Commit Graph

789 Commits

Author SHA1 Message Date
Josh Cummings f0772dc788
Merge branch '5.8.x' into 6.1.x
Closes gh-14279
2023-12-11 11:44:44 -07:00
Josh Cummings 74d06f020d
Update to Latest Boot Property
Closes gh-14252
2023-12-11 11:44:08 -07:00
Federico Herrera 7b67476153 Add missing method call in authorization docs 2023-12-08 11:51:43 -07:00
Josh Cummings 92be497d24 Polish RoleHierachyImpl#of
- Change to #fromHierarchy to match naming convention
- Keep existing test methods the same
- Deprecate setHierarchy and default constructor
- Add private Map constructor
- Change Adjust RoleHierarchyBuilder to use Map constructor

Issue gh-13788
2023-12-08 11:49:50 -07:00
Josh Cummings ee8bc78cbc Polish RoleHierarchyImpl#Builder
- Added documentation
- Removed withNoRolePrefix for now; let's see how folks
use the minimal API first
- Adjusted class hierarchy to match AuthorizeHttpRequests more
closely
- Adjusted to match Spring Security style guide
- Added needed @since attributes

Issue gh-13300
2023-12-07 15:18:13 -07:00
Steve Riesenberg 82297acb4c
Merge branch '6.2.x' 2023-12-07 11:10:01 -06:00
David Kanenwisher 4f6a4d6471
Fix typo in architecture.adoc 2023-12-07 11:03:43 -06:00
Josh Cummings d50698a269
Prepare for Spring Security 6.3
Closes gh-14210
2023-12-05 15:49:42 -07:00
Josh Cummings 3ab235cd56
Merge branch '6.1.x' 2023-12-01 15:54:44 -07:00
Josh Cummings 641722823e
Merge branch '6.0.x' into 6.1.x 2023-12-01 15:45:32 -07:00
Josh Cummings f536b2652f
Merge branch '5.8.x' into 6.0.x 2023-12-01 15:45:03 -07:00
Josh Cummings c336ca49fb
Update Spring MVC Docs
Closes gh-14220
2023-12-01 12:57:46 -07:00
Steve Riesenberg 8cdd53f531
Polish gh-13593 2023-11-30 13:23:13 -06:00
Seongguk Jeong 54b8f3874f
Fix link in authentication/architecture.adoc
Closes gh-13577
2023-11-30 13:23:12 -06:00
Steve Riesenberg 57f7eff568
Polish method-security.adoc 2023-11-30 12:18:57 -06:00
Steve Riesenberg 6e1605314a
Polish gh-14219 2023-11-30 12:18:48 -06:00
ANDREI LISA 1d769b5afc
make XML and Java/Kotlin consistent with AspectJExpressionPointcut 2023-11-30 12:14:27 -06:00
ahmd-nabil 0beda02a14 fix typo in docs and add api url
Signed-off-by: ahmd-nabil <ahm3dnabil99@gmail.com>
2023-11-30 09:12:14 -03:00
ahmd-nabil abe2029cb4 add missing [tabs] 2023-11-30 09:12:14 -03:00
aaron-to-go d99e98515c Fix typo in the 'Authorizing Requests' example
The example request matcher listed "/resources/**", while the explanation (3) used "/static/" instead.
2023-11-22 11:58:41 -03:00
Josh Cummings 4131a38f9e
Revert "Add forServletPattern"
This reverts commit 762319b6be.
2023-11-17 12:02:14 -07:00
Josh Cummings fbad708347
Polish Grammar
Co-Authored-By: grad.ofthe.es@gmail.com
2023-11-14 10:49:13 -07:00
Nicolas-Ortiz d8f77e9649 fix typo in documentation 2023-11-14 10:36:22 -07:00
Marcus Hert Da Coregio eb0460df03 Merge branch '6.1.x' 2023-11-14 14:26:43 -03:00
Ruben Suet 916d9d949a fix broken link for servlet getting started page 2023-11-14 14:26:20 -03:00
Steve Riesenberg 67d3e4c9b8
Merge branch '6.1.x' 2023-11-09 14:13:00 -06:00
Steve Riesenberg a2d1fcf923
Merge branch '6.0.x' into 6.1.x 2023-11-09 14:12:43 -06:00
Steve Riesenberg b14a66c30d
Merge branch '5.8.x' into 6.0.x 2023-11-09 14:12:29 -06:00
Steve Riesenberg 7335c5745c
Document authentication helper method in WebClient integration
This commit re-applies 49f3c0ce53
which was lost while splitting pages for Antora.

Issue gh-13816
Issue gh-10120
2023-11-09 10:46:32 -06:00
Josh Cummings 22000b42e9
Merge remote-tracking branch 'origin/6.1.x' 2023-11-07 16:34:15 -07:00
Josh Cummings 42225371d7
Merge branch '6.0.x' into 6.1.x
Closes gh-14114
2023-11-07 16:33:45 -07:00
Josh Cummings 18c5f4354e
Merge branch '5.8.x' into 6.0.x
Closes gh-14113
2023-11-07 16:31:46 -07:00
Josh Cummings b919ece045
Change Idempotent to Read-Only
Closes gh-13644
2023-11-07 16:25:28 -07:00
Marcus Hert Da Coregio 6ab9cc6ff7 Merge branch '6.1.x' 2023-11-07 10:54:02 -03:00
Marcus Hert Da Coregio 2158d262bc Merge branch '6.0.x' into 6.1.x 2023-11-07 10:53:56 -03:00
Dong, Xue-Han fafb579a6e fix code blocks formatting mistakes. 2023-11-07 10:53:33 -03:00
Steve Riesenberg 447f40949c
Revert unnecessary merges on 6.1.x
This commit removes unnecessary main-branch merges starting from
9f8db22b77 and adds the following
needed commit(s) that were made afterward:

- 4d6ff49b9d
- ed6ff670d1
- c823b00794
- 44fad21363
2023-10-31 15:22:15 -05:00
Steve Riesenberg 9db33f33c7
Revert unnecessary merges on 6.0.x
This commit removes unnecessary main-branch merges starting from
8750608b5b and adds the following
needed commit(s) that were made afterward:

- 5dce82c48b
2023-10-31 15:11:45 -05:00
Sadid Shaikh 44fad21363 Fix typo in method-security.adoc
Fixed typo by changing 'please' to 'place'
2023-10-31 09:46:28 -03:00
Mark Bonnekessel c823b00794 Update logout.adoc: Replace Directives with Directive 2023-10-31 09:45:12 -03:00
Steve Riesenberg bfc31bacab
Polish Username/Password Authentication page
Issue gh-11926

(cherry picked from commit 781d575921)
2023-10-25 15:50:53 -05:00
Steve Riesenberg 781d575921
Polish Username/Password Authentication page
Issue gh-11926
2023-10-25 15:47:23 -05:00
Steve Riesenberg 8307196799
Add Kotlin examples to OAuth2 docs landing page
Issue gh-13785
2023-10-23 14:52:13 -05:00
abramofranchetti ab478a13bc
Clarify Effects Disabling CSRF Has On Logout
Issue gh-13062
2023-10-16 14:47:28 -06:00
Steve Riesenberg 82e11ccb25
Merge branch '6.1.x'
Closes gh-14016
2023-10-13 18:18:05 -05:00
Steve Riesenberg bea2b4676e
Merge branch '6.0.x' into 6.1.x
Closes gh-14015
2023-10-13 18:17:47 -05:00
Steve Riesenberg c7461d1a95
Merge branch '5.8.x' into 6.0.x
Closes gh-14014
2023-10-13 18:16:37 -05:00
Steve Riesenberg 81d91063a5
Document how to publish an AuthenticationManager
Closes gh-11926
2023-10-13 18:15:09 -05:00
Josh Cummings 762319b6be Add forServletPattern
Closes gh-13562
2023-10-12 09:29:08 -06:00
Marcus Da Coregio c08baea67e Merge branch '6.1.x' 2023-10-11 08:06:20 -03:00
pbborisov18 7a8faf85d9 Docs custom AuthorizationManager fix
Issue gh-13967
2023-10-11 08:05:58 -03:00
Steve Riesenberg 7d5a541a7b
Backport "Revisit CSRF page" to 6.0.x
(cherry picked from commit e7fa34008b)

Closes gh-13910
2023-10-10 10:43:14 -05:00
Josh Cummings a3227f041c
Polish OAuth2AuthorizationManagers
- Add OAuth2ReactiveAuthorizationManagers
- Code to interfaces
- Align error message with the same in
AuthorityAuthorizationManager
- Adjust expectations in tests to confirm an
appropriately constructed authorizaion manager
- Add JavaDoc and reference documentation

Issue gh-13654
2023-10-02 17:26:06 -06:00
Josh Cummings 6b0d82236d
Fix Documentation Errors
Issue gh-12570
2023-09-18 16:21:37 -06:00
Josh Cummings cb33fd7850
Add OIDC Back-Channel Logout Support
Closes gh-12570
2023-09-16 15:12:21 -06:00
Steve Riesenberg 9de717ac7a
Polish gh-13575 2023-09-07 14:07:40 -05:00
moon 3a50c92168 Replace wildcard type ? with * in Kotlin and fix typo 2023-09-07 14:02:47 -05:00
Deniz Husaj 91a8ed1ba7 Update firewall.adoc 2023-09-07 13:58:39 -05:00
Some developer 5a25a8220b Fix grammar 2023-09-07 13:56:59 -05:00
Kevin2Jordan 90d845c3df Fixing untitled page title in documentation 2023-09-07 13:43:18 -05:00
Steve Riesenberg 1f8c94aee8
Add overview documentation for OAuth2
This commit adds an overview to the landing page for OAuth2 with:
* OAuth2 Resource Server
* OAuth2 Client

At this level, OAuth2 Login is combined into the overview for Client
to make it clear that it is part of the oauth2-client module.

Content is broken down into use cases similar to other docs pages
that have been updated recently. This content will be revisited
as additional updates are made to OAuth2 docs, and some use cases
may be moved or even added as needed. This commit only adds a few
initial use cases to get the OAuth2 docs update process started.

Closes gh-13784
2023-09-07 12:26:07 -05:00
Marcus Da Coregio 8eed8cd13b Merge branch '6.1.x' 2023-08-30 14:16:30 -03:00
username1103 14b328e3ed Fix incorrect documentation 2023-08-30 14:15:55 -03:00
Josh Cummings 40929a53ea
Merge branch '6.1.x'
Closes gh-13727
2023-08-20 23:34:32 -06:00
Josh Cummings bcfa4adc44
Add MvcRequestMatcher Reference
Closes gh-13726
2023-08-20 23:32:14 -06:00
Marcus Da Coregio 779d4725a7 Merge branch '6.1.x' 2023-08-09 09:56:20 -03:00
Marcus Da Coregio 35d879191c Merge branch '6.0.x' into 6.1.x 2023-08-09 09:56:05 -03:00
Marcus Da Coregio 17e9fec6eb Merge branch '5.8.x' into 6.0.x 2023-08-09 09:55:39 -03:00
Mario Petrovski 1db8734101 Closes #11450 Add Java beans configuration for Remmember Me Docs 2023-08-09 09:54:53 -03:00
Josh Cummings 6ee4bbcc13
Merge branch '6.1.x'
Closes gh-13596 in 6.2.x
Closes gh-13636
2023-08-08 18:12:17 -06:00
galmegiz 8368c234a5
Add Missing Return Statement in Snippet
Closes gh-13596
Closes gh-13595
2023-08-08 18:11:53 -06:00
Josh Cummings a29f90b29e
Merge branch '6.1.x'
Closes gh-13634
2023-08-08 17:46:46 -06:00
Josh Cummings 3edbdc6e87
Merge branch '6.0.x' into 6.1.x
Closes gh-13632
2023-08-08 17:46:04 -06:00
Seongguk Jeong 90936537dc
Update links in adocs
Spring Security 6.0 requires Spring 6.0 as a minimum and Spring 6.0 requires a minimum of Tomcat 10/Jetty 11

Closes gh-13565
2023-08-08 17:45:07 -06:00
Madhura Bhave 68f9371fa6 Fix minor typo in docs 2023-08-08 17:29:57 -06:00
Josh Cummings 1c20df6be7
Merge branch '6.1.x' 2023-08-08 17:27:01 -06:00
Josh Cummings 36d0ca340a
Merge branch '6.0.x' into 6.1.x 2023-08-08 17:26:47 -06:00
Guillaume Husta a8fcfaa428
Doc : typo in Custom DSLs section
Method 'configure' was renamed 'filterChain'
2023-08-08 17:26:25 -06:00
Josh Cummings 3b7e7f63d8
Update Jwt Multi-tenancy Documentation
Issue gh-13427
2023-08-08 10:03:11 -06:00
Josh Cummings 30d016bcbd
Merge branch '6.1.x' 2023-08-07 14:48:51 -06:00
Josh Cummings b7efa15591
Merge branch '6.0.x' into 6.1.x 2023-08-07 14:48:37 -06:00
Josh Cummings 1f27b18398
Merge branch '5.8.x' into 6.0.x 2023-08-07 14:48:12 -06:00
Daniel Shuy e8b9a35494
Fix Bearer Token RestTemplate Support example 2023-08-07 14:47:37 -06:00
Niklas Sparfeld f77f020a47 Fix typo: you're -> your 2023-08-07 14:44:22 -06:00
Marcus Da Coregio 2ef9dc916f Fix unresolved xref
Issue gh-13552
2023-07-19 14:31:37 -03:00
Josh Cummings 1e8250e4b6
Merge branch '6.1.x'
Closes gh-13501
2023-07-12 15:02:54 -06:00
yahya jabary c03bd3f717
Remove deprecated usage
Closes gh-13446
2023-07-12 15:02:26 -06:00
Marcus Da Coregio 1ff5eb6b57 Add with() method to apply SecurityConfigurerAdapter
This method is intended to replace .apply() because it will not be possible to chain configurations when .and() gets removed

Closes gh-13204
2023-06-29 14:52:30 -03:00
Marcus Da Coregio 7e0fcb7dae Merge branch '6.1.x'
Closes gh-13422
2023-06-23 10:39:17 -03:00
Marcus Da Coregio 73a0dd6f50 Merge branch '6.0.x' into 6.1.x
Closes gh-13421
2023-06-23 10:38:52 -03:00
Marcus Da Coregio 6e2c9b421b Merge branch '5.8.x' into 6.0.x
Closes gh-13420
2023-06-23 10:38:21 -03:00
Marcus Da Coregio 80a5028f3f saml2Login filterProcessingUrl should be loginProcessingUrl
Closes gh-13417
2023-06-23 10:38:04 -03:00
Marcus Da Coregio 618847418f Automatically enable .cors() if CorsConfigurationSource bean is present
Closes gh-5011
2023-06-23 09:51:46 -03:00
Josh Cummings fb910e2997
Prepare for Spring Security 6.2
Closes gh-14316
2023-06-22 11:03:28 -06:00
Marcus Da Coregio 2e4b417fce Merge branch '6.0.x'
Closes gh-13414
2023-06-22 10:31:05 -03:00
Marcus Da Coregio 225f3536c5 Merge branch '5.8.x' into 6.0.x
Closes gh-13413
2023-06-22 10:28:56 -03:00
Marcus Da Coregio c30bacac10 Improve Security Filters Documentation
Closes gh-8167
2023-06-22 10:11:18 -03:00
Rob Winch 8407c9ebee Merge branch '6.0.x'
Closes gh-13407
2023-06-18 21:41:16 -05:00
Rob Winch f66a5bab99 Merge branch '5.8.x' into 6.0.x
Closes gh-13406
2023-06-18 21:33:58 -05:00
Rob Winch 7da99acca7 Merge branch '5.7.x' into 5.8.x
Closes gh-13405
2023-06-18 21:32:35 -05:00
Rob Winch 0cf95dbf61 Merge branch '5.6.x' into 5.7.x
Closes gh-13404
2023-06-18 21:31:35 -05:00
Rob Winch 39c43159f4 Convert to Asciidoctor Tabs
Closes gh-13403
2023-06-18 21:30:41 -05:00
Rob Winch b472a06848 Merge branch '5.8.x' into 6.0.x
Closes gh-13293
2023-06-08 17:17:34 -05:00
Rob Winch 04692d9ee8 Fix Antora Warnings
Closes gh-13210
2023-06-08 17:02:19 -05:00
Josh Cummings 79e09bbefb
Merge branch '6.0.x' 2023-06-05 14:28:53 -06:00
Josh Cummings ce90bcc6fc
Merge branch '5.8.x' into 6.0.x 2023-06-05 14:28:40 -06:00
Josh Cummings 1c6dc1aaac
Merge branch '5.7.x' into 5.8.x 2023-06-05 14:27:56 -06:00
Anubhav Ahlawat 2279f9fd39 Typos in persistence section 2023-06-05 14:27:43 -06:00
Mário Pereira cece06e338 Fix typo on method-security.adoc 2023-06-05 13:30:20 -06:00
Josh Cummings 4921b494b1
Merge branch '6.0.x' 2023-06-05 13:24:21 -06:00
Josh Cummings d8db849400
Merge branch '5.8.x' into 6.0.x 2023-06-05 13:24:03 -06:00
Josh Cummings df4411fb48
Merge branch '5.7.x' into 5.8.x 2023-06-05 13:18:22 -06:00
Josh Cummings e834543eed Change possessives to use two ticks 2023-06-05 13:17:15 -06:00
1993heqiang 783f674704 Fix typo authentication.adoc 2023-06-05 13:17:15 -06:00
1993heqiang 933debebeb Fix typo overview.adoc 2023-06-05 13:17:15 -06:00
Josh Cummings 528ec318ab
Merge branch '6.0.x' 2023-06-05 12:56:56 -06:00
Vladimir Kidyaev d47e3e8cd8
Delete duplicate line from oauth2/client/core.adoc 2023-06-05 12:56:24 -06:00
Josh Cummings 58a08050c1
Merge branch '6.0.x'
Closes gh-13239
2023-05-26 14:25:33 -06:00
Josh Cummings 0ac554ee3e
Merge branch '5.8.x' into 6.0.x
Closes gh-13238
2023-05-26 14:25:20 -06:00
Josh Cummings 8ccc03fdb6
Update Resource Server Docs
Closes gh-13147
2023-05-26 14:24:31 -06:00
Josh Cummings f03e045710
Add @EnableTransactionManagement Reference Details
Issue gh-13152
2023-05-24 10:26:59 -06:00
Josh Cummings bf597bce4a
Merge branch '6.0.x'
Closes gh-13206
2023-05-22 14:45:49 -06:00
Josh Cummings c3174179a3
Merge branch '5.8.x' into 6.0.x
Closes gh-13205
2023-05-22 14:45:28 -06:00
Jan Marten 6b19728c54 Fix legacy-websocket-configuration cross-reference
Closes gh-12969
2023-05-22 14:44:34 -06:00
Josh Cummings 0e3ee89902
Merge branch '6.0.x' 2023-05-18 11:08:11 -06:00
Josh Cummings cdac708051
Merge branch '5.8.x' into 6.0.x 2023-05-18 11:08:00 -06:00
Josh Cummings 219faf29d4
Merge branch '5.7.x' into 5.8.x 2023-05-18 11:07:42 -06:00
moli b6f3cb71e6
Add Missing AuthorizationRequestRepository in Snippet
Closes PR-13099
2023-05-18 10:54:19 -06:00
Steve Riesenberg f54c344989
Move imports to code section
Issue gh-13089
2023-05-15 09:22:57 -05:00
Steve Riesenberg e7fa34008b
Revisit CSRF page
Closes gh-13089
2023-05-12 12:29:32 -05:00
Josh Cummings 97a42ba190
Update SpEL Documentation
Closes gh-12974
2023-05-12 08:37:26 -06:00
Josh Cummings eea3b7734f
Address Antora Warnings 2023-05-10 15:57:25 -06:00
Josh Cummings 810e57686e
Merge branch '6.0.x' 2023-05-10 15:56:49 -06:00
Josh Cummings 1b4b91a35c
Merge branch '5.8.x' into 6.0.x 2023-05-10 15:56:18 -06:00
Josh Cummings b969179b5c
Merge branch '5.7.x' into 5.8.x 2023-05-10 15:53:22 -06:00
Josh Cummings 3469bcb822
Address Antora Warnings 2023-05-10 15:51:49 -06:00
Josh Cummings d194e2a725
Revisit Getting Started Page
Closes gh-12213
Closes gh-12551
2023-05-10 15:26:41 -06:00
1993heqiang 1631cac150 Fix typo cas.adoc 2023-05-03 11:26:04 -03:00
Marcus Da Coregio 9078730c5b Merge branch '6.0.x' 2023-05-03 11:13:38 -03:00
Glenn Adams dfbfa9199d X-XSS-Protection is now disabled 2023-05-03 11:13:08 -03:00
Marcus Da Coregio b6dcb29a11 Merge branch '5.8.x' into 6.0.x
Closes gh-13125
2023-05-02 16:08:48 -03:00
Marcus Da Coregio 6d37ca1808 Fix code snippets in Authorize HttpServletRequest
Closes gh-11522
2023-05-02 16:06:27 -03:00
Josh Cummings e5fcf1ebcf
Revisit Request and Method Security Docs
Issue gh-13088
2023-05-01 14:09:22 -06:00
Marcus Da Coregio 42cd19fcee Merge branch '6.0.x'
Closes gh-13103
2023-04-26 15:59:20 -03:00
Marcus Da Coregio 8c5f13657e Merge branch '5.8.x' into 6.0.x
Closes gh-13102
2023-04-26 15:58:25 -03:00
Marcus Da Coregio 5632469a90 Merge branch '5.7.x' into 5.8.x
Closes gh-13101
2023-04-26 15:57:32 -03:00
Marcus Da Coregio e61adcb0cd Clarify that Kotlin DSL needs an import
Closes gh-13092
2023-04-26 15:56:47 -03:00
Nikita Eshkeev bb402a706f Update acls.adoc
Fix the spring security samples link
2023-04-24 16:38:24 -06:00
Nikita Eshkeev 9edbac7233 Update architecture.adoc
`RoleHierarchy` doesn't have the `setHierarchy` method, so the snippet doesn't work as is. The method is declared inside `RoleHierarchyImpl`
2023-04-24 16:37:47 -06:00
Josh Cummings 33b266e8fa
Add Boot Link
Issue gh-13062
2023-04-18 11:33:48 -06:00
Josh Cummings 3f6f01ce20
Add Spring MVC Links
Issue gh-13062
2023-04-18 11:23:57 -06:00
Josh Cummings 62fec2f969
Revisit Logout Docs
Closes gh-13062
2023-04-17 16:58:43 -06:00
Marcus Da Coregio 04b3d07319 Merge branch '6.0.x' 2023-04-17 07:30:54 -03:00
Marcus Da Coregio a484044591 Merge branch '5.8.x' into 6.0.x 2023-04-17 07:29:42 -03:00
Marcus Da Coregio 6cf8c53aaa Merge branch '5.7.x' into 5.8.x 2023-04-17 07:16:47 -03:00
Marcus Da Coregio 2d52fb8e4b Clear Repository on Logout 2023-04-17 06:47:57 -03:00
Josh Cummings 76eba9bd0c
Add withIssuerLocation
Closes gh-10309
2023-04-12 16:36:15 -06:00
Rob Winch fb3ed7288c Merge branch '6.0.x'
Closes gh-12981
2023-04-10 11:15:33 -05:00
1993heqiang 54de5c9537 Fix documentation code block bug.
Closes gh-12980
2023-04-10 11:11:10 -05:00
Marcus Da Coregio ff4e926111 Merge branch '6.0.x'
Closes gh-12942
2023-03-28 15:23:51 -03:00
Marcus Da Coregio b4b4cd0ffa Merge branch '5.8.x' into 6.0.x
Closes gh-12941
2023-03-28 15:23:21 -03:00
Marcus Da Coregio eb58655fa9 Improve Docs by mentioning that Empty SecurityContext should be saved
Closes gh-12906
2023-03-28 15:21:30 -03:00
Josh Cummings dfdadc90cf
Merge branch '6.0.x'
Closes gh-12933
2023-03-27 14:43:00 -06:00
Josh Cummings 834e361898
Merge branch '5.8.x' into 6.0.x
Closes gh-12932
2023-03-27 14:41:07 -06:00
Josh Cummings 6bda1d2bf3
Document WebExpressionAuthorizationManager
Closes gh-12928
2023-03-27 14:38:09 -06:00
Marcus Da Coregio 13f707a6d5 Merge branch '6.0.x' 2023-03-22 10:34:19 -03:00
Marcus Da Coregio 9ec9e77c6b Merge branch '5.8.x' into 6.0.x 2023-03-22 10:34:02 -03:00
slauth a708007536 fix ID of WebSocket Authorization section
Throughout this document there are 3 references to `<<websocket-authorization>>` but the section ID was actually named `[[websocket-configuration]]`
2023-03-22 10:33:10 -03:00
Marcus Da Coregio 57e134cc5f Merge branch '6.0.x' 2023-03-22 10:12:28 -03:00
Jesper Rønn-Jensen ed42dc4a09 chore: typo, removed extra "s" in word implementationss 2023-03-22 10:11:16 -03:00
Gabriel Maciel 2fa1bbc9d1 Fix typo architecture.adoc 2023-03-22 10:10:28 -03:00
Marcus Da Coregio 1730efd130 Merge branch '6.0.x' 2023-03-22 09:22:12 -03:00
Marcus Da Coregio 8a2b96795e Merge branch '5.8.x' into 6.0.x 2023-03-22 09:21:50 -03:00
Bishakh Ghosh c75ee25a6d Fix documentation code block bug
Fixes #12850
2023-03-22 09:21:09 -03:00
Josh Cummings 6f5172d388
Merge branch '6.0.x' 2023-03-20 16:18:45 -06:00
zks cfeb1ce303
Fix docs typo 2023-03-20 16:18:10 -06:00
Josh Cummings 2b6a2c22db
Merge branch '6.0.x' 2023-03-20 15:24:45 -06:00
Josh Cummings b22dd9a3e9
Merge branch '5.8.x' into 6.0.x 2023-03-20 15:24:19 -06:00
el-hopaness-romtic 4154ed543a
Fix .access(...) parameter 2023-03-20 15:23:40 -06:00
Logan Kulinski 8ad91287d9 Fix Broken Link
Closes gh-12824
2023-03-20 15:13:10 -06:00
Josh Cummings 3ad6c6ce06 Use EntityId-lookup Components
Closes gh-12880
2023-03-17 18:00:02 -06:00
Josh Cummings dbdf04f151 SAML Response Reads EntityId
Closes gh-10243
2023-03-17 18:00:02 -06:00
Josh Cummings 3f2816f745 Logout Request Reads EntityId
Closes gh-12843
Closes gh-12845
2023-03-17 18:00:02 -06:00
Josh Cummings 46452c0cae Add saml2Metadata
Closes gh-11828
2023-03-17 18:00:02 -06:00
Josh Cummings ac1d269e73
Merge branch '6.0.x'
Closes gh-12839
2023-03-07 11:53:01 -07:00
rai-sandeep ffe029d5bd Fix broken links in form login section
Closes gh-12822
2023-03-07 11:52:19 -07:00
Wyfrel 3b447b938c fix missing semi-colon java example in observability documentation 2023-03-03 15:04:16 -07:00
hdeadman e0284a4503 Fix CAS packages for 4.0.1 and Jasig references
Issue gh-11674
2023-03-01 17:21:24 -03:00
hdeadman b4d3ac6665 Revert "Remove CAS module"
This reverts commit caf4c471
2023-03-01 17:21:23 -03:00
Steve Riesenberg 7c89bd8c90
Merge branch '6.0.x'
Closes gh-12809
2023-02-28 17:28:37 -06:00
Qie 8b2ce79341
Correct deprecated description in docs
Remove deprecated SecurityContextPersistenceFilter from docs.

Closes gh-12690
2023-02-28 17:01:47 -06:00
Josh Cummings 41fadaecd3
Merge branch '6.0.x'
Closes gh-12800
2023-02-28 13:08:47 -07:00
Josh Cummings e28ea6dbad
Preserve OpenSamlAssertingPartyDetails Instance
Closes gh-12667
2023-02-28 13:08:13 -07:00
Josh Cummings aedabf5504
Merge branch '6.0.x' 2023-02-28 12:49:33 -07:00
Josh Cummings ddad623abf
Merge branch '5.8.x' into 6.0.x 2023-02-28 12:49:04 -07:00
Josh Cummings 383e0c2cf0
Merge branch '5.7.x' into 5.8.x 2023-02-28 12:47:06 -07:00
Josh Cummings 0421e25cba
Document Common SAML URI Endpoints
Issue gh-12764
2023-02-28 12:45:48 -07:00
Josh Cummings 1c885cf3a3
Document Federation Usecase
Closes gh-12764
2023-02-28 12:35:04 -07:00
Josh Cummings be2958ed13
Merge branch '6.0.x'
Closes gh-12784
2023-02-24 13:51:34 -07:00
Josh Cummings 109f6e7028
Add Note about RoleHierarchy
Closes gh-12766
2023-02-24 13:43:43 -07:00
Josh Cummings eac1f846b3
Update RoleHierarchy Docs
Closes gh-12766
2023-02-24 12:00:35 -07:00
Steve Riesenberg 82642dc9ba
Merge branch '6.0.x'
Closes gh-12730
2023-02-17 15:52:43 -06:00
Byeonggon Lee f2c4656abd
Fix typo in form.adoc
Closes gh-12678
2023-02-17 15:52:26 -06:00
Josh Cummings a1b282ff03
Merge branch '5.7.x' into 5.8.x
Closes gh-12693
2023-02-17 10:09:32 -07:00
Josh Cummings 2db4430dcd Preserve OpenSamlAssertingPartyDetails Instance
Closes gh-12667
2023-02-17 10:02:17 -07:00
Steve Riesenberg 5286b78308
Merge branch '6.0.x'
Closes gh-12684
2023-02-16 13:27:17 -06:00
Steve Riesenberg c4f68d83bf
Document default CsrfTokenRequestHandler in 6.0
Closes gh-12651
2023-02-16 13:26:23 -06:00
Marcus Da Coregio 4bb944e7e5 Merge branch '6.0.x' 2023-02-16 10:58:02 -03:00
Marcus Da Coregio 5ccf414f02 Merge branch '5.8.x' into 6.0.x 2023-02-16 10:57:33 -03:00
Marcus Da Coregio 82c86b822f Polish session-management.adoc
Remove unresolved anchor

Issue gh-12519
2023-02-16 10:57:02 -03:00
Marcus Da Coregio 78c70d8c9b Merge branch '6.0.x' 2023-02-16 10:53:27 -03:00
Marcus Da Coregio e59f71f036 Polish session-management.adoc
Remove default values from configuration

Issue gh-12519
2023-02-16 10:52:55 -03:00
Marcus Da Coregio 5d8df25b10 Merge branch '6.0.x'
Closes gh-12681
2023-02-16 10:44:12 -03:00
Marcus Da Coregio ce222de7e6 Merge branch '5.8.x' into 6.0.x
Closes gh-12680
2023-02-16 10:42:56 -03:00
Marcus Da Coregio 4f3faa78f7 Revisit Session Management docs
Closes gh-12519
2023-02-16 10:39:59 -03:00
Josh Cummings c4485a8909
Merge branch '6.0.x' 2023-02-07 14:15:26 -07:00
Dmitriy Grushin 2b36499700 Update expression-based.adoc
Removed a duplicate paragraph that was phrased a bit differently.
2023-02-07 13:00:59 -07:00
Dan Allen c47fbf7cfd move code comment to callout 2023-01-18 14:41:57 -06:00
Rob Winch 5beabbe357 Merge branch '5.7.x' into 5.8.x
Closes gh-12553
2023-01-17 15:03:14 -06:00
Dan Allen f5bc6ce665 fix unclosed block in docs 2023-01-17 15:02:30 -06:00
Josh Cummings ce11015e53
Merge branch '6.0.x'
Closes gh-12518
2023-01-10 10:44:21 -07:00
Josh Cummings 21ceb333a8
Merge branch '5.8.x' into 6.0.x
Closes gh-12517
2023-01-10 10:43:25 -07:00
Josh Cummings 6f43104eb3
Merge branch '5.7.x' into 5.8.x
Closes gh-12516
2023-01-10 10:42:45 -07:00
Josh Cummings 2028507bf8
Fix Typo in Sample
Closes gh-11095
2023-01-10 10:38:28 -07:00
Josh Cummings cb18e34b76
Merge branch '6.0.x' 2023-01-05 10:33:38 -07:00
Olivier Délèze 9535566f84 Update multitenancy.adoc
The Java example at line 421 should use the injected `jwtValidator` and not from the current class referenced by `this. jwtValidator`.
2023-01-05 10:32:57 -07:00
Marcus Da Coregio 73c12f9aa8 Merge branch '6.0.x' 2022-12-19 16:53:35 -03:00
Marcus Da Coregio b9f9139f5e Merge branch '5.8.x' into 6.0.x 2022-12-19 16:53:22 -03:00
Marcus Da Coregio 5406fed5dc Merge branch '5.7.x' into 5.8.x 2022-12-19 16:53:05 -03:00
Eleftheria Stein-Kousathana fbfa13bd47 Fix OAuth 2.0 testing docs 2022-12-19 16:52:25 -03:00
Steve Riesenberg 00019c1fb9
Merge branch '6.0.x'
Closes gh-12406
2022-12-15 14:41:27 -06:00
Steve Riesenberg ed657a8fac
Polish gh-12280
Apply editing changes from gh-9668
2022-12-15 14:18:24 -06:00
Wilson-Emmanuel edd1915d1b
Corrected errors on the ACLS document
Closes gh-12270
2022-12-15 14:16:55 -06:00
Marcus Da Coregio 0fdcde2d6f Merge branch '6.0.x' 2022-12-05 14:42:42 -08:00
Marcus Da Coregio 2fdf762726 Merge branch '5.8.x' into 6.0.x 2022-12-05 14:41:59 -08:00
Marcus Da Coregio 7aaa25b88e Merge branch '5.7.x' into 5.8.x 2022-12-05 14:40:54 -08:00
Marcus Da Coregio fc25b87967 Merge branch '5.6.x' into 5.7.x 2022-12-05 14:40:38 -08:00
Sellami 626e53d121 Fix: Replace tenantRepository with tenants 2022-12-05 14:31:24 -08:00
Marcus Da Coregio 547a1a11d1 Merge branch '6.0.x'
Closes gh-12342
2022-12-05 12:26:39 -08:00
Marcus Da Coregio 42a00e2003 Merge branch '5.8.x' into 6.0.x
Closes gh-12341
2022-12-05 12:26:00 -08:00
Marcus Da Coregio d2b33a2583 Fix docs
Closes gh-11396
2022-12-05 12:25:26 -08:00
Josh Cummings eb57d9e5c1
Merge branch '6.0.x' 2022-11-29 16:26:13 -07:00
Josh Cummings c60c10792c
Fix Observability Opt-out Documentation Typo
Issue gh-12268
2022-11-29 16:24:57 -07:00
Marcus Da Coregio e6173f9e5b Prepare for Spring Security 6.1 2022-11-28 15:47:10 -03:00
Marcus Da Coregio 3e0e532ed7 Merge branch '5.8.x' into 6.0.x
Closes gh-12287
2022-11-24 08:48:27 -03:00
Marcus Da Coregio 5db7ac4ce3 Merge branch '5.7.x' into 5.8.x
Closes gh-12286
2022-11-24 08:48:05 -03:00
Marcus Da Coregio 9b3f834bff Merge branch '5.6.x' into 5.7.x
Closes gh-12285
2022-11-24 08:47:46 -03:00
Marcus Da Coregio 70bfc39418 Fix AuthorizationFilter diagram in docs
Closes gh-12274
2022-11-24 08:46:16 -03:00
Steve Riesenberg 34102a6531
Document default SecurityContextRepository
Issue gh-12049
2022-11-18 16:14:22 -06:00
Steve Riesenberg 1a3be83084
Merge branch '5.8.x'
Closes gh-12185
2022-11-09 12:28:37 -06:00
Steve Riesenberg 9071f10759
Document DelegatingSecurityContextRepository
Closes gh-12069
2022-11-09 12:19:43 -06:00
Johannes Graf 8af3b5afe4 Fix documentation part of Multiple HttpSecurity Instances
`http.antMatcher()` is not longer available and was replaced with
`http.securityMatcher()`, so use this in the Java Config Multiple
HttpSecurity Instances example, too
2022-11-08 13:51:05 -03:00
Marcus Da Coregio c7b9b33cd1 Merge branch '5.8.x' 2022-11-03 08:23:50 -03:00
Marcus Da Coregio 4d646a2978 Merge branch '5.7.x' into 5.8.x 2022-11-03 08:23:26 -03:00
Marcus Da Coregio 067fc1678c Merge branch '5.6.x' into 5.7.x 2022-11-03 08:22:09 -03:00
Rivaldi 01a37dd678 Fix typo
(cherry picked from commit 20e89e3eca0823bfa329b5de80448bac1f5e0f30)
2022-11-03 08:21:48 -03:00
Márk Kővári aad01447c3 docs: fix realm typo 2022-11-03 08:21:26 -03:00
Josh Cummings cca999c57d
Merge remote-tracking branch 'origin/5.8.x' 2022-11-01 13:46:08 -06:00
Josh Cummings d29ab8bcae
Merge branch '5.7.x' into 5.8.x 2022-11-01 13:43:40 -06:00
Josh Cummings c94e33b6c8
Merge branch '5.6.x' into 5.7.x 2022-11-01 13:42:35 -06:00
Ger Roza 8315545144 Update RP-Initiated Logout target URLs.
The URLs we're using are not actually pointing to the OIDC RP-Initiated Logout Specs.

Fixes: gh-12081
2022-11-01 12:35:39 -06:00
Josh Cummings c5badbc631
Add AccessDecisionManager Preparation Steps
Issue gh-11337
2022-10-31 15:25:05 -06:00
Rob Winch 3da0d1bf27 Merge branch '5.8.x' 2022-10-27 15:39:03 -05:00
Rob Winch aac1261f0c Document Migration to SecurityContextHolderFilter
Closes gh-12098
2022-10-27 15:12:45 -05:00
Rob Winch d40ed58118 Merge branch '5.8.x'
Closes gh-12091
Closes gh-12092
2022-10-26 14:56:02 -05:00
Rob Winch c17e258a6f Document Saved Requests
Closes gh-12088
2022-10-26 14:22:30 -05:00
Josh Cummings 7adc000c6b
Merge remote-tracking branch 'origin/5.8.x' 2022-10-25 14:42:32 -06:00
Josh Cummings 04fa5af794
Add Missing Doc Header
The EnableMethodSecurity section
2022-10-25 14:41:11 -06:00
Josh Cummings fe96a62dfc
Document Observability Support
Issue gh-10964
2022-10-12 20:32:25 -06:00
Marcus Da Coregio c5e35bf32e Merge branch '5.8.x'
Closes gh-11978
2022-10-10 09:24:50 -03:00
Marcus Da Coregio 4b6fed0667 Add static factory method to AntPathRequestMather and RegexRequestMatcher
Closes gh-11938
2022-10-10 09:24:15 -03:00
Daniel Garnier-Moiroux 27059ced87
Default X-Xss-Protection header value to "0"
Closes gh-9631
2022-10-07 17:42:55 -05:00
Marcus Da Coregio 398f5dee7f Remove deprecated RequestMatcher methods from Java Configuration
Closes gh-11939
2022-10-07 15:26:46 -03:00
Marcus Da Coregio 9fd195d419 Default to shouldFilterAllDispatcherTypes=true in XML
Closes gh-11970
2022-10-07 11:46:20 -03:00
Marcus Da Coregio 146d3269bc Merge branch '5.8.x'
Closes gh-11971
2022-10-07 10:28:14 -03:00
Marcus Da Coregio f3321c256c Add XML support for shouldFilterAllDispatcherTypes
Closes gh-11492
2022-10-07 10:20:32 -03:00
Josh Cummings 12b9f2e196
use-authorization-manager defaults to true
Closes gh-11929
2022-10-06 08:12:46 -06:00
Marcus Da Coregio c4d23f2b49 Use MvcRequestMatcher by default if Spring MVC is present
Closes gh-11899
2022-10-06 09:12:04 -03:00
Steve Riesenberg 8b490de08d
Merge branch '5.8.x'
# Conflicts:
#	docs/modules/ROOT/pages/servlet/exploits/csrf.adoc
2022-10-05 14:46:15 -05:00
Steve Riesenberg dce1c30522
Add support for BREACH
Closes gh-4001
2022-10-05 14:21:13 -05:00
Marcus Da Coregio 38a7bbd2eb Merge branch '5.8.x' 2022-10-05 13:20:12 -03:00
Marcus Da Coregio ace8caa182 Remove mvcMatchers usage from docs
Issue gh-11347
2022-10-05 13:19:37 -03:00
Steve Riesenberg 5de6da890b
Merge branch '5.8.x'
Closes gh-dry-run
2022-10-04 11:18:00 -05:00
Steve Riesenberg 475b3bb6bb
Add deferred CsrfTokenRepository.loadDeferredToken
* Move DeferredCsrfToken to top-level and implement Supplier<CsrfToken>
* Move RepositoryDeferredCsrfToken to top-level and make package-private
* Add CsrfTokenRepository.loadToken(HttpServletRequest, HttpServletResponse)
* Update CsrfFilter
* Rename CsrfTokenRepositoryRequestHandler to CsrfTokenRequestAttributeHandler

Issue gh-11892
Closes gh-11918
2022-10-03 17:10:54 -05:00
Steve Riesenberg 7c3cc1e386
Merge branch '5.8.x' 2022-10-03 14:29:51 -05:00
Daniel Garnier-Moiroux 0e215a21ad
Add X-Xss-Protection headerValue to XML config
Issue gh-9631
2022-10-03 14:29:34 -05:00
Marcus Da Coregio ad2abd39dc Merge branch '5.8.x'
Closes gh-11347 in 6.0.x
Closes gh-11945
2022-10-03 16:02:18 -03:00
Marcus Da Coregio 039e0328e1 Simplify Java Configuration RequestMatcher Usage
If Spring MVC is present in the classpath, use MvcRequestMatcher by default. This commit also adds a new securityMatcher method in HttpSecurity

Closes gh-11347
Closes gh-9159
2022-10-03 15:55:20 -03:00
Steve Riesenberg 181ee7410b
Change default authority for oauth2Login()
Previously, the default authority was ROLE_USER when using
oauth2Login() for both OAuth2 and OIDC providers.

* Default authority for OAuth2UserAuthority is now OAUTH2_USER
* Default authority for OidcUserAuthority is now OIDC_USER

Documentation has been updated to include this implementation detail.

Closes gh-7856
2022-09-26 10:06:31 -05:00
Steve Riesenberg bcb21c9384
Merge branch '5.8.x'
# Conflicts:
#	config/src/test/java/org/springframework/security/config/annotation/web/configuration/DeferHttpSessionJavaConfigTests.java
2022-09-23 15:39:43 -05:00
Steve Riesenberg 46696a9226
CsrfTokenRequestHandler extends CsrfTokenRequestResolver
Closes gh-11896
2022-09-23 15:09:00 -05:00
Rob Winch 0efe26c1fd Merge branch '5.8.x'
Closes gh-11894
2022-09-22 13:47:04 -05:00
Rob Winch d94677f87e CsrfTokenRequestAttributeHandler -> CsrfTokenRequestHandler
This renames CsrfTokenRequestAttributeHandler to CsrfTokenRequestHandler and
moves usage from CsrfFilter into CsrfTokenRequestHandler.

Closes gh-11892
2022-09-22 11:09:44 -05:00
Rob Winch 48e31f87e4 Remove Deprecated OpenSAML 3 Support
Closes gh-10556
2022-09-20 16:57:38 -06:00
Steve Riesenberg 2431dd1103
Merge branch '5.8.x' 2022-09-13 17:38:10 -05:00
Steve Riesenberg 355ef21117
Polish gh-11665 2022-09-13 16:45:39 -05:00
ch4mpy 1efb63387f
Add authentication converter for introspected tokens
Adds configurable authentication converter for resource-servers with
token introspection (something very similar to what
JwtAuthenticationConverter does for resource-servers with JWT decoder).

The new (Reactive)OpaqueTokenAuthenticationConverter is given
responsibility for converting successful token introspection result
into an Authentication instance (which is currently done by a private
methods of OpaqueTokenAuthenticationProvider and
OpaqueTokenReactiveAuthenticationManager).

The default (Reactive)OpaqueTokenAuthenticationConverter, behave the
same as current private convert(OAuth2AuthenticatedPrincipal principal,
String token) methods: map authorities from scope attribute and build a
BearerTokenAuthentication.

Closes gh-11661
2022-09-13 16:45:36 -05:00
Steve Riesenberg ed41a60aae
Merge branch '5.8.x'
# Conflicts:
#	config/src/test/java/org/springframework/security/config/annotation/web/configuration/DeferHttpSessionJavaConfigTests.java
#	config/src/test/resources/org/springframework/security/config/http/DeferHttpSessionTests-Explicit.xml
#	web/src/main/java/org/springframework/security/web/csrf/CsrfFilter.java
2022-09-06 11:51:55 -05:00
Steve Riesenberg 86fbb8db07 Add new interfaces for CSRF request processing
Issue gh-4001
Issue gh-11456
2022-09-06 11:43:33 -05:00
Marcus Da Coregio e17989d92d Merge branch '5.8.x' 2022-09-01 09:39:33 -03:00
Marcus Da Coregio ff6fd78d64 Merge branch '5.7.x' into 5.8.x 2022-09-01 09:39:10 -03:00
Marcus Da Coregio 0a08a23423 Merge branch '5.6.x' into 5.7.x 2022-09-01 09:38:33 -03:00
Underground Hill 8b74bf9742 Updated reference to architecture page
In the context of Servlet Authentication page, "Architecture" should probably link to "Servlet Authentication Architecture" page
2022-09-01 09:38:10 -03:00
Steve Riesenberg 8474acebf2
Merge branch '5.8.x' 2022-08-29 15:12:48 -05:00
he1ex-tG 568277f8bc
Mistake in Kotlin code representation is fixed 2022-08-29 15:11:10 -05:00
Josh Cummings b1fd9af723
Merge remote-tracking branch 'origin/5.8.x' into main 2022-08-26 16:01:40 -06:00
Josh Cummings 0f58620643 Add AspectJ AuthorizationManager Support
Closes gh-11326
2022-08-26 15:59:08 -06:00
Rob Winch 81d6b6df6c Add Explicit SessionAuthenticationStrategy Option
SessionAuthenticationFilter requires accessing the HttpSession to do its
job. Previously, there was no way to just disable the
SessionAuthenticationFilter despite the fact that
SessionAuthenticationStrategy is invoked by the authentication filters
directly.

This commit adds an option to disable SessionManagmentFilter in favor of
requiring explicit SessionAuthenticationStrategy invocation already
performed by the authentication filters.

Closes gh-11455
2022-08-18 17:38:03 -05:00
Rob Winch 89f8310d6c Add Explicit SessionAuthenticationStrategy Option
SessionAuthenticationFilter requires accessing the HttpSession to do its
job. Previously, there was no way to just disable the
SessionAuthenticationFilter despite the fact that
SessionAuthenticationStrategy is invoked by the authentication filters
directly.

This commit adds an option to disable SessionManagmentFilter in favor of
requiring explicit SessionAuthenticationStrategy invocation already
performed by the authentication filters.

Closes gh-11455
2022-08-18 17:00:47 -05:00
Rob Winch 8ad20b1768 Add CsrfFilter.csrfRequestAttributeName
Previously the CsrfToken was set on the request attribute with the name
equal to CsrfToken.getParameterName(). This didn't really make a lot of
sense because the CsrfToken.getParameterName() is intended to be used as
the HTTP parameter that the CSRF token was provided. What's more is it
meant that the CsrfToken needed to be read for every request to place it
as an HttpServletRequestAttribute. This causes unnecessary HttpSession
access which can decrease performance for applications.

This commit allows setting CsrfFilter.csrfReqeustAttributeName to
remove the dual purposing of CsrfToken.parameterName and to allow deferal
of reading the CsrfToken to prevent unnecessary HttpSession access.

Issue gh-11699
2022-08-16 13:47:31 -05:00
Rob Winch 5b64526ba9 Add CsrfFilter.csrfRequestAttributeName
Previously the CsrfToken was set on the request attribute with the name
equal to CsrfToken.getParameterName(). This didn't really make a lot of
sense because the CsrfToken.getParameterName() is intended to be used as
the HTTP parameter that the CSRF token was provided. What's more is it
meant that the CsrfToken needed to be read for every request to place it
as an HttpServletRequestAttribute. This causes unnecessary HttpSession
access which can decrease performance for applications.

This commit allows setting CsrfFilter.csrfReqeustAttributeName to
remove the dual purposing of CsrfToken.parameterName and to allow deferal
of reading the CsrfToken to prevent unnecessary HttpSession access.

Issue gh-11699
2022-08-15 17:07:02 -05:00
Rob Winch 425b3501b7 Remove `@Configuration` from `@Enable*` Annotations
This removes `@Configuration` from all `@Enable` Annotations and explicitly
adds `@Configuration` to wherever the `@Enable*` Annotations are used.

Closes gh-11653
2022-08-09 17:00:24 -05:00
Rob Winch a5069d7e35 Fix Add @Configuration to @Enable*Security Usage
Issue gh-6613
2022-08-09 17:00:16 -05:00
Igor Bolic 2e66b9f6cc Allow customization of redirect strategy
The default redirect strategy will provide authorization redirect
URI within HTTP 302 response Location header.
Allowing the configuration of custom redirect strategy will provide
an option for the clients to obtain the authorization URI from e.g.
HTTP response body as JSON payload, without a need to handle
automatic redirection initiated by the HTTP Location header.

Closes gh-11373
2022-08-08 15:44:01 -05:00
Igor Bolic efaee4e56b Allow customization of redirect strategy
The default redirect strategy will provide authorization redirect
URI within HTTP 302 response Location header.
Allowing the configuration of custom redirect strategy will provide
an option for the clients to obtain the authorization URI from e.g.
HTTP response body as JSON payload, without a need to handle
automatic redirection initiated by the HTTP Location header.

Closes gh-11373
2022-08-08 15:35:49 -05:00
Joshua Sattler 040111ae9e Remove Configuration meta-annotation from Enable* annotations
Before, Spring Security's @Enable* annotations were meta-annotated with @Configuration.
While convenient, this is not consistent with the rest of the Spring projects and most notably
Spring Framework's @Enable annotations. Additionally, the introduction of support for
@Configuration(proxyBeanMethods=false) in Spring Framework provides a compelling reason to
remove @Configuration meta-annotation from Spring Security's @Enable annotations and allow
users to opt into their preferred configuration mode.

Closes gh-6613

Signed-off-by: Joshua Sattler <joshua.sattler@mailbox.org>
2022-07-30 03:48:42 +02:00
Marcus Da Coregio 0c549ee147 Use SHA256 by default in Remember Me
Closes gh-11520
2022-07-25 10:33:12 -03:00
Marcus Da Coregio f45c4d4b8e Add SHA256 as an algorithm option for Remember Me token hashing
Closes gh-8549
2022-07-15 10:41:03 -03:00
Marcus Da Coregio dda98f333c Polish
Make encodingAlgorithm final and add it to the constructor
Add since tags
Add more tests
2022-07-15 10:34:36 -03:00
Marcus Da Coregio e17fe8ced9 Add SHA256 as an algorithm option for Remember Me token hashing
Closes gh-8549
2022-07-15 10:34:36 -03:00
Josh Cummings 35fc437559
Add AuthorizationManager for protect-pointcut
Closes gh-11323
2022-07-14 09:25:49 -06:00
Marcus Da Coregio 9608eaa138 Clarify authorize-http-requests docs
Issue gh-11467
2022-07-14 10:19:31 -03:00
Marcus Da Coregio 64ba31aebb Improve docs on dispatcherTypeMatcher
Closes gh-11467
2022-07-14 10:08:19 -03:00
Marcus Da Coregio 57d6ab7134 Improve docs on dispatcherTypeMatcher
Closes gh-11467
2022-07-14 09:13:46 -03:00
Josh Cummings 624fdfa731
Add AuthorizationManager for protect-pointcut
Closes gh-11323
2022-07-13 17:58:16 -06:00
Marcus Da Coregio 6455e98745 FilterSecurityInterceptor applies to every request by default
Closes gh-11466
2022-07-12 10:53:03 -03:00
Tim te Beek ce67fb08fd
Clearly end sentence in note before next sentence 2022-07-11 17:38:44 -06:00
Tim te Beek 6e63278ab9
Use Collection<ConfigAttribute> in examples
To match `org.springframework.security.access.ConfigAttribute`.
2022-07-11 17:38:44 -06:00
Tim te Beek 2c0a4337a8
Clearly end sentence in note before next sentence 2022-07-11 17:36:30 -06:00
Tim te Beek 9f4b0ca8b5
Use Collection<ConfigAttribute> in examples
To match `org.springframework.security.access.ConfigAttribute`.
2022-07-11 17:36:30 -06:00
Josh Cummings 148c926de0
Support AuthorizationManager for intercept-methods Element
Closes gh-11328
2022-07-06 13:01:57 -06:00
Josh Cummings 74a007dc91
Support AuthorizationManager for intercept-methods Element
Closes gh-11328
2022-07-06 12:54:05 -06:00
Josh Cummings bffe08465a
Add SecurityContextHolderStrategy XML Configuration for Messaging
Issue gh-11061
2022-06-27 16:24:27 -06:00
Josh Cummings 74167d62b1
Add SecurityContextHolderStrategy XML Configuration for Messaging
Issue gh-11061
2022-06-27 15:55:28 -06:00
Josh Cummings 5e4e7abf15
Add SecurityContextHolderStrategy XML Configuration for Method Security
Issue gh-11061
2022-06-27 13:40:55 -06:00
Josh Cummings 9cd7c7b046
Add SecurityContextHolderStrategy XML Configuration for Method Security
Issue gh-11061
2022-06-27 13:05:07 -06:00
Vinícius Hashimoto 11a74a2926 Fix method call example on documentation 2022-06-24 17:05:31 -06:00
Josh Cummings 150b81d008
Add SecurityContextHolderStrategy XML Configuration for Defaults
Issue gh-11061
2022-06-17 12:21:10 -06:00
Josh Cummings 2a70707c35 Add SecurityContextHolderStrategy XML Configuration for Defaults
Issue gh-11061
2022-06-17 11:28:10 -06:00
sKai.fun a3e996a66b Fix title render issue of Digest Authentication document
Closes gh-11272
2022-06-01 17:33:41 -05:00
sKai.fun 953b54f63d Fix title render issue of Digest Authentication document
Closes gh-11272
2022-06-01 15:15:03 -05:00
sKai.fun 6b1d5ec6ae Fix title render issue of Digest Authentication document
Closes gh-11272
2022-06-01 15:13:06 -05:00
André Luis Gomes aca3fc2412 Update opaque-token.adoc
Fixing yaml sample in Servlet and Reactive pages
2022-06-01 08:51:44 -03:00
André Luis Gomes 0c31cb21dc Update opaque-token.adoc
Fixing yaml sample in Servlet and Reactive pages
2022-06-01 08:50:56 -03:00
André Luis Gomes 24701b547f Update opaque-token.adoc
Fixing yaml sample in Servlet and Reactive pages
2022-06-01 08:49:47 -03:00
André Luis Gomes b9acdd5058 Update opaque-token.adoc
Fixing yaml sample in Servlet and Reactive pages
2022-06-01 13:43:42 +02:00
Josh Cummings 2afa9313eb
Use AuthorizationManager in <http>
Closes gh-11305
2022-05-31 16:01:41 -06:00
Josh Cummings 9dbd1f3e25
Use AuthorizationManager in <http>
Closes gh-11305
2022-05-31 15:10:00 -06:00
Josh Cummings d7077b441a
Correct access(String) reference
Closes gh-11280
2022-05-27 15:00:15 -06:00
Josh Cummings 292585080a
Correct access(String) reference
Closes gh-11280
2022-05-27 14:59:06 -06:00