spring-security

Commit Graph

Author	SHA1	Message	Date
Luke Taylor	6d6c2d31ef	SEC-1462: Only apply session fixation protection strategy if request.isRequestedSessionIdValid() returns true. We don't need to create a new session if the current one already has a different Id from the client.	16 years ago
Luke Taylor	0760bb947b	SEC-1458: Remove logger field in HttpSessionEventPublisher in favour of direct lookup. Prevents early initialization of logging system when listener is initialized.	16 years ago
Luke Taylor	b8e50c0933	SEC-1439: Make getters and setters public on HttpRequestResponseHolder. Necessary to allow use of custom SecurityContextRepository.(cherry picked from commit `d5df53f1db`)	16 years ago
Luke Taylor	677576ea8b	SEC-1429: Fix test. Wasn't setting allowSessionCreation=false on failure handler.	16 years ago
Luke Taylor	1b0ac9c785	Porting of gradle changes from master.	16 years ago
Luke Taylor	5a5b62e2cb	SEC-1429: Removed cached authentication from session after successful authentication.(cherry picked from commit `43f0e11106`)	16 years ago
Luke Taylor	6ac8588144	Fix to Javadoc for AbstractAuthenticationProcessingFilter.(cherry picked from commit `a3263753d9`)	16 years ago
Luke Taylor	5690f1c581	SEC-1428: Check if response has been committed before redirecting to target URL in AbstractAuthenticationTargetUrlRequestHandler.	16 years ago
Luke Taylor	87cf27ab7c	SEC-1429: Move logic for saving of AuthenticationException into the SimpleUrlAuthenticationFailurehandler from AbstractAuthenticationProcessingFilter. It will also now use request scope if configured to do a forward instead of a redirect.	16 years ago
Luke Taylor	a7e21318bf	SEC-1425: Replace use of Java 1.6 String.isEmpty().	16 years ago
Luke Taylor	b46ae6ac62	SEC-1425: Add check for empty cookie in AbstractRememberMeServices. Prevents ArrayOutOfBoundsException later when processing the tokeniszed cookie.	16 years ago
Luke Taylor	9831980bc2	Update versions to 3.0.3.CI-SNAPSHOT.	16 years ago
Luke Taylor	44f45d21f0	3.0.2 release. Update version in build files.	16 years ago
Luke Taylor	14ae36ac3b	SEC-1412: Modify DefaultSavedRequest to ignore If-Not-Matched header. The browser (or at least Firefox) does not send it after a redirect, and it causes problems with Spring's ShallowEtagHeaderFilter if it is stored and returned by the saved request.	16 years ago
Luke Taylor	bd635edc31	SEC-1410: Makes sure usernames which are OpenID https identities are detected as well as http ones. Using ":" as the token delimiter means we accidentally mistake the URL for two tokens. This had previously been fixed for http URLs but not https ones.	16 years ago
Luke Taylor	c1133d1ef3	Removed unused import in DelegatingAuthenticationEntryPoint and corrected test class name.	16 years ago
Luke Taylor	d30e31d816	Remove unnecessary @SuppressWarnings and inline dependency from ELRequestMatcher (util package) to core ExpressionUtils.	16 years ago
Luke Taylor	c12c43da9e	Javadoc fixes.	16 years ago
Luke Taylor	36612377e2	Replace package.html with package-info.java files, creating new ones where missing and updating outdated contents.	16 years ago
Luke Taylor	1e4f451352	Moved DelegatingAuthenticationEntryPointTest-context.xml to test/resources	16 years ago
Luke Taylor	dcbdfc2026	SEC-1396: Implement eager saving of SecurityContext in SessionManagementFilter on authentication. The user is then seen as being authenticated to further (re-entrant) requests which occur before the existing request has completed. The saving logic is contained with the SecurityContextRepository implementation.	16 years ago
Mike Wiesner	90d6ff1fde	SEC-1406: Create a DelegatingAuthenticationEntryPoint	16 years ago
Mike Wiesner	d32b078a8c	SEC-1406: Create a DelegatingAuthenticationEntryPoint	16 years ago
Mike Wiesner	d2413cf237	SEC-1406: Create a DelegatingAuthenticationEntryPoint	16 years ago
Luke Taylor	08c7155ab5	SEC-1404: Refactored IP subnet matching into IpAddressMatcher class to allow it to be used outside expressions.	16 years ago
Luke Taylor	1ecd3e228b	SEC-1405: added RequestMatcher interface.	16 years ago
Luke Taylor	984604b026	SEC-1384: Removed check for empty authority list from DefaultWebInvocationPrivilegeEvaluator. The class previously rejected access if the user had no authorities. It will now allow the AccessDecisionManager to make the decision.	16 years ago
Luke Taylor	0974e21fb6	SEC-1379: Added creation of a session if session timeout is detected (requested session ID is invalid). This prevents problems with repeated detection of the same invalid session when the redirected request comes in.	16 years ago
Luke Taylor	04447bdbf0	SEC-1377: Extended HTML escaping functionality to take account of control characters, whitespace and to handle Unicode supplementary characters (surrogate pairs).	16 years ago
Luke Taylor	0c10efbbf8	Revert SEC-1356. Checking the path of a submitted cookie will never work as the path is not sent by the browser, so will be null.	16 years ago
Luke Taylor	1a7f71fc0f	SEC-1372: Return an empty list rather than null from SessionRegistryImpl.getAllSessions() If the principal has no sessions, null is returned which contradicts the interface contract. In practice it didn't matter as the null was checked for, but it is cleaner to disallow a null value.	16 years ago
Luke Taylor	51dfc0fb39	Set versions to 3.0.2-CI-SNAPSHOT, post release.	16 years ago
Luke Taylor	05634f97dc	Updated version numbers for 3.0.1 release.	16 years ago
Luke Taylor	a9567a58d8	SEC-1359,SEC-1360,SEC-1361,SEC-1363,SEC-1364,SEC-1365,SEC-1366,SEC-1367: Minor doc and Javadoc typos.	16 years ago
Luke Taylor	3a8daa1bf4	Gradle build improvements. Added generation of source archives and trial support for maven deployment and pom generation, with "provided" configuration mapped to "provided" scope.	16 years ago
Luke Taylor	f62d97b092	SEC-1356: Fix broken tests. Test cookies now require that the path be set in order for them to be recognised for auto-login purposes..	16 years ago
Luke Taylor	6eff4d90b7	SEC-1356: Modify AbstractRememberMeService to check the cookie path as well as the name when extracting it from the incoming request. This makes things consistent with the cookie setting methods. If someone wants to share a cookie between multiple applications then they should modify the cookie extraction and setting methods to use a less-specific path.	16 years ago
Luke Taylor	2023ca283e	SEC-1358: Support empty context path in DefaultWebInvocationPrivilegeEvaluator This class was failing when an application was deployed at the root context because of an assertion which checked that the contexPath was not empty. An empty context path doesn't actually cause problems for the class so I've removed the assertion.	16 years ago
Luke Taylor	b323098167	Added gradle build files for taglibs, tutorial, contacts and openid. Changed build file names to match module names (by manipulating the project objects in the settings.gradle file).	16 years ago
Luke Taylor	e211f9b35f	SEC-1349: Allow configuration of OpenID with parameters which should be transferred to the return_to URL. The OpenIDAuthenticationFilter now has a returnToUrlParameters property (a Set). If this is set, the named parameters will be copied from the incoming submitted request to the return_to URL. If not set, it defaults to the "parameter" property of the AbstractRememberMeServices of the parent class. If remember-me is not in use, it defaults to the empty set. Enabled remember-me in the OpenID sample.	16 years ago
Luke Taylor	bc02fc2de1	Corrected "incorrect numer of tokens" error message in TokenBasedRememberMeServices.	16 years ago
Luke Taylor	052537c8b0	Removing $Id$ markers and stripping trailing whitespace from the codebase.	16 years ago
Luke Taylor	f5d36aef65	SEC-1350: Improved Javadoc for AbstractPreAuthenticatedProcessingFilter Added clarification that the credentials returned by the subclass should not be null or they will typically be rejected by the provider. Also added some general overview.	16 years ago
Luke Taylor	c6b8fe5e55	SEC-1346: Added missing 'return' statements after redirects. ConcurrentSessionFilter and SessionManagementFilter now return immediately after redirecting to the expired URL and invalid session URLs respectively. Extra tests added to check.	16 years ago
Luke Taylor	893f212fa5	Tidying	16 years ago
Luke Taylor	115d5b84ff	[maven-release-plugin] prepare for next development iteration	16 years ago
Luke Taylor	6c6ef08353	[maven-release-plugin] prepare release spring-security-3.0.0.RELEASE	16 years ago
Luke Taylor	e64866ae6a	Updated bundlor templates and introduced spring.version variable	16 years ago
Luke Taylor	3418aab46e	SEC-1327: Javadoc additions to clarify some behaviour	16 years ago
Luke Taylor	fcce29f8df	SEC-1326: Updating dependencies to match Spring versions. Removing unused deps.	16 years ago

1 2 3 4

182 Commits (304f12fb63e528008dd677ed73624feecb0e6229)