spring-security

Commit Graph

Author	SHA1	Message	Date
Yanming Zhou	f0f47b54ec	Improve warning message	1 year ago
Hero Wanders	f372f5cf52	Replace OidcSessionStrategy References with OidcSessionRegistry	1 year ago
Josh Cummings	5c604b95fb	Correct PostFilterAuthorizationMethodInterceptor Target Type Previously, `postFilterAuthorizationMethodInterceptor` mistakenly was published as an `Advisor`. Because `MethodSecurityAdvisorRegistrar` re-publishes each pre/post annotation interceptor also as an `Advisor`, this resulted in a duplicate advisor for `@PostFilter`. Closes gh-15651	1 year ago
Josh Cummings	f398be793d	Simplify AuthorizationAdvisorProxyFactory Configuration Closes gh-15497	1 year ago
Josh Cummings	ae8e4d148e	Produce Exactly One AuthorizationAdvisor Per Annotation Closes gh-15592	1 year ago
Josh Cummings	27af1df87d	Simplify Method Interceptor Configuration Simplifies to use only one ObjectProvider for easier future maintenance Issue gh-15592	1 year ago
Daniel Garnier-Moiroux	b731623b3a	Fix checkstyle errors with @Deprecated	1 year ago
Daniel Garnier-Moiroux	b92ed92548	Fix checkstyle errors with @Deprecated	1 year ago
Daniel Garnier-Moiroux	79fb0113c8	Bump io-spring-javaformat from 0.0.42 to 0.0.43 Bumps `io-spring-javaformat` from 0.0.42 to 0.0.43. Updates `io.spring.javaformat:spring-javaformat-checkstyle` from 0.0.42 to 0.0.43 - [Release notes](https://github.com/spring-io/spring-javaformat/releases) - [Commits](spring-io/spring-javaformat@v0.0.42...v0.0.43) Updates `io.spring.javaformat:spring-javaformat-gradle-plugin` from 0.0.42 to 0.0.43 - [Release notes](https://github.com/spring-io/spring-javaformat/releases) - [Commits](spring-io/spring-javaformat@v0.0.42...v0.0.43) --- updated-dependencies: - dependency-name: io.spring.javaformat:spring-javaformat-checkstyle dependency-type: direct:production update-type: version-update:semver-patch - dependency-name: io.spring.javaformat:spring-javaformat-gradle-plugin dependency-type: direct:production update-type: version-update:semver-patch ... --- Manual updates: - Adhere to rule where `@Deprecated` annotations and `@deprecated` javadoc comments MUST be used together Signed-off-by: dependabot[bot] <support@github.com>	1 year ago
Daniel Garnier-Moiroux	2caf1fb6b4	Bump io-spring-javaformat from 0.0.42 to 0.0.43 Bumps `io-spring-javaformat` from 0.0.42 to 0.0.43. Updates `io.spring.javaformat:spring-javaformat-checkstyle` from 0.0.42 to 0.0.43 - [Release notes](https://github.com/spring-io/spring-javaformat/releases) - [Commits](spring-io/spring-javaformat@v0.0.42...v0.0.43) Updates `io.spring.javaformat:spring-javaformat-gradle-plugin` from 0.0.42 to 0.0.43 - [Release notes](https://github.com/spring-io/spring-javaformat/releases) - [Commits](spring-io/spring-javaformat@v0.0.42...v0.0.43) --- updated-dependencies: - dependency-name: io.spring.javaformat:spring-javaformat-checkstyle dependency-type: direct:production update-type: version-update:semver-patch - dependency-name: io.spring.javaformat:spring-javaformat-gradle-plugin dependency-type: direct:production update-type: version-update:semver-patch ... --- Manual updates: - Adhere to rule where `@Deprecated` annotations and `@deprecated` javadoc comments MUST be used together Signed-off-by: dependabot[bot] <support@github.com>	1 year ago
DingHao	ed16c86115	Improve @CurrentSecurityContext meta-annotations Closes gh-15551	2 years ago
Josh Cummings	59ec1f6480	Revert "Polish AuthorizationAdvisorProxyFactory advisor configuration" This commit had some unintended consequences when the advisor interceptor was published in a Spring Boot application. As such, 15497 will be reopened to investigate. In the meantime, this commit reverts the previous change so as to allow the build to pass. Issue gh-15497	2 years ago
Josh Cummings	08b8b09066	Update Copyright Issue gh-15286	2 years ago
Josh Cummings	2b33f6f04a	Add Config Tests for AuthenticationPrincipal Templates Issue gh-15286	2 years ago
Josh Cummings	e40c98e6d7	Deprecate PrePostTemplateDefaults Since there is nothing specific to configuring pre/post annotations, there is no need for the extra class. If a need like this does arise in the future, either AnnotationTemplateExpressionDefaults can be sub- classed, or it can have introduced a Map field holding custom properties. Issue gh-15286	2 years ago
DingHao	2c02d8aec7	Update Copyright	2 years ago
DingHao	895978c818	Auto config AuthenticationPrincipalArgumentResolver When AnnotationTemplateExpressionDefaults bean is Present	2 years ago
Daniel Garnier-Moiroux	3b8cdc323f	Remove unused method	2 years ago
Daniel Garnier-Moiroux	109da2719f	Use explicit types everywhere instead of var	2 years ago
Josh Cummings	02cca6f737	Polish AuthorizationAdvisorProxyFactory advisor configuration Closes gh-15497	2 years ago
Josh Cummings	816ebe38b5	Add OpenSAML to Config Build Issue gh-11658	2 years ago
Josh Cummings	1da383b360	Add OpenSAML 5 Support Issue gh-11658	2 years ago
Josh Cummings	78a0173cc1	Use OpenSAML API for web Issue gh-11658	2 years ago
Josh Cummings	51fc05630d	Use OpenSAML API for web.authentication.logout Issue gh-11658	2 years ago
Josh Cummings	ff9a925e88	Use OpenSAML API for metadata Issue gh-11658	2 years ago
Josh Cummings	416859e70e	Use OpenSAML API in authentication.logout Issue gh-11658	2 years ago
Daniel Garnier-Moiroux	bc8ba7f3b7	Inline CSS for default login and logout page - Remove the dependency on Bootstrap CSS. Results in faster load times, no failures in air-gapped or offline scenarios, and no dependency on an external CDN that may go away some day.	2 years ago
Josh Cummings	37a2812d1a	Mimic Annotation Fallback Logic For backward compatibility, this commit changes the annotation traversal logic to match what is found in PrePostAnnotationSecurityMetadataSource. This reverts gh-13783 which is a feature that unfortunately regressess pre-existing behavior like that found in gh-15352. As such, that functionality has been removed. Issue gh-15352	2 years ago
Josh Cummings	f20ae1a71c	Revert gh-13783 This feature unfortunately regresses pre-existing behavior like that found in gh-15352. As such, this functionality has been removed. Closes gh-15352	2 years ago
Marcus Hert Da Coregio	304685521c	Fix tags order	2 years ago
baezzys	3d4bcf1b44	fix: Restrict automatic CORS configuration to UrlBasedCorsConfigurationSource - Update CORS configuration logic to automatically enable .cors() only if a UrlBasedCorsConfigurationSource bean is present. - Modify applyCorsIfAvailable method to check for UrlBasedCorsConfigurationSource instances.	2 years ago
Marcus Hert Da Coregio	98af8d1123	Add permissionsPolicyHeader This method is a replacement of `permissionsPolicy(Customizer)` that returns its own configurer instead of `HeadersConfigurer`. Closes gh-14803	2 years ago
Josh Cummings	9d8888c5f0	Use AssertingPartyMetadata Issue gh-15394	2 years ago
Josh Cummings	dab48d25b0	Improve Error Message When Registration Missing Closes gh-15363	2 years ago
Josh Cummings	796e4d6b6c	Add query parameter support for authn requests Closes gh-15017	2 years ago
Josh Cummings	7422a1134a	Allow logout+jwt JWT type Closes gh-15003	2 years ago
Josh Cummings	773e86701e	Add ParameterRequestMatcher Closes gh-15342	2 years ago
Marcus Hert Da Coregio	aa9c1bab67	Upgrade to Spring Framework 6.2.0-M4 Closes gh-15266	2 years ago
Josh Cummings	0e7566ede3	Adjust any-request check Storing the request matcher outside of the for loop means that if one of the SecurityFilterChain instances is not of type DefaultSecurityFilterChain, then the error may print out an earlier request matcher instead of the current one. Instead, this commit changes to print out the entire filter chain so that it can be inside of the for loop, regardless of type. Issue gh-15220	2 years ago
Max Batischev	4c780bf8d4	Add support checking AnyRequestMatcher securityFilterChains Closes gh-15220	2 years ago
Steve Riesenberg	7eaab95639	Polish gh-15237	2 years ago
Max Batischev	4e52eda0f5	Add support configuring OAuth2AuthorizationRequestResolver as bean Closes gh-15236	2 years ago
Marcus Hert Da Coregio	b4c8fdf91d	Add missing @Test annotation	2 years ago
Marcus Hert Da Coregio	7c43fc111f	Support RoleHierarchy Bean in authorizeHttpRequests Kotlin DSL Closes gh-15136	2 years ago
Josh Cummings	4ca0de9c2d	Sync XSD with RncToXsd Task	2 years ago
Josh Cummings	a7f9ccb6d6	Use GrantedAuthorityDefaults Bean in Kotlin DSL Closes gh-15171	2 years ago
Josh Cummings	6aabd768a8	Pick MvcRequestMatcher for MockMvc requests Closes gh-13849	2 years ago
Josh Cummings	cdd626644e	Use Request-Level Servlet Context Spring Security cannot use the ServletContext attached to the ApplicationContext since there may be child ApplicationContext's with their own ServletContext. Because of that, it is necessary to always use the ServletContext attached to the request. Closes gh-14418	2 years ago
Josh Cummings	5a798e93f1	Polish MVC Tests Issue gh-14418	2 years ago
Josh Cummings	9101bf1f7d	Allow logout+jwt JWT type Closes gh-15003	2 years ago

1 2 3 4 5 ...

2500 Commits (820ce4ea7a8cf1ac2d91ff71891d04f2f7b05e2e)