root
/
spring-security
mirror of https://github.com/spring-projects/spring-security.git
1
0
Fork 0
Code Issues Actions 5 Packages Projects Releases Wiki Activity
17,158 Commits 38 Branches 345 Tags 115 MiB
Commit Graph

1815 Commits

Author SHA1 Message Date
Joaquin Santana 927840fe88 Do Not Invalidate Current Session When It Is Registered 
Closes gh-15066
 2024-05-14 10:01:54 -03:00
Marcus Hert Da Coregio 08f11f06ab Revert unnecessary commits from main 
Issue gh-15016
 2024-05-08 13:49:18 -03:00
Marcus Hert Da Coregio b3c7f3ff19 Rename CompromisedPasswordCheckResult to CompromisedPasswordDecision 
Issue gh-7395
 2024-04-30 08:38:03 -03:00
Josh Cummings 36cd48474d
Merge branch '6.2.x' 2024-04-17 17:01:24 -06:00
Josh Cummings 3887f33f81
Merge branch '6.1.x' into 6.2.x 2024-04-17 17:01:03 -06:00
Josh Cummings 61df8e493d
Merge branch '5.8.x' into 6.1.x 2024-04-17 17:00:24 -06:00
Josh Cummings 470e2c5c97
Address Build Issues 
Issue gh-14837
 2024-04-17 16:59:40 -06:00
Josh Cummings ff473313df
Merge branch '6.2.x' 2024-04-17 16:45:47 -06:00
Josh Cummings f16a434f0c
Merge branch '6.1.x' into 6.2.x 
Closes gh-14922
 2024-04-17 16:45:30 -06:00
Josh Cummings ade45771b2
Merge branch '5.8.x' into 6.1.x 
Closes gh-14921
 2024-04-17 16:44:50 -06:00
Josh Cummings 657760af5b
Improve Logging 
Closes gh-14837
 2024-04-17 16:43:29 -06:00
Marcus Hert Da Coregio 61eba00654 Move HaveIBeenPwnedRestApiPasswordChecker to spring-security-web 
Prior to this commit, the implementation was placed in spring-security-core, however we do not want to introduce a dependency on spring-web and spring-webflux for that module.

Issue gh-7395
 2024-04-10 14:58:01 -03:00
DingHao f689f3c3fc Fix continueOnError default value in java doc 
Closes gh-14870
 2024-04-10 13:28:06 -03:00
erie0210 7faae83ebb docs: fix typo 2024-04-08 14:44:12 -03:00
Josh Cummings c439cfef0f
Merge branch '6.1.x' into 6.2.x 2024-03-21 17:24:34 -06:00
Thomas Hagelberg ce9f1821b1
Improve logging in AuthenticationWebFilter 
Closes #14091
 2024-03-21 17:24:10 -06:00
Thomas Hagelberg 091976fffb Improve logging in AuthenticationWebFilter 
Closes #14091
 2024-03-21 17:22:35 -06:00
ruabtmh c0928bf198 Add DelegatingAuthenticationConverter 
Closes gh-14644
 2024-03-13 14:33:45 -06:00
DingHao 8885707674 Add DelegatingServerAuthenticationConverter 
Closes gh-14644
 2024-03-05 08:21:59 -07:00
Steve Riesenberg bd345fb2a8
Polish gh-11758 2024-02-29 12:15:30 -06:00
Markus Heiden 5c5503924b
Add SwitchUserGrantedAuthorityMixIn 
Closes gh-11775
 2024-02-29 11:07:21 -06:00
Marcus Hert Da Coregio f8ff056eb6 Update Max Sessions on WebFlux 
Delete WebSessionStoreReactiveSessionRegistry.java and gives the responsibility to remove the sessions from the WebSessionStore to the handler

Issue gh-6192
 2024-02-28 10:06:45 -03:00
Marcus Hert Da Coregio a5ce8ae87f Polish Max Sessions on WebFlux 
This commit changes the PreventLoginServerMaximumSessionsExceededHandler to invalidate the WebSession in addition to throwing the error, this is needed otherwise the session would still be saved with the security context. It also changes the SessionRegistryWebSession to first perform the operation on the delegate and then invoke the needed method on the ReactiveSessionRegistry

Issue gh-6192
 2024-02-27 11:12:50 -03:00
Josh Cummings 4d039e515f
Merge branch '6.2.x' 2024-02-22 13:21:22 -07:00
Josh Cummings 9c48546883
Merge branch '6.1.x' into 6.2.x 2024-02-22 13:21:14 -07:00
Josh Cummings 7f106f0419
Merge branch '5.8.x' into 6.1.x 2024-02-22 13:20:29 -07:00
Christian Becker 5f80468de3 Updated copyright date 2024-02-22 13:19:05 -07:00
Christian Becker 2f762fefe1 Allow tab in HTTP header values. 
Closes gh-14573
 2024-02-22 13:19:05 -07:00
Marcus Hert Da Coregio 21580fd27d Merge branch '6.2.x' 2024-02-16 13:31:20 -03:00
Marcus Hert Da Coregio 15306c1007 Merge branch '6.1.x' into 6.2.x 2024-02-16 13:21:15 -03:00
Rob Winch 750cb30ce4 Add AuthenticationTrustResolver.isAuthenticated 2024-02-16 13:08:29 -03:00
Josh Cummings aa8178af65
Merge branch '6.2.x' 2024-02-07 08:53:16 -07:00
Josh Cummings 0cadabfa89
Merge branch '6.1.x' into 6.2.x 
Closes gh-14568
 2024-02-07 08:52:47 -07:00
Josh Cummings 75fdcd10f7
Use synchronized 
Closes gh-14445
 2024-02-07 08:48:49 -07:00
Marcus Hert Da Coregio 915d68e216 Remove includeExpiredSessions parameter 
The reactive implementation of max sessions does not keep track of expired sessions, therefore we do not need such parameter

Issue gh-6192
 2024-02-06 10:43:00 -03:00
Federico Herrera c1adeef0da Add validation IpAddressMatcher 
Closes gh-13621
 2024-01-30 17:16:18 -07:00
Nermin Karapandzic 6e1bcfed11 Add argument resolver for SecurityContext 
Closes gh-13425
 2024-01-29 17:30:38 -07:00
ahmd-nabil a808c139ad Enhance IpAddressMatcher performance 
Closes gh-14493

Signed-off-by: ahmd-nabil <ahm3dnabil99@gmail.com>
 2024-01-29 17:28:19 -07:00
sonallux 6df9ef5ba6 Fix wrong class name in JavaDoc 
In the `ServerWebExchangeDelegatingReactiveAuthenticationManagerResolver.Builder` class the JavaDoc comments mention the wrong class name. This commit fixes this.
 2024-01-19 09:29:07 -07:00
Marcus Hert Da Coregio 06278157fa Merge branch '6.2.x' 
Closes gh-14471
 2024-01-17 16:16:40 -03:00
Marcus Hert Da Coregio 148e0b41d2 Merge branch '6.1.x' into 6.2.x 
Closes gh-14470
 2024-01-17 16:16:27 -03:00
Marcus Hert Da Coregio ce5f5e6e33 Add native hint for CsrfTokenRequestAttributeHandler$SupplierCsrfToken 
Closes gh-14397
 2024-01-17 16:14:59 -03:00
Josh Cummings d7a9a19161
Merge branch '6.2.x' 2023-12-18 11:47:39 -07:00
Josh Cummings 03e48905c7
Merge branch '6.1.x' into 6.2.x 
Closes gh-14346
 2023-12-18 11:47:23 -07:00
Josh Cummings b855ccdb09
Merge branch '5.8.x' into 6.1.x 
Closes gh-14345
 2023-12-18 11:46:04 -07:00
Josh Cummings eaaa813ede
Fix header value typo 
Closes gh-11948
 2023-12-18 10:42:50 -07:00
Josh Cummings 8a34e32a24 Polish IpAddressAuthorizationManager 
Closes gh-10577
 2023-12-15 16:54:58 -07:00
brunodmartins ea7c720ce7 Add hasIpAddress to Kotlin DSL 
Closes gh-10577
 2023-12-15 16:54:58 -07:00
Rob Winch 465642828a Merge branch '6.2.x' 
Add HandlerMappingIntrospector Caching

Closes gh-14333
 2023-12-14 16:11:08 -06:00
Rob Winch 6dd29520b0 Merge branch '6.1.x' into 6.2.x 
Add HandlerMappingIntrospector Caching

Closes gh-14332
 2023-12-14 16:10:50 -06:00
Rob Winch 70dfb3d391 Add HandlerMappingIntrospector Caching 
Closes gh-14128
 2023-12-14 16:08:36 -06:00
Marcus Da Coregio 57ab15127a Add Max Sessions on WebFlux 
Closes gh-6192
 2023-12-11 09:48:34 -03:00
Josh Cummings cad6689659
Merge remote-tracking branch 'origin/6.1.x' 2023-11-15 09:28:28 -07:00
Josh Cummings 187ef0e1a8
Merge branch '6.0.x' into 6.1.x 
Closes gh-14146
 2023-11-15 09:26:59 -07:00
Josh Cummings 18530c8dcd
Add PhasedObservation 
Observation itself does not protect against start and stop being called
multiple times. This commit aligns all observation instances to instead
use an implementation that does have these guards in place.

Closes gh-14082
 2023-11-15 09:22:41 -07:00
Marcus Hert Da Coregio e920bfb3a2 Merge branch '6.1.x' 
Closes gh-14138
 2023-11-14 10:56:57 -03:00
Marcus Hert Da Coregio 921afba134 Use addCookie instead of addHeader in CookieCsrfTokenRepository 
By using addCookie we make sure that configured Tomcat's CookieProcessors are invoked

Closes gh-14131
 2023-11-14 10:56:24 -03:00
Josh Cummings 621ab3e7cb
Merge remote-tracking branch 'origin/6.1.x' 2023-11-07 17:33:09 -07:00
Josh Cummings bcef8f98aa
Merge branch '6.0.x' into 6.1.x 
Closes gh-14117
 2023-11-07 17:32:51 -07:00
Josh Cummings 4990373cf9
Merge branch '5.8.x' into 6.0.x 
Closes gh-14116
 2023-11-07 17:22:36 -07:00
Josh Cummings 52675c80b3
Check For Null Exception Message 
Closes gh-13768
 2023-11-07 17:19:35 -07:00
Steve Riesenberg d0a5ada2da
Fix formatting 2023-10-31 15:38:44 -05:00
Steve Riesenberg 447f40949c
Revert unnecessary merges on 6.1.x 
This commit removes unnecessary main-branch merges starting from
9f8db22b77 and adds the following
needed commit(s) that were made afterward:

- 4d6ff49b9d
- ed6ff670d1
- c823b00794
- 44fad21363
 2023-10-31 15:22:15 -05:00
Steve Riesenberg 9db33f33c7
Revert unnecessary merges on 6.0.x 
This commit removes unnecessary main-branch merges starting from
8750608b5b and adds the following
needed commit(s) that were made afterward:

- 5dce82c48b
 2023-10-31 15:11:45 -05:00
Martin Lukas 318dec845a Update obsolete comment reference (former name of the class) 2023-10-31 09:48:43 -03:00
Josh Cummings ed6ff670d1 Add Test 
Issue gh-13660
 2023-10-30 17:49:58 -06:00
Duje 4d6ff49b9d Removed dash from micrometer metric label 
Closes gh-13660
 2023-10-30 17:49:58 -06:00
Josh Cummings 5dce82c48b
Close Both Observations 
Depending on when a request is cancelled, the before and after observation
starts and stops may be called out of order due to the order in
which their doOnCancel handlers are invoked.

To address this, the before filter-wrapper now always closes both the
before observation and the after observation. Since the before filter-
wrapper wraps the entire request, this ensures that either that was
started is stopped, and either that has not been started yet cannot
inadvertently be started by any unexpected ordering of events that
follows.

Closes gh-14031
 2023-10-30 16:32:11 -06:00
Mark Chesney d9399dfda0 Allow redirect status code to be customized 
Closes gh-12797
 2023-10-16 13:55:52 -06:00
Mark Chesney 2638555e53 Allow redirect strategy to be customized 
Closes gh-12795
 2023-10-16 13:55:52 -06:00
Marcus Da Coregio 7e9d707c7d Allow customize the AuthenticationConverter in BasicAuthenticationFilter 
Closes gh-13988
 2023-10-11 08:42:45 -03:00
Josh Cummings cef882b84e
Merge branch '6.1.x' 2023-10-02 18:11:50 -06:00
Seongguk Jeong d8eadd2207 Replace deprecated method 
Replace HttpMethod.resolve() to HttpMethod.valueOf()
 2023-10-02 17:49:39 -06:00
Marcus Da Coregio 07b6c451fd Merge branch '6.1.x' 
Closes gh-13884
 2023-09-29 11:47:38 -03:00
Marcus Da Coregio 8adfc9b463 Merge branch '6.0.x' into 6.1.x 
Closes gh-13883
 2023-09-29 11:46:48 -03:00
Marcus Da Coregio 92c82191c9 Merge branch '5.8.x' into 6.0.x 
Closes gh-13882
 2023-09-29 11:46:00 -03:00
Marcus Da Coregio 64e2a2ff8b Apply updated Code Style 
Closes gh-13881
 2023-09-29 11:44:32 -03:00
Steve Riesenberg ff374935fb
Verify ReactorContext when using Virtual Threads 
Closes gh-12791
 2023-09-25 12:01:31 -05:00
Steve Riesenberg ecf8467cac
Fix tests on JDK 21 
Issue gh-12790
Issue gh-13811
 2023-09-19 10:39:04 -05:00
Steve Riesenberg d48b8697bd
Fix mockito usage 
Issue gh-13810
 2023-09-19 10:39:04 -05:00
Steve Riesenberg d6ff58bb7f
Update Mockito to 5.5.0 
Closes gh-13810
 2023-09-19 10:39:03 -05:00
Marcus Da Coregio a052e2effb Merge branch '6.1.x' 
Closes gh-13821
 2023-09-14 21:26:05 +01:00
Marcus Da Coregio 7fcf44f8d9 Merge branch '6.0.x' into 6.1.x 
Closes gh-13820
 2023-09-14 21:25:48 +01:00
Marcus Da Coregio 18e88366d2 Resolve The matchingRequestParameterName From The Query String 
Prior to this commit, the ServletRequest#getParameter method was used in order to verify if the matchingRequestParameterName was present in the request. That method has some side effects like interfering in the execution of the ServletRequest#getInputStream and ServletRequest#getReader method when the request is an HTTP POST (if those methods are invoked after getParameter, or vice-versa, the content won't be available). This commit makes that we only use the query string to check for the parameter, avoiding draining the request's input stream.

Closes gh-13731
 2023-09-14 21:25:25 +01:00
Josh Cummings 2a1cf98b80 Update Copyright and Formatting 
Issue gh-13615
 2023-09-12 16:20:28 -06:00
Bjorn Harvold 5e715c5297 Improve StrictHttpFirewall Error Messaging 
Better error strings for invalid header and parameter values.

Closes gh-13615
 2023-09-12 16:20:28 -06:00
Tim te Beek 9df9cb5aed refactor: AssertJ best practices 
Use this link to re-run the recipe: https://app.moderne.io/recipes/builder/bGVuS?organizationId=RGVmYXVsdA%3D%3D

Co-authored-by: Moderne <team@moderne.io>
 2023-09-12 16:18:14 -06:00
Marcus Da Coregio 36a488a360 Merge branch '6.1.x' 
Closes gh-13797
 2023-09-12 16:22:31 +01:00
Marcus Da Coregio b80a1de9fa Merge branch '6.0.x' into 6.1.x 
Closes gh-13796
 2023-09-12 16:22:04 +01:00
Marcus Da Coregio db37bdfe94 Merge branch '5.8.x' into 6.0.x 
Closes gh-13795
 2023-09-12 16:21:48 +01:00
Marcus Da Coregio ce012a4661 CookieRequestCache Should Preserve Request Locale 
Closes gh-13792
 2023-09-12 16:21:27 +01:00
Marcus Da Coregio d23b231ac3 Merge branch '6.1.x' 
Closes gh-13760
 2023-08-31 10:16:30 -03:00
Marcus Da Coregio b64d5395c5 Merge branch '6.0.x' into 6.1.x 
Closes gh-13759
 2023-08-31 10:16:07 -03:00
Marcus Da Coregio 629540f9d8 Merge branch '5.8.x' into 6.0.x 
Closes gh-13758
 2023-08-31 10:12:59 -03:00
Marcus Da Coregio 96d1763fc4 WWW-Authenticate header should not be added twice 
Closes gh-13737
 2023-08-31 10:07:10 -03:00
Josh Cummings 0d70a7f508
Merge branch '6.1.x' 
Closes gh-13748
 2023-08-28 17:04:25 -06:00
Josh Cummings a4d8c62ad7
withHttpOnlyCookie defaults to false 
Closes gh-13659
 2023-08-28 16:58:28 -06:00
Steve Riesenberg 985e569685
Polish gh-13608 2023-08-10 17:30:54 -05:00
Olivier Vanekem 6353d90047
Add integrity attribute for signin.css 
Closes gh-13486
 2023-08-10 17:30:52 -05:00
Josh Cummings 82c0ddc56d Polish 
- Add Reactive equivalent
- Update copyright

Issue gh-13310
 2023-08-07 17:57:02 -06:00
Kevin2Jordan e21da061d3 Suppress ArrayIndexOutOfBoundsException in XorCsrfTokenRequestAttributeHandler 
Closes gh-13310
 2023-08-07 17:57:02 -06:00
Josh Cummings 75e0068925
Merge branch '6.1.x' 2023-08-07 16:03:55 -06:00
Seongguk Jeong bcd4dcc15c Refactor equals method 
Using the accessor method for fields instead of directly access
 2023-08-07 16:00:18 -06:00
Seongguk Jeong ea19f82b8a Using pattern matching for instanceof 2023-08-07 16:00:18 -06:00
Josh Cummings beab899c3d
Fix Import Order 2023-08-07 15:56:38 -06:00
1993heqiang 94c80bc2c6 Remove redundant code. 2023-08-07 15:01:52 -06:00
Jonas Bamberger 0d4e3f939a Clean up SavedRequestAwareWrapper and related test 2023-08-07 14:56:39 -06:00
Jonas Bamberger 07f737b989 Return content-type from saved request 2023-08-07 14:56:39 -06:00
Marcus Da Coregio 8f5793afb1 Merge branch '6.1.x' 2023-07-17 09:17:10 -03:00
Marcus Da Coregio aaa31312bd Merge branch '6.0.x' into 6.1.x 2023-07-17 09:16:45 -03:00
Marcus Da Coregio cbef118026 Merge branch '5.8.x' into 6.0.x 2023-07-17 09:16:20 -03:00
Marcus Da Coregio a939f17890 Merge branch '5.7.x' into 5.8.x 2023-07-17 09:15:56 -03:00
Marcus Da Coregio fe9bc26bdc Merge branch '5.6.x' into 5.7.x 2023-07-17 09:13:28 -03:00
Marcus Da Coregio 7813a9ba26 Use default PathPatternParser instance 2023-07-17 09:12:28 -03:00
Josh Cummings b0022a0ae8
Update Mockito Usage 
Issue gh-13542
 2023-07-14 18:44:34 -06:00
Josh Cummings 6c3636d780
Update Removed Usages 
Issue gh-13544
 2023-07-14 18:38:58 -06:00
Josh Cummings 1637b5c071
Merge branch '6.1.x' 
Closes gh-13483
 2023-07-10 16:18:02 -06:00
Josh Cummings c58e0dd113
Merge branch '6.0.x' into 6.1.x 
Closes gh-13482
 2023-07-10 16:17:13 -06:00
Josh Cummings 83c0f4231e
Merge branch '5.8.x' into 6.0.x 
Closes gh-13481
 2023-07-10 16:13:04 -06:00
Josh Cummings 40d61743b9
Replace Existing Continue Parameter 
Closes gh-13438
 2023-07-10 16:12:05 -06:00
Marcus Da Coregio 72698680e2 Merge branch '6.1.x' 
Closes gh-13466
 2023-07-07 14:36:08 -03:00
Marcus Da Coregio 230977d7ef Merge branch '6.0.x' into 6.1.x 
Closes gh-13465
 2023-07-07 14:35:52 -03:00
Marcus Da Coregio 863aa5f65f Fix Documented Default Value for AuthorizationFilter properties 
Closes gh-13456
 2023-07-07 14:35:11 -03:00
Marcus Da Coregio 2dee6218b5 Create NoOpAccessDeniedHandler 
Closes gh-13109
 2023-06-27 14:44:40 -03:00
Marcus Da Coregio e35faa84f7 Create NoOpAuthenticationEntryPoint 
Closes gh-13107
 2023-06-27 14:44:40 -03:00
Claudio Nave 52e12ad64b Replace deprecated methods 2023-06-22 13:19:55 -06:00
Evgeniy Cheban 0cefb27928 Simplify RequestMatcherDelegatingAuthorizationManager.Builder matcher registration 
Closes gh-11624
 2023-06-22 16:07:30 -03:00
Cedomir Igaly dd469ac2a0 Assert is missing object. It was useless before Spring Framework 6.1, and will not compile on 6.1 2023-06-22 12:11:40 -06:00
Krzysztof Krason 9b603b99ab Using modern Java features 2023-06-22 11:24:25 -06:00
Kandaguru17 7e01ebdd92 Remove LazyCsrfTokenRepository usage 
Closes gh-13194
 2023-06-22 11:23:35 -06:00
Josh Cummings aeeed6c368
Merge branch '6.0.x' 
Closes gh-13279
 2023-06-05 12:49:09 -06:00
Josh Cummings 45683349a4
Merge branch '5.8.x' into 6.0.x 
Closes gh-13278
 2023-06-05 12:48:43 -06:00
Josh Cummings 9ac286e8ea
Merge branch '5.7.x' into 5.8.x 
Closes gh-13231
 2023-06-05 12:47:23 -06:00
Christoph Zuleger 06e58e4c34 Update JavaDoc of BasicAuthenticationFilter 
Remove deprecated hint to use Digest Auth in favor of Basic Auth.
 2023-06-05 12:46:30 -06:00
Marcus Da Coregio bb7c7d3554 Merge branch '6.0.x' 2023-05-24 15:00:44 -03:00
Marcus Da Coregio ce5aa9e694 Merge branch '5.8.x' into 6.0.x 2023-05-24 15:00:17 -03:00
Marcus Da Coregio f8e39336cb Merge branch '5.7.x' into 5.8.x 2023-05-24 14:59:27 -03:00
Marcus Da Coregio a53cbb838b Polish 
Issue gh-13155
 2023-05-24 14:59:16 -03:00
joerg-richter-5234 8287289bcb Fix XContentTypeOptionsServerHttpHeadersWriter 
set constant value to X-Content-Type-Options

Closes gh-13155
 2023-05-24 14:59:14 -03:00
Josh Cummings 17a58194c1
Merge branch '6.0.x' 2023-05-18 09:33:12 -06:00
Josh Cummings 4c5bf3bdf5 Polish 
Use StringUtils#hasText

PR gh-13179
 2023-05-18 09:17:02 -06:00
Dennis Frommknecht af233a2a00 Use consistent list of micrometer tags in web observation handler 
The tag `spring.security.reached.filter.name` is only set if a
filter-name is available, otherwise the tag is omitted entirely. This
leads to issues with metric-exporters that don't support dynamic tags,
but rather expect tag-names of a metric to be always the same. The most
prominent example is the Prometheus-exporter.

Instead of omitting the tag if no filer-name is set, a none-value is
applied instead, making the tag-list consistent in all cases

Closes gh-13179
 2023-05-18 09:17:02 -06:00
Josh Cummings a4e13c520b
Merge branch '6.0.x' 
Closes gh-13150
 2023-05-10 16:15:13 -06:00
Josh Cummings e033e347b4
Remove Redundant Close 
Closes gh-12787
 2023-05-10 16:12:34 -06:00
Josh Cummings cdcc2d31d1
Merge branch '6.0.x' 
Closes gh-13145
 2023-05-08 14:19:15 -06:00
Josh Cummings 5d903b5b71
Enforce start happens-before stop 
Closes gh-13133
 2023-05-08 14:07:05 -06:00
Steve Riesenberg 07b884a2cb
Add Set-Cookie header value for XSRF-TOKEN 
This commit fixes an issue where using HttpServletResponse#setHeader
causes previous header values to be overwritten.

Closes gh-13075
 2023-04-25 15:15:02 -05:00
Marcus Da Coregio 04b3d07319 Merge branch '6.0.x' 2023-04-17 07:30:54 -03:00
Marcus Da Coregio a484044591 Merge branch '5.8.x' into 6.0.x 2023-04-17 07:29:42 -03:00
Marcus Da Coregio 6cf8c53aaa Merge branch '5.7.x' into 5.8.x 2023-04-17 07:16:47 -03:00