-10-21 08:56:42 -05:00
4ce7cde155
Add Firewall for WebFlux
...
Closes gh-15967
2024-10-21 08:46:13 -05:00
f689257dc4
Fix unused import
2024-10-21 00:28:57 -05:00
8a0a5e2647
Format
2024-10-21 00:17:51 -05:00
c461abd5da
Remove unnecessary WebauthnJackson2Module usage
...
HttpMessageConverterAuthenticationSuccessHandler does not need to use
WebauthnJacksonModule
2024-10-21 00:16:31 -05:00
6d7df007dd
Remove non-ascii characters
...
Attempt fix windows format error
2024-10-21 00:15:58 -05:00
5736f0897e
Remove imports for Javadoc Only Usage
2024-10-21 00:08:12 -05:00
0bb406aaab
Run format again
2024-10-20 23:35:50 -05:00
7f26e54d07
Remove §
...
See if this fixes format in windows
2024-10-20 23:30:40 -05:00
b0e8730d70
Add Passkeys Support
...
Closes gh-13305
2024-10-20 22:54:53 -05:00
472c315ac3
Add Since to setSessionAuthenticaitonStrategy
...
Issue gh-2253
2024-10-15 15:09:36 -06:00
7f537241e7
Use SessionAuthenticationStrategy for Remember-Me authentication
...
Closes gh-2253
2024-10-15 14:07:07 -07:00
d37d41c130
Polish One-Time Token API Names and Doc
...
The names of variables and methods have been adjusted in accordance with the names of the one-time token login API components.
Issue gh-15114
2024-10-15 14:04:56 -07:00
c40334317d
Polish One-Time Token Component Names
...
Aligning parts of speech so that names are using nouns/verbs
where comparable components are using nouns/verbs.
Issue gh-15114
2024-10-14 14:07:47 -06:00
b8aa78829c
Improve readability of empty collection checks
2024-10-14 12:16:39 -07:00
31bdaf720d
Remove redundant keyword
2024-10-14 11:51:35 -07:00
31f8caec5f
Polish diamond operator usage
2024-10-14 11:51:35 -07:00
9ce5a76e8c
Polish AuthorizationManager#authorize
...
Issue gh-14843
2024-10-14 11:48:57 -07:00
e7644925f8
Add AuthorizationResult support for AuthorizationManager
...
Closes gh-14843
2024-10-14 11:48:57 -07:00
702538ebce
AuthorizationEventPublisher Accepts AuthorizationResult
...
Closes gh-15915
Co-authored-by: Max Batischev <mblancer@mail.ru>
2024-10-14 11:48:57 -07:00
b26f2af5d5
Polish
...
Formatting as well as adding a missing defer
Issue gh-15699
2024-10-07 16:39:54 -07:00
2ca2e56383
Add Reactive One-Time Token Login support
...
Closes gh-15699
2024-10-07 16:39:54 -07:00
de104e22b7
Update javaDoc for DefaultOneTimeTokenSubmitPageGeneratingFilter
2024-10-02 15:31:43 -05:00
7fcb42b537
Fix typo of createDefaultRequestMacher in WebSessionServerRequestCache
...
createDefaultRequestMacher -> createDefaultRequestMatcher
2024-09-30 15:24:40 -07:00
a88a7744ed
Require GeneratedOneTimeTokenHandler on constructor
...
Issue gh-15114
2024-09-17 08:21:26 -03:00
7e41785dfc
Remove trailing spaces in default UIs
...
- Default UIs had blank lines with only spaces. These get deleted by the
spring-javaformat plugin. In order to avoid this behavior, an extra \s
had been inserted in the tests. The reason for those \s is not obvious.
- This commit cleans up the \s but changing the HTML templates.
2024-09-11 10:44:45 -07:00
98975a9b83
Add runtime hints for CSS resource
2024-09-10 12:46:13 -07:00
2405a5b680
Remove CssUtils
2024-09-10 12:46:13 -07:00
c1b9035544
Use static CSS in OneTimeToken default UI
2024-09-10 12:46:13 -07:00
e958ff2d4a
Use static CSS in reactive default UI
2024-09-10 12:46:13 -07:00
45d53973ab
Serve static content (css, js) for reactive default UIs from DefaultResourcesWebFilter
2024-09-10 12:46:13 -07:00
11616a1d78
Use static CSS in servlet default UI
2024-09-10 12:46:13 -07:00
c5c5cd5ed0
Serve static content (css, js) for default UIs from DefaultResourcesFilter
2024-09-10 12:46:13 -07:00
2ff29dc229
Throw AuthorizationDeniedException when AuthorizationResult is available
...
Closes gh-15706
2024-09-10 09:14:50 -03:00
4660e042d9
Remove unused <script> and <noscript> tags in One-Time-Token submit page
2024-09-06 09:13:30 -03:00
528d739a60
Use contextPath in One-Time-Token default submit UI
2024-09-06 09:13:30 -03:00
ef31ae1a98
Render One Time Token UIs using lightweight templates
2024-09-05 15:02:42 -07:00
a642a1bb66
Render reactive default UIs using lightweight templates
2024-09-05 15:02:42 -07:00
8d47906191
Render default UIs using lightweight templates
2024-09-05 15:02:42 -07:00
33495441b5
Hardcode ott-username input name in DefaultLoginPageGeneratingFilter
...
- GenerateOneTimeTokenFilter uses `"username"`, the default UI should use the same parameter name
2024-09-05 09:42:45 -03:00
00e4a8fb54
Add support for One-Time Token Login
...
Closes gh-15114
2024-09-03 10:07:56 -03:00
5c56bddbdd
Polish log message
2024-09-03 09:43:37 -03:00
008cbc2cae
Add cookie customizer to CookieRequestCache and CookieServerRequestCache
...
Issue gh-15204
2024-09-03 09:41:30 -03:00
626610a975
Polish Annotation API
...
Rename to a class that isn't focused on the synthesis implementation detail.
Also add Security to the front of the name to clarify that it is only intended
for security annotations, reminiscent of SecurityMetadataSource.
Refine method signatures to better articulate supported use cases.
Issue gh-15286
2024-08-30 08:51:49 -06:00
095929f6e8
Include FilterChain in SessionInformationExpiredEvent
...
Closes gh-14077
2024-08-29 13:12:27 -03:00
ed16c86115
Improve @CurrentSecurityContext meta-annotations
...
Closes gh-15551
2024-08-13 13:18:15 -06:00
08b8b09066
Update Copyright
...
Issue gh-15286
2024-08-10 11:48:14 -06:00
2c02d8aec7
Update Copyright
2024-08-10 11:46:51 -06:00
9aaf959400
Improve @AuthenticationPrincipal meta-annotations
...
Closes gh-15286
2024-08-10 11:46:51 -06:00
bc8ba7f3b7
Inline CSS for default login and logout page
...
- Remove the dependency on Bootstrap CSS. Results in faster load times, no failures
in air-gapped or offline scenarios, and no dependency on an external CDN that may
go away some day.
2024-08-05 09:27:18 -05:00
4169c0cf36
Publish Constants for Firewall Header and Parameter Predicates
...
Introduced public static final Predicates for allowed header names,
header values, parameter names, and parameter values for building
expressions.
Closes gh-13639
2024-07-18 17:24:38 -07:00
773e86701e
Add ParameterRequestMatcher
...
Closes gh-15342
2024-07-02 15:17:54 -06:00
9f0b2a29ee
Merge branch '6.3.x'
2024-07-01 11:43:19 -06:00
8917cdb404
Improve Performance of IPv4 Check
...
Closes gh-15324
2024-07-01 11:40:28 -06:00
44f9396bad
Add support remember-me cookie customization
...
Closes gh-14990
2024-06-05 11:47:20 -03:00
1e4aff2bdb
Merge branch '6.2.x' into 6.3.x
...
Closes gh-15186
2024-05-31 19:02:31 -05:00
3fc7b6e921
Merge branch '5.8.x' into 6.2.x
...
Closes gh-15185
2024-05-31 18:34:14 -05:00
dcb8c563e8
Fix ArrayIndexOutOfBoundsException
...
Issue gh-13310
Closes gh-15184
2024-05-31 18:12:21 -05:00
7288fecc24
Verify ipAddress Not A Hostname
...
Closes gh-15172
2024-05-30 17:50:56 -06:00
6956ed693c
Polish DefaultSecurityFilterChain Logs
...
Reuse String manipulation logic in Spring Framework
Compress whitespace
Closes gh-15096
2024-05-23 12:20:14 -06:00
ac9bdf5cbf
Change DefaultSecurityFilterChain logging to DEBUG level and simplify filter log
...
- Change DefaultSecurityFilterChain logging level from INFO to DEBUG to align with FilterChainProxy.
- Log filter class names instead of the toString() of filter.
2024-05-23 12:02:35 -06:00
0acf6cca6e
Merge branch '6.2.x'
...
Closes gh-15149
2024-05-23 14:05:06 -03:00
47ad405063
Merge branch '5.8.x' into 6.2.x
...
Closes gh-15148
2024-05-23 14:04:35 -03:00
c7b739eb3f
Fix broken link to jaspan article
...
Closes gh-14358
2024-05-23 14:04:10 -03:00
927840fe88
Do Not Invalidate Current Session When It Is Registered
...
Closes gh-15066
2024-05-14 10:01:54 -03:00
08f11f06ab
Revert unnecessary commits from main
...
Issue gh-15016
2024-05-08 13:49:18 -03:00
b3c7f3ff19
Rename CompromisedPasswordCheckResult to CompromisedPasswordDecision
...
Issue gh-7395
2024-04-30 08:38:03 -03:00
36cd48474d
Merge branch '6.2.x'
2024-04-17 17:01:24 -06:00
3887f33f81
Merge branch '6.1.x' into 6.2.x
2024-04-17 17:01:03 -06:00
61df8e493d
Merge branch '5.8.x' into 6.1.x
2024-04-17 17:00:24 -06:00
470e2c5c97
Address Build Issues
...
Issue gh-14837
2024-04-17 16:59:40 -06:00
ff473313df
Merge branch '6.2.x'
2024-04-17 16:45:47 -06:00
f16a434f0c
Merge branch '6.1.x' into 6.2.x
...
Closes gh-14922
2024-04-17 16:45:30 -06:00
ade45771b2
Merge branch '5.8.x' into 6.1.x
...
Closes gh-14921
2024-04-17 16:44:50 -06:00
657760af5b
Improve Logging
...
Closes gh-14837
2024-04-17 16:43:29 -06:00
61eba00654
Move HaveIBeenPwnedRestApiPasswordChecker to spring-security-web
...
Prior to this commit, the implementation was placed in spring-security-core, however we do not want to introduce a dependency on spring-web and spring-webflux for that module.
Issue gh-7395
2024-04-10 14:58:01 -03:00
f689f3c3fc
Fix continueOnError default value in java doc
...
Closes gh-14870
2024-04-10 13:28:06 -03:00
7faae83ebb
docs: fix typo
2024-04-08 14:44:12 -03:00
c439cfef0f
Merge branch '6.1.x' into 6.2.x
2024-03-21 17:24:34 -06:00
ce9f1821b1
Improve logging in AuthenticationWebFilter
...
Closes #14091
2024-03-21 17:24:10 -06:00
091976fffb
Improve logging in AuthenticationWebFilter
...
Closes #14091
2024-03-21 17:22:35 -06:00
c0928bf198
Add DelegatingAuthenticationConverter
...
Closes gh-14644
2024-03-13 14:33:45 -06:00
8885707674
Add DelegatingServerAuthenticationConverter
...
Closes gh-14644
2024-03-05 08:21:59 -07:00
bd345fb2a8
Polish gh-11758
2024-02-29 12:15:30 -06:00
5c5503924b
Add SwitchUserGrantedAuthorityMixIn
...
Closes gh-11775
2024-02-29 11:07:21 -06:00
f8ff056eb6
Update Max Sessions on WebFlux
...
Delete WebSessionStoreReactiveSessionRegistry.java and gives the responsibility to remove the sessions from the WebSessionStore to the handler
Issue gh-6192
2024-02-28 10:06:45 -03:00
a5ce8ae87f
Polish Max Sessions on WebFlux
...
This commit changes the PreventLoginServerMaximumSessionsExceededHandler to invalidate the WebSession in addition to throwing the error, this is needed otherwise the session would still be saved with the security context. It also changes the SessionRegistryWebSession to first perform the operation on the delegate and then invoke the needed method on the ReactiveSessionRegistry
Issue gh-6192
2024-02-27 11:12:50 -03:00
4d039e515f
Merge branch '6.2.x'
2024-02-22 13:21:22 -07:00
9c48546883
Merge branch '6.1.x' into 6.2.x
2024-02-22 13:21:14 -07:00
7f106f0419
Merge branch '5.8.x' into 6.1.x
2024-02-22 13:20:29 -07:00
5f80468de3
Updated copyright date
2024-02-22 13:19:05 -07:00
2f762fefe1
Allow tab in HTTP header values.
...
Closes gh-14573
2024-02-22 13:19:05 -07:00
21580fd27d
Merge branch '6.2.x'
2024-02-16 13:31:20 -03:00
15306c1007
Merge branch '6.1.x' into 6.2.x
2024-02-16 13:21:15 -03:00
750cb30ce4
Add AuthenticationTrustResolver.isAuthenticated
2024-02-16 13:08:29 -03:00
aa8178af65
Merge branch '6.2.x'
2024-02-07 08:53:16 -07:00
0cadabfa89
Merge branch '6.1.x' into 6.2.x
...
Closes gh-14568
2024-02-07 08:52:47 -07:00
75fdcd10f7
Use synchronized
...
Closes gh-14445
2024-02-07 08:48:49 -07:00
915d68e216
Remove includeExpiredSessions parameter
...
The reactive implementation of max sessions does not keep track of expired sessions, therefore we do not need such parameter
Issue gh-6192
2024-02-06 10:43:00 -03:00
c1adeef0da
Add validation IpAddressMatcher
...
Closes gh-13621
2024-01-30 17:16:18 -07:00
6e1bcfed11
Add argument resolver for SecurityContext
...
Closes gh-13425
2024-01-29 17:30:38 -07:00
a808c139ad
Enhance IpAddressMatcher performance
...
Closes gh-14493
Signed-off-by: ahmd-nabil <ahm3dnabil99@gmail.com>
2024-01-29 17:28:19 -07:00
6df9ef5ba6
Fix wrong class name in JavaDoc
...
In the `ServerWebExchangeDelegatingReactiveAuthenticationManagerResolver.Builder` class the JavaDoc comments mention the wrong class name. This commit fixes this.
2024-01-19 09:29:07 -07:00
06278157fa
Merge branch '6.2.x'
...
Closes gh-14471
2024-01-17 16:16:40 -03:00
148e0b41d2
Merge branch '6.1.x' into 6.2.x
...
Closes gh-14470
2024-01-17 16:16:27 -03:00
ce5f5e6e33
Add native hint for CsrfTokenRequestAttributeHandler$SupplierCsrfToken
...
Closes gh-14397
2024-01-17 16:14:59 -03:00
d7a9a19161
Merge branch '6.2.x'
2023-12-18 11:47:39 -07:00
03e48905c7
Merge branch '6.1.x' into 6.2.x
...
Closes gh-14346
2023-12-18 11:47:23 -07:00
b855ccdb09
Merge branch '5.8.x' into 6.1.x
...
Closes gh-14345
2023-12-18 11:46:04 -07:00
eaaa813ede
Fix header value typo
...
Closes gh-11948
2023-12-18 10:42:50 -07:00
8a34e32a24
Polish IpAddressAuthorizationManager
...
Closes gh-10577
2023-12-15 16:54:58 -07:00
ea7c720ce7
Add hasIpAddress to Kotlin DSL
...
Closes gh-10577
2023-12-15 16:54:58 -07:00
465642828a
Merge branch '6.2.x'
...
Add HandlerMappingIntrospector Caching
Closes gh-14333
2023-12-14 16:11:08 -06:00
6dd29520b0
Merge branch '6.1.x' into 6.2.x
...
Add HandlerMappingIntrospector Caching
Closes gh-14332
2023-12-14 16:10:50 -06:00
70dfb3d391
Add HandlerMappingIntrospector Caching
...
Closes gh-14128
2023-12-14 16:08:36 -06:00
57ab15127a
Add Max Sessions on WebFlux
...
Closes gh-6192
2023-12-11 09:48:34 -03:00
cad6689659
Merge remote-tracking branch 'origin/6.1.x'
2023-11-15 09:28:28 -07:00
187ef0e1a8
Merge branch '6.0.x' into 6.1.x
...
Closes gh-14146
2023-11-15 09:26:59 -07:00
18530c8dcd
Add PhasedObservation
...
Observation itself does not protect against start and stop being called
multiple times. This commit aligns all observation instances to instead
use an implementation that does have these guards in place.
Closes gh-14082
2023-11-15 09:22:41 -07:00
e920bfb3a2
Merge branch '6.1.x'
...
Closes gh-14138
2023-11-14 10:56:57 -03:00
921afba134
Use addCookie instead of addHeader in CookieCsrfTokenRepository
...
By using addCookie we make sure that configured Tomcat's CookieProcessors are invoked
Closes gh-14131
2023-11-14 10:56:24 -03:00
621ab3e7cb
Merge remote-tracking branch 'origin/6.1.x'
2023-11-07 17:33:09 -07:00
bcef8f98aa
Merge branch '6.0.x' into 6.1.x
...
Closes gh-14117
2023-11-07 17:32:51 -07:00
4990373cf9
Merge branch '5.8.x' into 6.0.x
...
Closes gh-14116
2023-11-07 17:22:36 -07:00
52675c80b3
Check For Null Exception Message
...
Closes gh-13768
2023-11-07 17:19:35 -07:00
d0a5ada2da
Fix formatting
2023-10-31 15:38:44 -05:00
447f40949c
Revert unnecessary merges on 6.1.x
...
This commit removes unnecessary main-branch merges starting from
9f8db22b774d6ff49b9ded6ff670d1c823b0079444fad21363
2023-10-31 15:22:15 -05:00
9db33f33c7
Revert unnecessary merges on 6.0.x
...
This commit removes unnecessary main-branch merges starting from
8750608b5b5dce82c48b
2023-10-31 15:11:45 -05:00
318dec845a
Update obsolete comment reference (former name of the class)
2023-10-31 09:48:43 -03:00
ed6ff670d1
Add Test
...
Issue gh-13660
2023-10-30 17:49:58 -06:00
4d6ff49b9d
Removed dash from micrometer metric label
...
Closes gh-13660
2023-10-30 17:49:58 -06:00
5dce82c48b
Close Both Observations
...
Depending on when a request is cancelled, the before and after observation
starts and stops may be called out of order due to the order in
which their doOnCancel handlers are invoked.
To address this, the before filter-wrapper now always closes both the
before observation and the after observation. Since the before filter-
wrapper wraps the entire request, this ensures that either that was
started is stopped, and either that has not been started yet cannot
inadvertently be started by any unexpected ordering of events that
follows.
Closes gh-14031
2023-10-30 16:32:11 -06:00
d9399dfda0
Allow redirect status code to be customized
...
Closes gh-12797
2023-10-16 13:55:52 -06:00
2638555e53
Allow redirect strategy to be customized
...
Closes gh-12795
2023-10-16 13:55:52 -06:00
7e9d707c7d
Allow customize the AuthenticationConverter in BasicAuthenticationFilter
...
Closes gh-13988
2023-10-11 08:42:45 -03:00
cef882b84e
Merge branch '6.1.x'
2023-10-02 18:11:50 -06:00
d8eadd2207
Replace deprecated method
...
Replace HttpMethod.resolve() to HttpMethod.valueOf()
2023-10-02 17:49:39 -06:00
07b6c451fd
Merge branch '6.1.x'
...
Closes gh-13884
2023-09-29 11:47:38 -03:00
8adfc9b463
Merge branch '6.0.x' into 6.1.x
...
Closes gh-13883
2023-09-29 11:46:48 -03:00
92c82191c9
Merge branch '5.8.x' into 6.0.x
...
Closes gh-13882
2023-09-29 11:46:00 -03:00
64e2a2ff8b
Apply updated Code Style
...
Closes gh-13881
2023-09-29 11:44:32 -03:00
ff374935fb
Verify ReactorContext when using Virtual Threads
...
Closes gh-12791
2023-09-25 12:01:31 -05:00
ecf8467cac
Fix tests on JDK 21
...
Issue gh-12790
Issue gh-13811
2023-09-19 10:39:04 -05:00
d48b8697bd
Fix mockito usage
...
Issue gh-13810
2023-09-19 10:39:04 -05:00
d6ff58bb7f
Update Mockito to 5.5.0
...
Closes gh-13810
2023-09-19 10:39:03 -05:00
a052e2effb
Merge branch '6.1.x'
...
Closes gh-13821
2023-09-14 21:26:05 +01:00
7fcf44f8d9
Merge branch '6.0.x' into 6.1.x
...
Closes gh-13820
2023-09-14 21:25:48 +01:00
18e88366d2
Resolve The matchingRequestParameterName From The Query String
...
Prior to this commit, the ServletRequest#getParameter method was used in order to verify if the matchingRequestParameterName was present in the request. That method has some side effects like interfering in the execution of the ServletRequest#getInputStream and ServletRequest#getReader method when the request is an HTTP POST (if those methods are invoked after getParameter, or vice-versa, the content won't be available). This commit makes that we only use the query string to check for the parameter, avoiding draining the request's input stream.
Closes gh-13731
2023-09-14 21:25:25 +01:00
2a1cf98b80
Update Copyright and Formatting
...
Issue gh-13615
2023-09-12 16:20:28 -06:00
5e715c5297
Improve StrictHttpFirewall Error Messaging
...
Better error strings for invalid header and parameter values.
Closes gh-13615
2023-09-12 16:20:28 -06:00
9df9cb5aed
refactor: AssertJ best practices
...
Use this link to re-run the recipe: https://app.moderne.io/recipes/builder/bGVuS?organizationId=RGVmYXVsdA%3D%3D
Co-authored-by: Moderne <team@moderne.io>
2023-09-12 16:18:14 -06:00
Josh Cummings
topiam
Rob Winch
Steve Riesenberg
Max Batischev
Borghi
tejas-teju
ying.li
Daniel Garnier-Moiroux
Craig Andrews
NeoTraveler
earlgrey02
Tran Ngoc Nhan
DingHao
Claudenir Machado
Michal Okosy
Yoshikazu Nojima
12OneTwo12
Joe Grandja
nomoreFt
Josh Cummings
xhaggi
kwonyonghyun
John Niang
Marcus Hert Da Coregio
Florian Bernard
Ilpyo-Yang
baezzys
Max Batischev
Joaquin Santana
erie0210
Thomas Hagelberg
Markus Heiden
Christian Becker
Rob Winch
Federico Herrera
Nermin Karapandzic
ahmd-nabil
sonallux
brunodmartins
Steve Riesenberg
Martin Lukas
Duje
Mark Chesney
Seongguk Jeong
Bjorn Harvold
Tim te Beek