spring-security

Commit Graph

Author	SHA1	Message	Date
Rob Winch	9cb668aec2	SessionManagementConfigurer properly defaults SecurityContextRepository Previously the default was an HttpSessionSecurityContextRepository which meant that if a stateless authentication occurred the SecurityContext would be lost on ERROR dispatch. This commit ensures that the RequestAttributeSecurityContextRepository is also consulted by default. Closes gh-12070	4 years ago
Steve Riesenberg	33b492df54	Default to DelegatingSecurityContextRepository Closes gh-12023 Closes gh-12049	4 years ago
Steve Riesenberg	819529f5ea	Remove CsrfSpec.tokenFromMultipartDataEnabled Also removed ServerCsrfDsl.tokenFromMultipartDataEnabled Closes gh-12020	4 years ago
Joe Grandja	753e113a13	RequestMatcherDelegatingAuthorizationManager defaults to deny Closes gh-11958	4 years ago
Josh Cummings	2713075d08	Mark Observations with Firewall Failures Closes gh-11994	4 years ago
Josh Cummings	46ab84684b	Mark Observations with CSRF Failures Closes gh-11993	4 years ago
Josh Cummings	99a87179dd	Instrument Filter Chain Closes gh-11911	4 years ago
Josh Cummings	8c610684f3	Instrument Authentication and Authorization Closes gh-11989 Closes gh-11990	4 years ago
Daniel Garnier-Moiroux	27059ced87	Default X-Xss-Protection header value to "0" Closes gh-9631	4 years ago
Steve Riesenberg	37fa49b32d	Polish gh-11952	4 years ago
Steve Riesenberg	f4ca90e719	Add reactive interfaces for CSRF request handling Issue gh-11959	4 years ago
Marcus Da Coregio	398f5dee7f	Remove deprecated RequestMatcher methods from Java Configuration Closes gh-11939	4 years ago
Marcus Da Coregio	9fd195d419	Default to shouldFilterAllDispatcherTypes=true in XML Closes gh-11970	4 years ago
Marcus Da Coregio	f3321c256c	Add XML support for shouldFilterAllDispatcherTypes Closes gh-11492	4 years ago
Marcus Da Coregio	8a5aed2983	Add deprecation warning to CsrfDsl#ignoringAntMatchers Issue gh-11347	4 years ago
Marcus Da Coregio	bc4ad52feb	Add deprecation warning to mvcMatchers methods Issue gh-11347	4 years ago
Josh Cummings	12b9f2e196	use-authorization-manager defaults to true Closes gh-11929	4 years ago
Marcus Da Coregio	c4d23f2b49	Use MvcRequestMatcher by default if Spring MVC is present Closes gh-11899	4 years ago
Josh Cummings	2079309c5a	Add SecurityContextHolderStrategy XML Configuration for OAuth2 Issue gh-11061	4 years ago
Josh Cummings	7543effe89	Add SecurityContextHolderStrategy Java Configuration for OAuth2 Issue gh-11061	4 years ago
Josh Cummings	7e3841105b	Add SecurityContextHolderStrategy XML Configuration for Saml2 Issue gh-11061	4 years ago
Josh Cummings	19181a5afd	Add SecurityContextHolderStrategy Java Configuration for Saml2 Issue gh-11061	4 years ago
Josh Cummings	0c0e298aa7	Polish Saml2 XML Use of SecurityContextHolderStrategy Issue gh-11061	4 years ago
Josh Cummings	b4d13e7726	Polish use-authorization-manager - Use SecurityContextHolderStrategy - Allow empty role prefix - Disallow access-decision-manager-ref and authorization-manager-ref together Issue gh-11305	4 years ago
Steve Riesenberg	1d706ae13d	Add csrfTokenRequestResolver to CsrfDsl Closes gh-11952	4 years ago
Marcus Da Coregio	bf6e85ec15	Accept String varargs in securityMatcher Issue gh-9159	4 years ago
Marcus Da Coregio	35f7e46d05	Remove WebSecurityConfigurerAdapter Closes gh-10902	4 years ago
Steve Riesenberg	3bc76815c2	Update csrf.request-handler-ref in 6.0 Issue gh-11918	4 years ago
Steve Riesenberg	475b3bb6bb	Add deferred CsrfTokenRepository.loadDeferredToken * Move DeferredCsrfToken to top-level and implement Supplier<CsrfToken> * Move RepositoryDeferredCsrfToken to top-level and make package-private * Add CsrfTokenRepository.loadToken(HttpServletRequest, HttpServletResponse) * Update CsrfFilter * Rename CsrfTokenRepositoryRequestHandler to CsrfTokenRequestAttributeHandler Issue gh-11892 Closes gh-11918	4 years ago
Steve Riesenberg	c98de7af2f	Add xss-protection.header-value in 6.0 Issue gh-9631	4 years ago
Daniel Garnier-Moiroux	0e215a21ad	Add X-Xss-Protection headerValue to XML config Issue gh-9631	4 years ago
Marcus Da Coregio	039e0328e1	Simplify Java Configuration RequestMatcher Usage If Spring MVC is present in the classpath, use MvcRequestMatcher by default. This commit also adds a new securityMatcher method in HttpSecurity Closes gh-11347 Closes gh-9159	4 years ago
Steve Riesenberg	d9a682a414	Polish gh-11896	4 years ago
Steve Riesenberg	7f9600ae08	Polish gh-11896	4 years ago
Marcus Da Coregio	64a19de4dc	Deprecate HPKP security header Closes gh-10144	4 years ago
Rob Winch	4479cefade	Default Require Explicit Session Management = true Closes gh-11763	4 years ago
Rob Winch	6d56af7b65	SessionManagementDsl.requireExplicitAuthenticationStrategy	4 years ago
Daniel Garnier-Moiroux	93250013e4	Make X-Xss-Protection configurable through ServerHttpSecurity OWASP recommends using "X-Xss-Protection: 0". The default is currently "X-Xss-Protection: 1; mode=block". In 6.0, the default will be "0". This commits adds the ability to configure the xssProtection header value in ServerHttpSecurity. This commit deprecates the use of "enabled" and "block" booleans to configure XSS protection, as the state "!enabled + block" is invalid. This impacts HttpSecurity. Issue gh-9631	4 years ago
Marcus Da Coregio	cf3349f31a	Configure ContentNegotiationStrategy in HttpSecurityConfiguration Closes gh-11916	4 years ago
Josh Cummings	506e50bfd0	Move Saml2 Authentication Filters Issue gh-8819	4 years ago
Josh Cummings	37a160245f	Adjust OAuth2 Resource Server packaging Closes gh-7349	4 years ago
Steve Riesenberg	21c0c73878	Remove request-resolver-ref in 6.0 Issue gh-11896	4 years ago
Steve Riesenberg	46696a9226	CsrfTokenRequestHandler extends CsrfTokenRequestResolver Closes gh-11896	4 years ago
Steve Riesenberg	3c66ef6305	Change default SecurityContextRepository Save SecurityContext in request attributes for stateless session management using RequestAttributeSecurityContextRepository. Closes gh-11026	4 years ago
Rob Winch	d94677f87e	CsrfTokenRequestAttributeHandler -> CsrfTokenRequestHandler This renames CsrfTokenRequestAttributeHandler to CsrfTokenRequestHandler and moves usage from CsrfFilter into CsrfTokenRequestHandler. Closes gh-11892	4 years ago
Josh Cummings	70460ca009	Adjust OAuth2 Resource Server packaging Closes gh-7349	4 years ago
Josh Cummings	61c80bcac5	Move Saml2 Authentication Filters Closes gh-8819	4 years ago
Rob Winch	48e31f87e4	Remove Deprecated OpenSAML 3 Support Closes gh-10556	4 years ago
Josh Cummings	3f8503f1b4	Deprecate AccessDecisionManager et al Closes gh-11302	4 years ago
slam	45bbd86f7e	HttpSecurityDsl should support apply method Closes gh-11754	4 years ago

1 2 3 4 5 ...

1554 Commits (7adc000c6bb604b0e415bda0cffabb6cd6d8e5dd)