spring-security

Commit Graph

Author	SHA1	Message	Date
Josh Cummings	12b9f2e196	use-authorization-manager defaults to true Closes gh-11929	3 years ago
Marcus Da Coregio	52ab2303da	Fix failing test Issue gh-11061	3 years ago
Marcus Da Coregio	c4d23f2b49	Use MvcRequestMatcher by default if Spring MVC is present Closes gh-11899	3 years ago
Josh Cummings	2079309c5a	Add SecurityContextHolderStrategy XML Configuration for OAuth2 Issue gh-11061	3 years ago
Josh Cummings	7543effe89	Add SecurityContextHolderStrategy Java Configuration for OAuth2 Issue gh-11061	3 years ago
Josh Cummings	7e3841105b	Add SecurityContextHolderStrategy XML Configuration for Saml2 Issue gh-11061	3 years ago
Josh Cummings	19181a5afd	Add SecurityContextHolderStrategy Java Configuration for Saml2 Issue gh-11061	3 years ago
Josh Cummings	0c0e298aa7	Polish Saml2 XML Use of SecurityContextHolderStrategy Issue gh-11061	3 years ago
Josh Cummings	b4d13e7726	Polish use-authorization-manager - Use SecurityContextHolderStrategy - Allow empty role prefix - Disallow access-decision-manager-ref and authorization-manager-ref together Issue gh-11305	3 years ago
Josh Cummings	7043ef6ccb	Polish OpaqueTokenAuthenticationConverterTests Issue gh-11665	3 years ago
Steve Riesenberg	dce1c30522	Add support for BREACH Closes gh-4001	3 years ago
Steve Riesenberg	6bbf20be93	Fix failing tests Issue gh-11952	3 years ago
Steve Riesenberg	1d706ae13d	Add csrfTokenRequestResolver to CsrfDsl Closes gh-11952	3 years ago
Marcus Da Coregio	c2ed65c67a	Fix failing tests Issue gh-9159	3 years ago
Marcus Da Coregio	bf6e85ec15	Accept String varargs in securityMatcher Issue gh-9159	3 years ago
Marcus Da Coregio	76d7a85bc0	Use modified classpath test support for tests that depend on the classpath Issue gh-11347	3 years ago
Marcus Da Coregio	77dcc691b3	Add modified classpath test support Closes gh-11951	3 years ago
Marcus Da Coregio	5002199be3	Revert "Disable tests that need Spring MVC mocked in classpath" This reverts commit `c6978fba7c`.	3 years ago
Marcus Da Coregio	35f7e46d05	Remove WebSecurityConfigurerAdapter Closes gh-10902	3 years ago
Steve Riesenberg	3bc76815c2	Update csrf.request-handler-ref in 6.0 Issue gh-11918	3 years ago
Marcus Da Coregio	c6978fba7c	Disable tests that need Spring MVC mocked in classpath Issue gh-11347	3 years ago
Steve Riesenberg	475b3bb6bb	Add deferred CsrfTokenRepository.loadDeferredToken * Move DeferredCsrfToken to top-level and implement Supplier<CsrfToken> * Move RepositoryDeferredCsrfToken to top-level and make package-private * Add CsrfTokenRepository.loadToken(HttpServletRequest, HttpServletResponse) * Update CsrfFilter * Rename CsrfTokenRepositoryRequestHandler to CsrfTokenRequestAttributeHandler Issue gh-11892 Closes gh-11918	3 years ago
Steve Riesenberg	c847efd3fd	Fix servlet import Issue gh-11347 Issue gh-9159	3 years ago
Steve Riesenberg	c98de7af2f	Add xss-protection.header-value in 6.0 Issue gh-9631	3 years ago
Daniel Garnier-Moiroux	0e215a21ad	Add X-Xss-Protection headerValue to XML config Issue gh-9631	3 years ago
Marcus Da Coregio	039e0328e1	Simplify Java Configuration RequestMatcher Usage If Spring MVC is present in the classpath, use MvcRequestMatcher by default. This commit also adds a new securityMatcher method in HttpSecurity Closes gh-11347 Closes gh-9159	3 years ago
Steve Riesenberg	d9a682a414	Polish gh-11896	3 years ago
Steve Riesenberg	7f9600ae08	Polish gh-11896	3 years ago
Marcus Da Coregio	64a19de4dc	Deprecate HPKP security header Closes gh-10144	3 years ago
Rob Winch	4479cefade	Default Require Explicit Session Management = true Closes gh-11763	3 years ago
Rob Winch	0d58c5180e	Remove Explicit RequestCache Config from DeferHttpSession Tests Issue gh-11757	3 years ago
Rob Winch	12a0ccf6de	Remove Explicit CSRF Config from DeferHttpSessionTests Issue gh-11764	3 years ago
Rob Winch	6d56af7b65	SessionManagementDsl.requireExplicitAuthenticationStrategy	3 years ago
Daniel Garnier-Moiroux	93250013e4	Make X-Xss-Protection configurable through ServerHttpSecurity OWASP recommends using "X-Xss-Protection: 0". The default is currently "X-Xss-Protection: 1; mode=block". In 6.0, the default will be "0". This commits adds the ability to configure the xssProtection header value in ServerHttpSecurity. This commit deprecates the use of "enabled" and "block" booleans to configure XSS protection, as the state "!enabled + block" is invalid. This impacts HttpSecurity. Issue gh-9631	3 years ago
Marcus Da Coregio	cf3349f31a	Configure ContentNegotiationStrategy in HttpSecurityConfiguration Closes gh-11916	3 years ago
Josh Cummings	506e50bfd0	Move Saml2 Authentication Filters Issue gh-8819	3 years ago
Steve Riesenberg	181ee7410b	Change default authority for oauth2Login() Previously, the default authority was ROLE_USER when using oauth2Login() for both OAuth2 and OIDC providers. * Default authority for OAuth2UserAuthority is now OAUTH2_USER * Default authority for OidcUserAuthority is now OIDC_USER Documentation has been updated to include this implementation detail. Closes gh-7856	3 years ago
Josh Cummings	37a160245f	Adjust OAuth2 Resource Server packaging Closes gh-7349	3 years ago
Steve Riesenberg	21c0c73878	Remove request-resolver-ref in 6.0 Issue gh-11896	3 years ago
Steve Riesenberg	46696a9226	CsrfTokenRequestHandler extends CsrfTokenRequestResolver Closes gh-11896	3 years ago
Steve Riesenberg	3c66ef6305	Change default SecurityContextRepository Save SecurityContext in request attributes for stateless session management using RequestAttributeSecurityContextRepository. Closes gh-11026	3 years ago
Rob Winch	d94677f87e	CsrfTokenRequestAttributeHandler -> CsrfTokenRequestHandler This renames CsrfTokenRequestAttributeHandler to CsrfTokenRequestHandler and moves usage from CsrfFilter into CsrfTokenRequestHandler. Closes gh-11892	3 years ago
Josh Cummings	44b7847258	Fix Import Order Issue gh-8819	3 years ago
Josh Cummings	70460ca009	Adjust OAuth2 Resource Server packaging Closes gh-7349	3 years ago
Josh Cummings	61c80bcac5	Move Saml2 Authentication Filters Closes gh-8819	3 years ago
Rob Winch	48e31f87e4	Remove Deprecated OpenSAML 3 Support Closes gh-10556	3 years ago
Josh Cummings	3f8503f1b4	Deprecate AccessDecisionManager et al Closes gh-11302	3 years ago
Marcus Da Coregio	bd18c05a27	Use mock class instead of interface on mock's return Issue gh-11860	3 years ago
slam	45bbd86f7e	HttpSecurityDsl should support apply method Closes gh-11754	3 years ago
Steve Riesenberg	1aee40dcca	Polish gh-11665 * Add authentication-converter-ref to 6.0 * Add @Configuration to test configs	3 years ago

... 2 3 4 5 6 ...

2468 Commits (6.0.x)