21ed5feb8d
SEC-1600: Added Implementation-Version and Implementation-Title to manifest templates and checking of version numbers in namespace config module and core. Config checks the version of core it is running against and core checks the Spring version, reporting any mismatches or situations where the app is running with less than the recommended Spring version.
16 years ago
f70942c6f5
SEC-1589: Add support for property placeholder in intercept-methods access attribute.
16 years ago
173537f4f2
SEC-1584: Added namespace support for injecting custom HttpFirewall instance into FilterChainProxy.
16 years ago
0961671772
Reinstated missing 3.0.3 schema file
16 years ago
f455e9a5a4
SEC-1584: Documentation of request-checking and matching process. Logging of servletPath and and pathInfo in DebugFilter for comparison.
16 years ago
7d97adc687
SEC-1584: Addition of HttpFirewall strategy to FilterChainProxy to reject un-normalized requests and wrap the incoming request object before processing by the security filter chain to provide a more consistent representation of paths than is guaranteed by the servlet spec. The wrapper strips path parameters from pathInfo and servletPath to provide consistency of URL matching across servlet containers and protect against bypassing security constraints by the malicious addition of such parameters to the URL. The paths are canonicalized further by replacing of multiple sequences of "/" characters with a single "/".
16 years ago
ee12d54bec
SEC-1536: moved web.authentication.jaas to web.jaasapi
...
Renamed org.springframework.security.web.authentication.jaas to org.springframework.security.web.jaasapi to be better aligned with org.springframework.security.web.servletapi, added package-info.java, and removed trailing whitespaces
16 years ago
e69b981c72
Make method in MatcherType public for use in OAuth.
16 years ago
11a87d1fa0
Switch to using xsd:boolean in schema file.
16 years ago
1b2b371970
SEC-1544: Added CookieClearingLogoutHandler and 'delete-cookies' attribute to the 'logout' namespace element.
...
When the user logs out, the handler will attempt to delete the named cookies (which it is constructor-injected with) by expiring them in the response.
Also added documentation on the feature and a suggestion for deleting JSESSIONID through an Apache proxy server, if the servlet container doesn't allow clearing the session cookie.
16 years ago
383211561c
Moved LDAP placeholder config test into LDAP tests to prevent issues with parallel tests. Converted LdapProviderBDP tests to groovy/spock. Other misc tidying of config tests.
16 years ago
7dd8cd2fb9
Make sure ApacheDS work directory is set correctly for separate LDAP test task in config module.
16 years ago
a128e3b4fe
http://forum.springsource.org/showthread.php?p=318755 Added PlaceHolderAndELConfigTests.ldapAuthenticationProviderWorksWithPlaceholders
16 years ago
de819378fc
SEC-1536: added JAAS API Integration, updated doc, updated jaas sample
16 years ago
0217e98bdb
Added an AppListener to collect events for use in tests
16 years ago
f4d57ab5e8
SEC-1456: Remove maven poms as we are now using gradle for the build.
16 years ago
20988c8cf6
Minor refactoring of debug filter and tidying up tests.
16 years ago
bdb906e588
Enable parameterization for log levels in logback files to allow the use of command-line options for controlling log output.
16 years ago
1db83fc81e
Minor BD parser tidying.
16 years ago
c37ca1c2a9
Sample app build adjustments to remove unwanted deps such as jsp-api, tidy up use of JSTL, make sure all are using servlet 2.5 etc.
16 years ago
5f6bcc0e1e
SEC-1540: Fix to add HTTP-method specific support for namespace requires-channel attribute.
16 years ago
3c02989d67
Removal of jmock test dependency and upgrading of mockito version to 1.8.5. Minor adjustments to other build deps and configurations (e.g. prevent groovy from being used as a transitive dep, since we only use it for tests).
16 years ago
aafc5f9038
File rename to correct case.
16 years ago
1f520b691f
SEC-1469: Initial support for debugging filter.
16 years ago
591bd532bd
Polishing FilterChainProxy and its tests.
16 years ago
6abfa2e887
Update minimum required schema to 3.1.
16 years ago
4bd41cbf72
SEC-1133: Support for setting of authenticationDetailsSource property for form-login, openid-login, http-basic and x509 namespace elements. These elements now support an additional 'authentication-details-source-ref' attribute.
16 years ago
4935aa07c7
SEC-1535: Added suggested doc fixes.
16 years ago
2222a7be07
Use Integer.valueOf() in preference to new Integer()
16 years ago
dca0fd871c
SEC-1532: Add cache of previously matched beans to ProtectPointcutPostProcessor to ensure that it doesn't perform pointcut matching every time a new prototype bean is created.
16 years ago
85c4c91e0e
IDEA inspection refactorings.
16 years ago
413b2a06e3
Improvements in up-to-date checking and use of parallel tests where possible.
16 years ago
64375484a1
More build and logging tuning.
16 years ago
2d9a848265
Added missing gradle build files for remaining samples. Some related reordering, dependency fixing etc. CAS sample no longer requires two separate subprojects as both client and server app can be run from a single gradle build.
16 years ago
c1c8fd1874
SEC-1171: Changed attribute name/value from secured="false" to security="none" to allow future extension by adding extra options (e.g. contextOnly to provide security context information during the request).
16 years ago
a4fd191499
Added check for use of "ref" with other attributes in <authentication-provider>.
16 years ago
4683273c2c
Correct message in namespace handler when web classes are missing.
16 years ago
69a10c48ae
Switch to using slf4j/logback for logging.
...
We still compile modules against commons-logging but all runtime logging and samples will use logback
16 years ago
443ac0487a
SEC-1093: Namespace support for jee element.
...
Adds a J2eePreAuthenticatedProcessingFilter to the stack, using a SimpleAttributes2GrantedAuthoritiesMapper to process the role attributes defined in the "mappable-roles" attribute. Provider uses a PreAuthenticatedGrantedAuthoritiesUserDetailsService by default.
16 years ago
026517f674
Removal of deprecated methods and classes.
16 years ago
6a79cf7be2
SEC-1383: Make MethodSecurityMetadataSourceBeanDefinitionParser extend AbstractBeanDefinitionParser for automatic support of ID attribute.
16 years ago
cd946c4e23
SEC-1493: Added namespace support.
16 years ago
8bddc8f820
SEC-1484: Documentation for some namespace attributes.
16 years ago
2e865752ff
Upgraded groovy to 1.7.2 to avoid jansi dependency issue
16 years ago
efb600166a
SEC-1488: Remove commons-logging dependencies from maven poms.
16 years ago
f7405cef82
Removed original Java version of refactored http namespace tests.
16 years ago
34401416b0
SEC-1171: Implement parsing of empty filter chain patters via http 'secured' attribute and remove filters='none' support.
16 years ago
05c7abe191
SEC-1445: Tests for setting of username and password parameter names through the form-login element.
16 years ago
7d74b7c87e
SEC-1171: Allow multiple http elements and add pattern attribute to specify filter chain mapping.
16 years ago
b0758dd8de
Refactoring HTTP config tests to use spock and groovy MarkupBuilder
16 years ago
Luke Taylor
Rob Winch