56ce7d284c
SEC-2336: WebSecurityConfigurerAdapter#registerAuthentication javadoc fixes
12 years ago
1f3b812a66
SEC-2282: Polish CSRF Documentation
12 years ago
ef7cc40389
SEC-2282: Polish CSRF Documentation
12 years ago
d16106ef56
SEC-2309: Document CSRF multipart/form-data
12 years ago
b591881e95
SEC-2302: Provide beforeSpringSecurityFilterChain hook
...
This allows inserting filters before the springSecurityFilterChain.
12 years ago
88f41cdf62
SEC-2341: Update to Gradle 1.8
...
Some dependencies were necessary to update due to issues with JUnit
integration.
12 years ago
a888ddf8b3
SEC-2307: JavaConfig RequestCache ignores favicon.ico
12 years ago
ddc0ef7ab3
SEC-2339: Added Logical (Or, And, Negated) RequestMatchers
12 years ago
28fb6ba14b
SEC-2328: Add hasAnyRole to ExpressionUrlAuthorizationConfiguration
12 years ago
b16c17f70b
SEC-2301: Remove invalid import
12 years ago
a3d112979f
SEC-2301: GlobalMethodSecurityConfiguration sets DefaultWebSecurityExpressionHandler BeanResolver
12 years ago
f294480e6b
SEC-2329: JC @Autowire(required=false) AuthenticationTrustResolver
...
Java Configuration now allows optional @Autowire of
AuthenticationTrustResolver. In the WebSecurityConfigurerAdapter this is
done by populating AuthenticationTrustResolver as a sharedObject.
12 years ago
788ba9a1fa
SEC-2329: Allow injecting of AuthenticationTrustResolver
12 years ago
7537dfc33a
SEC-2304: rm duplicate MethodExpressionHandler from GlobalMethodSecurityConfiguration
12 years ago
5082a04626
SEC-2311: LogoutConfigurer allows other HTTP methods if CSRF is disabled
12 years ago
9133c33f1d
SEC-2246: HttpSessionRequestCache.getRequest casts to RequestCache
...
The method getRequest use to cast to DefaultRequestCache, but this
is not necessary.
Now the cast is to SavedRequest.
12 years ago
8f8c6169e8
SEC-2331: Cache Control now includes Expires: 0
12 years ago
c5c1419521
SEC-2332: GlobalMethodSecurityConfiguration includes proper voters
...
Previously GlobalMethodSecurityConfiguration did not include the correct
voters. This updates the code and the tests to ensure that the proper
voters are added. Note this got past testing previously due to all the
voters abstaining, so tests were added for ensuring that methods could also
be invoked sucessfully using the configured annotation.
12 years ago
d33b9e2854
SEC-2324: Update Spring Security tld version
12 years ago
c156716be8
Ensure single version of org.slf4j
12 years ago
0114b457c0
SEC-2330: CacheControlHeadersWriter use a single header
12 years ago
05a7c58daa
SEC-2228: Change openid4j to optional in template.mf
12 years ago
e5804d323b
SEC-2256: Fix intercept-url doc precidence statement
...
Previously the documentation incorrectly stated "If a request matches
multiple patterns, the method-specific match will take precedence
regardless of ordering."
This has now been removed and InterceptUrlConfigTests was added previously
to ensure this was true.
12 years ago
be8aad8306
SEC-2196: Demonstrate Method Security works on Generic methods
12 years ago
d9c9cd7f84
Remove warnings from defaultSpringSecurityContextSource
12 years ago
b4cbcee7f0
SEC-2308: DefaultSpringSecurityContextSource allow empty baseUrl
12 years ago
f6587c8697
SEC-2312: Update javadoc link to Spring 3.2.x
12 years ago
32e9239fd2
SEC-2320: AuthenticationPrincipal can be null on invalid type
...
Previously a ClassCastException was thrown if the type was invalid. Now
a flag exists on AuthenticationPrincipal which indicates if a
ClassCastException should be thrown or not with the default being no error.
12 years ago
b22acd0768
SEC-2314: AbstractSecurityWebApplicationInitializer.getSessionTrackingModes() uses EnumSet
12 years ago
53a0db6be1
SEC-2313: Gradle javadoc hotfix
12 years ago
662bb24370
SEC-1937: Added test to demonstrate SEC-1937 was invalid
12 years ago
3c82e63ded
Formatting cleanup
12 years ago
8e74407381
SEC-2296: HttpServletRequest.login should throw ServletException if already authenticated
...
See throws documentation at
http://docs.oracle.com/javaee/6/api/javax/servlet/http/HttpServletRequest.html#login%28java.lang.String,%20java.lang.String%29
12 years ago
e8ac11641b
SEC-2297: Add DispatchType.ASYNC as default for AbstractSecurityWebApplicationInitializer
12 years ago
7203faf34f
SEC-2300: Update Spring LDAP version to 1.3.2.RELEASE
12 years ago
3d2f23602f
SEC-2294: Update Spring Version to 3.2.4.RELEASE
12 years ago
43f4d01cf3
SEC-2292: Add test to assert CSRF bypass of methods is case sensitive
...
HTTP methods should be case sensitive, so add test to ensure that this is
the case http://www.w3.org/Protocols/rfc2616/rfc2616-sec5.html#sec5.1.1
12 years ago
6e9fb7930b
SEC-2298: Add AuthenticationPrincipalArgumentResolver
12 years ago
98fe2322cd
SEC-2095: Fix Servlet API doc ids
12 years ago
fc16450344
Demonstrate rest.js CSRF support in reference docs
...
rest.js 0.9.4 added support for applying the CSRF header and token to
Ajax requests.
12 years ago
246c632f3a
SEC-2095: Document Servlet API support
12 years ago
664220f304
SEC-2295: Remove error logging when Spring version equals Spring Security
12 years ago
86340b8016
SEC-2283: Polish headers doc
12 years ago
ae368829f4
Tweak PermGen for tests
12 years ago
d89cf6db29
SEC-2283: Update headers documentation and tests
12 years ago
4761614c9f
SEC-2291: Fix internal links within reference
...
Instead of using xlink:href="# use linkend="
12 years ago
69aac09e1d
SEC-2285: Added headers to to reference
12 years ago
9483226d02
SEC-2282: Polish CSRF doc
12 years ago
aca2e4ff3a
SEC-2289: Add spring4Test
12 years ago
086056f191
SEC-2289: Make compatible with Spring 4 as well
...
There are a few subtle changes in Spring 4 that this commit addresses
12 years ago
Rob Winch
Scott Andrews