51171efa7a
SEC-2357: Move *RequestMatcher to .matcher package
12 years ago
14b9050616
SEC-2357: Move *RequestMatchers to .matchers package
12 years ago
f2b44e6beb
Fix javadoc whitespace issue in HttpBasicConfigurer
12 years ago
4ef0460ef6
SEC-2321: Improve Java Config defaults for JavaScript clients
12 years ago
5f10d84bf5
SEC-2303: WebSecurity sets the Bean resolver
13 years ago
dd1c2483b5
SEC-2349: Fix documentation tests
13 years ago
8087cde628
SEC-2331: Include Expires: 0 in xsd and appendix
13 years ago
17efd25717
SEC-2331: Include Expires: 0 in security headers documentation
13 years ago
614c94187e
SEC-2305: GlobalMethodSecurityConfiguration autowire PermissionEvaluator
...
If a single PermissionEvaluator bean is found the
DefaultMethodSecurityExpressionHandler is configured with the
PermissionEvaluator. If multiple PermissionEvaluator beans are found, the
beans are ignored.
13 years ago
a09756745f
SEC-2151: Support binding method arguments with Annotations
...
This allow utilizing method arguments for method access control on
interfaces prior to JDK 8.
13 years ago
cea0cf9260
SEC-2243: Remove additional Debug Filter
13 years ago
56ce7d284c
SEC-2336: WebSecurityConfigurerAdapter#registerAuthentication javadoc fixes
13 years ago
88f41cdf62
SEC-2341: Update to Gradle 1.8
...
Some dependencies were necessary to update due to issues with JUnit
integration.
13 years ago
a888ddf8b3
SEC-2307: JavaConfig RequestCache ignores favicon.ico
13 years ago
ddc0ef7ab3
SEC-2339: Added Logical (Or, And, Negated) RequestMatchers
13 years ago
28fb6ba14b
SEC-2328: Add hasAnyRole to ExpressionUrlAuthorizationConfiguration
13 years ago
b16c17f70b
SEC-2301: Remove invalid import
13 years ago
a3d112979f
SEC-2301: GlobalMethodSecurityConfiguration sets DefaultWebSecurityExpressionHandler BeanResolver
13 years ago
f294480e6b
SEC-2329: JC @Autowire(required=false) AuthenticationTrustResolver
...
Java Configuration now allows optional @Autowire of
AuthenticationTrustResolver. In the WebSecurityConfigurerAdapter this is
done by populating AuthenticationTrustResolver as a sharedObject.
13 years ago
7537dfc33a
SEC-2304: rm duplicate MethodExpressionHandler from GlobalMethodSecurityConfiguration
13 years ago
5082a04626
SEC-2311: LogoutConfigurer allows other HTTP methods if CSRF is disabled
13 years ago
8f8c6169e8
SEC-2331: Cache Control now includes Expires: 0
13 years ago
c5c1419521
SEC-2332: GlobalMethodSecurityConfiguration includes proper voters
...
Previously GlobalMethodSecurityConfiguration did not include the correct
voters. This updates the code and the tests to ensure that the proper
voters are added. Note this got past testing previously due to all the
voters abstaining, so tests were added for ensuring that methods could also
be invoked sucessfully using the configured annotation.
13 years ago
0114b457c0
SEC-2330: CacheControlHeadersWriter use a single header
13 years ago
05a7c58daa
SEC-2228: Change openid4j to optional in template.mf
13 years ago
be8aad8306
SEC-2196: Demonstrate Method Security works on Generic methods
13 years ago
662bb24370
SEC-1937: Added test to demonstrate SEC-1937 was invalid
13 years ago
3c82e63ded
Formatting cleanup
13 years ago
7203faf34f
SEC-2300: Update Spring LDAP version to 1.3.2.RELEASE
13 years ago
3d2f23602f
SEC-2294: Update Spring Version to 3.2.4.RELEASE
13 years ago
6e9fb7930b
SEC-2298: Add AuthenticationPrincipalArgumentResolver
13 years ago
ae368829f4
Tweak PermGen for tests
13 years ago
d89cf6db29
SEC-2283: Update headers documentation and tests
13 years ago
4761614c9f
SEC-2291: Fix internal links within reference
...
Instead of using xlink:href="# use linkend="
13 years ago
26166ef6e8
SEC-2272: CsrfRequestDataValueProcessor support Spring 4 and Spring 3
13 years ago
d60108eaf6
SEC-2229: Add optional dependencies to spring-security-config
...
spring-tx and spring-jdbc aren't pulled in transitively from
spring-security-web now, so we must include them as optional dependencies.
13 years ago
18bd82e7d4
SEC-2131: Update doc to state session authentication sends 401 if no page
13 years ago
f29505d657
SEC-2280: Fix SessionFixationConfigurer#changeSessionId Javadoc
...
The Javadoc for SessionFixationConfigurer#changeSessionId() was copied and pasted from
SessionFixationConfigurer#none() and never updated. It is incorrect. This commit fixes that.
13 years ago
48283ec004
SEC-2276: Delay saving CsrfToken until token is accessed
...
This also removed the CsrfToken from the response headers to prevent the
token from being saved. If user's wish to return the CsrfToken in the
response headers, they should use the CsrfToken found on the request.
13 years ago
c131fb6379
SEC-2139: named-security-filter are all defined and ordered correctly
13 years ago
379cbd2a8b
SEC-2274: Add ApplicationContext as HttpSecurity shared object
13 years ago
0247dd124f
SEC-2271: LogoutConfigurer#logoutUrl explains about CSRF
13 years ago
110e769bd4
SEC-2257: Remove HttpSecurityBuilder#getAuthenticationManager()
...
Removed in favor of using shared object.
13 years ago
5fe32bb3c8
SEC-2216: Add withObjectPostProcessor
13 years ago
d62c2e0835
SEC-2244: Defaults based on loginPage are now updated when loginPage changes
13 years ago
e0cad0d684
SEC-2230: Fix Header tests
13 years ago
2e852f4613
SEC-2230: Remove stray import
13 years ago
a469f26b10
SEC-2230: Polish Headers JavaConfig
13 years ago
e9bb9e766e
SEC-1574: Add CSRF Support
13 years ago
797df51264
SEC-2135: Support HttpServletRequest#changeSessionId()
13 years ago
Rob Winch
Nick Williams