3059 Commits

Author	SHA1	Message	Date
Kevin Yue	7de4217469	Don't cache WebSocket request ... PR gh-16741 Signed-off-by: Kevin Yue <yuezk001@gmail.com>	2025-06-27 15:47:05 -05:00
Rob Winch	00ead7f24d	Update to Kotlin 2.2	2025-06-26 17:29:12 -05:00
Tran Ngoc Nhan	e686ac6b11	Remove AbstractSecurityWebSocketMessageBrokerConfigurer ... Signed-off-by: Tran Ngoc Nhan <ngocnhan.tran1996@gmail.com>	2025-06-24 12:56:05 -06:00
Tran Ngoc Nhan	a74ce06dae	Remove JwtIssuer(Reactive)AuthenticationManagerResolver deprecations ... Signed-off-by: Tran Ngoc Nhan <ngocnhan.tran1996@gmail.com>	2025-06-24 12:33:00 -06:00
Josh Cummings	08cbdb4640	Merge remote-tracking branch 'origin/6.5.x'	2025-06-20 14:43:25 -06:00
Josh Cummings	9f88ef83eb	Polish Post-Processor Test ... Issue gh-17175 Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>	2025-06-20 14:41:58 -06:00
Maciej Kowalski	46283b3452	Relax ObjectPostProcessor Type Constraints ... Closes gh-17175 Signed-off-by: Maciej Kowalski <f.kowal@gmail.com>	2025-06-20 14:41:58 -06:00
Josh Cummings	a4c338f8a5	Format authorizeExchange Blocks ... This commit formats authorizeExchange blocks to use a common variable name and ensure the variable and reference are on the same line. Issue gh-13067	2025-06-20 10:46:52 -06:00
Josh Cummings	da6c7b8759	Format Lambda Usage ... This commit updates Lambda DSL usage to favor having the variable and reference on the same line Issue gh-13067	2025-06-20 10:46:52 -06:00
Josh Cummings	777447e1d9	Format authorizeHttpRequests Blocks ... This commit formats authorizeHttpRequests blocks to use the same parameter name and places the reference on the same line as the parameter. Issue gh-13067	2025-06-20 10:46:51 -06:00
Josh Cummings	cf6b52d6f7	Format authorizeRequests Blocks ... This commit changes all auhorizeRequests declarations to use the same variable name and declare the lambda parameter and reference on the same line. Issue gh-13067	2025-06-20 10:46:51 -06:00
Josh Cummings	5dd40a7f10	Remove ServerHttpSecurity and() DSL Methods ... This commit removes all and() DSL methods with the exception of featurePolicy, which will be removed as a whole at another time. Closes gh-13067	2025-06-20 10:46:43 -06:00
Josh Cummings	f789abc87f	Use ServerHttpSecurity Lambda DSL in JavaDoc ... Issue gh-13067	2025-06-20 10:41:32 -06:00
Josh Cummings	461f00ed38	Use ServerHttpSecurity Lambda DSL in Config ... Issue gh-13067	2025-06-20 10:41:31 -06:00
Josh Cummings	9fcfacf283	Use ServerHttpSecurity Lambda DSL in Tests ... Issue gh-13067	2025-06-20 10:41:31 -06:00
Josh Cummings	1a7b1fcc7c	Remove HttpSecurity and() DSL Methods ... This commit removes all and() methods that have been deprecated in the HttpSecurity DSL with the exception of featurePolicy, which will be removed when that feature is removed. Note that since featurePolicy does not have a lambda equivalent, the and support needs to remain for the moment. Issue gh-13067	2025-06-20 10:41:31 -06:00
Josh Cummings	45a1447e9b	Use HttpSecurity Lambda DSL in JavaDoc ... Issue gh-13067	2025-06-20 10:41:30 -06:00
Josh Cummings	1435e0f3d3	Use HttpSecurity Lambda DSL in Config Tests ... Issue gh-13067	2025-06-20 10:41:30 -06:00
Josh Cummings	6ddb964c61	Remove ApacheDS Support ... Closes gh-13852	2025-06-19 11:55:34 -06:00
Josh Cummings	42e24aa53c	Fix Formatting	2025-06-17 16:55:22 -06:00
evga7	06ed6ef342	Simplify Csrf Processor Decision Logic ... Replaces repeated if-else string comparisons with a Set.contains() check for known WebSocket handshake handler class names in MessageSecurityPostProcessor. Improves readability and maintainability without changing behavior. Signed-off-by: Wonpyo Hong <evga7@naver.com>	2025-06-17 16:55:22 -06:00
Tran Ngoc Nhan	c2c84c4243	Update HttpSecurity javadoc ... Signed-off-by: Tran Ngoc Nhan <ngocnhan.tran1996@gmail.com>	2025-06-17 13:31:24 -05:00
Evgeniy Cheban	b0cecb37d2	Replace deprecated #check calls with #authorize ... Closes gh-16936 Signed-off-by: Evgeniy Cheban <mister.cheban@gmail.com>	2025-06-12 11:11:49 -06:00
Rob Winch	7bf2730a53	Add x509@principal-extractor-ref ... Enables customizing the X500PrincipalExtractor	2025-06-12 12:09:20 -05:00
Rob Winch	88ed4a5ccf	Use principalExtractor reference instead of properties	2025-06-12 12:09:20 -05:00
Max Batischev	aba437d469	Add Support SubjectX500PrincipalExtractor ... Closes gh-16980 Signed-off-by: Max Batischev <mblancer@mail.ru>	2025-06-12 12:09:20 -05:00
Josh Cummings	9b724377ce	Rework Saml2 Authentication Statement ... This commit separates the authentication principal, the assertion details, and the relying party tenant into separate components. This allows the principal to be completely decoupled from how Spring Security triggers and processes SLO. Specifically, it adds Saml2AssertionAuthentication, a new authentication implementation that allows an Object principal and a Saml2ResponseAssertionAccessor credential. It also moves the relying party registration id from Saml2AuthenticatedPrincipal to Saml2AssertionAuthentication. As such, Saml2AuthenticatedPrincipal is now deprecated in favor of placing its assertion components in Saml2ResponseAssertionAccessor and the relying party registration id in Saml2AssertionAuthentication. Closes gh-10820	2025-06-10 17:21:03 -06:00
Christian Schuster	36c7b91fb9	SAML 2.0 Single Logout Uses Saml2AuthenticationInfo ... This allows SLO to be triggered without the authentication principal needing to implement a given interface. Issue gh-10820	2025-06-10 17:21:03 -06:00
Josh Cummings	aa3135169d	Polish Documentation ... Closes gh-14635	2025-06-09 16:49:36 -06:00
Liviu Gheorghe	3ddf201d66	Updated Copyrights ... Signed-off-by: Liviu Gheorghe <liviu.gheorghe.ro@gmail.com>	2025-06-09 16:45:24 -06:00
1livv	edfd7b9b43	Addressed review comments ... Signed-off-by: Liviu Gheorghe <liviu.gheorghe.ro@gmail.com>	2025-06-09 16:45:24 -06:00
1livv	358f6c96b5	Update config tests ... Signed-off-by: Liviu Gheorghe <liviu.gheorghe.ro@gmail.com>	2025-06-09 16:45:24 -06:00
Joe Grandja	2e913d2af9	Merge branch '6.5.x'	2025-06-05 16:22:35 -04:00
Joe Grandja	dab989d7c3	Fix NPE with DPoP tokenAuthenticationManager ... Closes gh-17172	2025-06-05 16:06:55 -04:00
Josh Cummings	c8b843c4c5	Merge branch '6.5.x'	2025-06-05 12:36:53 -06:00
damable-nuvolex	3b12e758d3	Fix inconsistent constructor declaration ... Closes gh-16325 Signed-off-by: damable-nuvolex <damable@nuvolex.com>	2025-06-05 12:36:27 -06:00
Josh Cummings	eaab42a73c	Polish BearerTokenAuthenticationConverter Support ... - Moved to BearerTokenAuthenticationFilter constructor to align with AuthenticationFilter - Undeprecated BearerTokenResolver to reduce number of migration scenarios - Updated to 7.0 schema - Added migration docs Issue gh-14750	2025-06-04 18:17:17 -06:00
Max Batischev	4967f3feee	Add Support BearerTokenAuthenticationConverter ... Closes gh-14750 Signed-off-by: Max Batischev <mblancer@mail.ru>	2025-06-04 18:17:17 -06:00
Josh Cummings	3f0326d3f1	Merge remote-tracking branch 'origin/6.5.x'	2025-06-04 12:49:12 -06:00
Evgeniy Cheban	33ae1711a7	Set Precedence Order for Spring MVC TargetVisitor ... Closes gh-17185 Signed-off-by: Evgeniy Cheban <mister.cheban@gmail.com>	2025-06-04 12:47:36 -06:00
Josh Cummings	195f933438	Allow Default Ordering for TargetVisitor ... In tests, we want to both test that functionality works and also demonstrate common or expected usage, where possible. It is likely incorrect to use @Order(0) for a target visitor as this states that it should take precedence over all Spring Security visitors defined at a lower precedence. Also, it appears this may have been added this way because of a mock visitor that appears to be unused by any tests. Further, when an application has multiple visitors, they should use the TargetVisitor.of method to publish one bean with the order determined by the order of the method parameters instead of having two separate beans. This commit removes the @Order(0) annotation and also the mock visitor, deferring to the natural ordering afforded by the framework. Issue gh-15994	2025-06-02 13:41:21 -06:00
Evgeniy Cheban	fd4f06a66e	Support Spring Data container types for AuthorizeReturnObject ... Closes gh-15994 Signed-off-by: Evgeniy Cheban <mister.cheban@gmail.com>	2025-05-29 17:05:27 -06:00
Josh Cummings	6d3b54df21	Change Type Validation Default ... NimbusJwtDecoder and NimbusReactiveJwtDecoder now use Spring Security's JwtTypeValidator by default instead of Nimbus's type validator. Closes gh-17181	2025-05-28 16:11:13 -06:00
Yanming Zhou	42790403da	Use SpringReactiveOpaqueTokenIntrospector ... Now that NimbusReactiveOpaqueTokenIntrospector is deprecated, this commit changes the Spring Security default to now use SpringReactiveOpaqueTokenIntrospector. Issue gh-15988 Signed-off-by: Yanming Zhou <zhouyanming@gmail.com>	2025-05-27 14:25:31 -06:00
Josh Cummings	596449d882	Polish ... Issue gh-14149	2025-05-27 11:44:33 -06:00
Felix Hagemans	1a4de49977	Create CsrfCustomizer for SPA configuration ... Closes gh-14149 Signed-off-by: Felix Hagemans <felixhagemans@gmail.com>	2025-05-27 11:44:33 -06:00
Josh Cummings	52394c1f07	Propagate Any AccessDeniedException ... Any time a response handler throws an exception, we want to propagate an underlying AccessDeniedException if their is one. Issue gh-16058	2025-05-23 15:18:01 -06:00
Evgeniy Cheban	fae61b9426	Propagate AccessDeniedException for Authorized Objects Returned from a Controller ... Closes gh-16058 Signed-off-by: Evgeniy Cheban <mister.cheban@gmail.com>	2025-05-23 15:18:01 -06:00
dae won	8612e952fe	Make AuthorizationProxyFactory#proxy Generic ... Closes gh-16706 Signed-off-by: dae won <eodnjs01477@gmail.com>	2025-05-23 14:48:11 -06:00
Max Batischev	f4b8e2421a	Add Support Credentialless COEP Header ... Closes gh-16991 Signed-off-by: Max Batischev <mblancer@mail.ru>	2025-05-23 14:45:59 -06:00