bc2448419b
SEC-1679: Make sure whitespace is trimmed from cookie names when specifying multiple cookies.
15 years ago
27be72a81c
SEC-1677: Split out LDAP server tests from config module.
15 years ago
866615ceaa
SEC-1662: Cater for the case where a user uses two <http> elements without patterns and the RequestMatcher does not have two arguments.
15 years ago
2eefbf3a23
SEC-1657: Added support for 'name' attribute in <http> element to expose filter chain as a list bean.
15 years ago
6de2197c0f
SEC-1653: Ensure UserDetailsServiceFactoryBean is registered using the tools API to prevent errors in STS.
15 years ago
8d7830a1ee
SEC-1603: Add support in namespace for use of AuthenticationSuccessHandler with remember-me.
15 years ago
1ed5227d75
Removed @Override from HttpFirewallBeanDefinitionParser.parse since it does not override a method definition, it implements one.
...
Fixed The method parse(Element, ParserContext) of type HttpFirewallBeanDefinitionParser must override a superclass method HttpFirewallBeanDefinitionParser.java /spring-security-config/src/main/java/org/springframework/security/config/http line 23 Java Problem
16 years ago
2be2660b13
SEC-1636: Add optimizations for simple pattern cases in AntPathRequestMatcher. "/**" and "**" are treated as universal matches and a trailing "/**" is now optimized using a substring match.
16 years ago
4a40d80da1
SEC-1418: Deprecate GrantedAuthorityImpl in favour of final SimpleGrantedAuthority.
...
It should be noted that equality checks or lookups with Strings or other authority types will now fail where they would have succeeded before.
16 years ago
441aa25383
SEC-1615: Changed key generation for anonymous provider to only use SecureRandom on demand.
16 years ago
b9a98613eb
SEC-1593: Added tests to try to reproduce issue.
16 years ago
21ed5feb8d
SEC-1600: Added Implementation-Version and Implementation-Title to manifest templates and checking of version numbers in namespace config module and core. Config checks the version of core it is running against and core checks the Spring version, reporting any mismatches or situations where the app is running with less than the recommended Spring version.
16 years ago
f70942c6f5
SEC-1589: Add support for property placeholder in intercept-methods access attribute.
16 years ago
173537f4f2
SEC-1584: Added namespace support for injecting custom HttpFirewall instance into FilterChainProxy.
16 years ago
0961671772
Reinstated missing 3.0.3 schema file
16 years ago
f455e9a5a4
SEC-1584: Documentation of request-checking and matching process. Logging of servletPath and and pathInfo in DebugFilter for comparison.
16 years ago
7d97adc687
SEC-1584: Addition of HttpFirewall strategy to FilterChainProxy to reject un-normalized requests and wrap the incoming request object before processing by the security filter chain to provide a more consistent representation of paths than is guaranteed by the servlet spec. The wrapper strips path parameters from pathInfo and servletPath to provide consistency of URL matching across servlet containers and protect against bypassing security constraints by the malicious addition of such parameters to the URL. The paths are canonicalized further by replacing of multiple sequences of "/" characters with a single "/".
16 years ago
ee12d54bec
SEC-1536: moved web.authentication.jaas to web.jaasapi
...
Renamed org.springframework.security.web.authentication.jaas to org.springframework.security.web.jaasapi to be better aligned with org.springframework.security.web.servletapi, added package-info.java, and removed trailing whitespaces
16 years ago
e69b981c72
Make method in MatcherType public for use in OAuth.
16 years ago
11a87d1fa0
Switch to using xsd:boolean in schema file.
16 years ago
1b2b371970
SEC-1544: Added CookieClearingLogoutHandler and 'delete-cookies' attribute to the 'logout' namespace element.
...
When the user logs out, the handler will attempt to delete the named cookies (which it is constructor-injected with) by expiring them in the response.
Also added documentation on the feature and a suggestion for deleting JSESSIONID through an Apache proxy server, if the servlet container doesn't allow clearing the session cookie.
16 years ago
383211561c
Moved LDAP placeholder config test into LDAP tests to prevent issues with parallel tests. Converted LdapProviderBDP tests to groovy/spock. Other misc tidying of config tests.
16 years ago
a128e3b4fe
http://forum.springsource.org/showthread.php?p=318755 Added PlaceHolderAndELConfigTests.ldapAuthenticationProviderWorksWithPlaceholders
16 years ago
de819378fc
SEC-1536: added JAAS API Integration, updated doc, updated jaas sample
16 years ago
0217e98bdb
Added an AppListener to collect events for use in tests
16 years ago
20988c8cf6
Minor refactoring of debug filter and tidying up tests.
16 years ago
bdb906e588
Enable parameterization for log levels in logback files to allow the use of command-line options for controlling log output.
16 years ago
1db83fc81e
Minor BD parser tidying.
16 years ago
5f6bcc0e1e
SEC-1540: Fix to add HTTP-method specific support for namespace requires-channel attribute.
16 years ago
aafc5f9038
File rename to correct case.
16 years ago
1f520b691f
SEC-1469: Initial support for debugging filter.
16 years ago
591bd532bd
Polishing FilterChainProxy and its tests.
16 years ago
6abfa2e887
Update minimum required schema to 3.1.
16 years ago
4bd41cbf72
SEC-1133: Support for setting of authenticationDetailsSource property for form-login, openid-login, http-basic and x509 namespace elements. These elements now support an additional 'authentication-details-source-ref' attribute.
16 years ago
4935aa07c7
SEC-1535: Added suggested doc fixes.
16 years ago
2222a7be07
Use Integer.valueOf() in preference to new Integer()
16 years ago
dca0fd871c
SEC-1532: Add cache of previously matched beans to ProtectPointcutPostProcessor to ensure that it doesn't perform pointcut matching every time a new prototype bean is created.
16 years ago
85c4c91e0e
IDEA inspection refactorings.
16 years ago
413b2a06e3
Improvements in up-to-date checking and use of parallel tests where possible.
16 years ago
64375484a1
More build and logging tuning.
16 years ago
c1c8fd1874
SEC-1171: Changed attribute name/value from secured="false" to security="none" to allow future extension by adding extra options (e.g. contextOnly to provide security context information during the request).
16 years ago
a4fd191499
Added check for use of "ref" with other attributes in <authentication-provider>.
16 years ago
4683273c2c
Correct message in namespace handler when web classes are missing.
16 years ago
69a10c48ae
Switch to using slf4j/logback for logging.
...
We still compile modules against commons-logging but all runtime logging and samples will use logback
16 years ago
443ac0487a
SEC-1093: Namespace support for jee element.
...
Adds a J2eePreAuthenticatedProcessingFilter to the stack, using a SimpleAttributes2GrantedAuthoritiesMapper to process the role attributes defined in the "mappable-roles" attribute. Provider uses a PreAuthenticatedGrantedAuthoritiesUserDetailsService by default.
16 years ago
026517f674
Removal of deprecated methods and classes.
16 years ago
6a79cf7be2
SEC-1383: Make MethodSecurityMetadataSourceBeanDefinitionParser extend AbstractBeanDefinitionParser for automatic support of ID attribute.
16 years ago
cd946c4e23
SEC-1493: Added namespace support.
16 years ago
8bddc8f820
SEC-1484: Documentation for some namespace attributes.
16 years ago
f7405cef82
Removed original Java version of refactored http namespace tests.
16 years ago
Luke Taylor
Rob Winch
Rob Winch