spring-security

Commit Graph

Author	SHA1	Message	Date
Luke Taylor	2e2625873c	SEC-1446: Modified BasicAuthenticationFilter to treat invalid base64 and invalid Basic authentication tokens as a failed authentication (raising a BadCredentialsException, without calling the AuthenticationManager). This solves the problem in this issue (invalid Base64 not resulting in a 401) and also prevents unnecessary calls to the AuthenticationManager.	16 years ago
Luke Taylor	d5df53f1db	SEC-1439: Make getters and setters public on HttpRequestResponseHolder. Necessary to allow use of custom SecurityContextRepository.	16 years ago
Luke Taylor	f3264ba9ab	Addition of commons-logging exclusions and adjustments to pom generation.	16 years ago
Luke Taylor	43f0e11106	SEC-1429: Removed cached authentication from session after successful authentication.	16 years ago
Luke Taylor	89d8c8cc83	Additional test classes for authentication and logout success/failure handling.	16 years ago
Luke Taylor	a3263753d9	Fix to Javadoc for AbstractAuthenticationProcessingFilter.	16 years ago
Luke Taylor	530ab3ae30	SEC-1429: Move logic for saving of AuthenticationException into the SimpleUrlAuthenticationFailurehandler from AbstractAuthenticationProcessingFilter. It will also now use request scope if configured to do a forward instead of a redirect.	16 years ago
Luke Taylor	43f3568b16	SEC-1407: Removed original URL matching classes and updated Javadoc of new RequestMatcher versions.	16 years ago
Luke Taylor	ae8027fa47	SEC-1425: Replace use of Java 1.6 String.isEmpty().	16 years ago
Luke Taylor	93438defff	SEC-1407: Use RequestMatcher instances as the FilterInvocationSecurityMetadataSource keys and in the FilterChainMap use by FilterChainProxy. This greatly simplifies the code and opens up possibilities for other matching strategies (e.g. EL). This also means that matching is now completely strict - the order of the matchers is all that matters (not whether an HTTP method is included or not). The first matcher that returns true will be used.	16 years ago
Luke Taylor	cb0f3f677f	SEC-1425: Add check for empty cookie in AbstractRememberMeServices. Prevents ArrayOutOfBoundsException later when processing the tokeniszed cookie.	16 years ago
Luke Taylor	f0466b6488	SEC-1424: Added support for "stateless" option for create-session attribute, designed for applications which do not use sessions at all.	16 years ago
Luke Taylor	e2f9be9015	SEC-1307: Modify context saving logic in HttpSessionSecurityContextRepository to check the SecurityContext and its contents (the Authentication) against the respective values when the request first arrived at the SecurityContextPersistenceFilter. As explained in the issue, this allows a definite decision to be made about whether the current thread has modified the context information during the request, indicating that it should be saved. Also removed deprecated HttpSessionContextIntegrationFilter and tests.	16 years ago
Luke Taylor	4dd10cd266	Refactor overly large doFilter() method in DigestAuthenticationFilter.	16 years ago
Luke Taylor	f3f84da625	Increase upper bounds of Spring and Spring Security versions in bundlor templates to 3.2.0.	16 years ago
Luke Taylor	2ee7696bf4	Update version number to 3.1.0.CI-SNAPSHOT.	16 years ago
Luke Taylor	44f45d21f0	3.0.2 release. Update version in build files.	16 years ago
Luke Taylor	14ae36ac3b	SEC-1412: Modify DefaultSavedRequest to ignore If-Not-Matched header. The browser (or at least Firefox) does not send it after a redirect, and it causes problems with Spring's ShallowEtagHeaderFilter if it is stored and returned by the saved request.	16 years ago
Luke Taylor	bd635edc31	SEC-1410: Makes sure usernames which are OpenID https identities are detected as well as http ones. Using ":" as the token delimiter means we accidentally mistake the URL for two tokens. This had previously been fixed for http URLs but not https ones.	16 years ago
Luke Taylor	c1133d1ef3	Removed unused import in DelegatingAuthenticationEntryPoint and corrected test class name.	16 years ago
Luke Taylor	d30e31d816	Remove unnecessary @SuppressWarnings and inline dependency from ELRequestMatcher (util package) to core ExpressionUtils.	16 years ago
Luke Taylor	c12c43da9e	Javadoc fixes.	16 years ago
Luke Taylor	36612377e2	Replace package.html with package-info.java files, creating new ones where missing and updating outdated contents.	16 years ago
Luke Taylor	1e4f451352	Moved DelegatingAuthenticationEntryPointTest-context.xml to test/resources	16 years ago
Luke Taylor	dcbdfc2026	SEC-1396: Implement eager saving of SecurityContext in SessionManagementFilter on authentication. The user is then seen as being authenticated to further (re-entrant) requests which occur before the existing request has completed. The saving logic is contained with the SecurityContextRepository implementation.	16 years ago
Mike Wiesner	90d6ff1fde	SEC-1406: Create a DelegatingAuthenticationEntryPoint	16 years ago
Mike Wiesner	d32b078a8c	SEC-1406: Create a DelegatingAuthenticationEntryPoint	16 years ago
Mike Wiesner	d2413cf237	SEC-1406: Create a DelegatingAuthenticationEntryPoint	16 years ago
Luke Taylor	08c7155ab5	SEC-1404: Refactored IP subnet matching into IpAddressMatcher class to allow it to be used outside expressions.	16 years ago
Luke Taylor	1ecd3e228b	SEC-1405: added RequestMatcher interface.	16 years ago
Luke Taylor	984604b026	SEC-1384: Removed check for empty authority list from DefaultWebInvocationPrivilegeEvaluator. The class previously rejected access if the user had no authorities. It will now allow the AccessDecisionManager to make the decision.	16 years ago
Luke Taylor	0974e21fb6	SEC-1379: Added creation of a session if session timeout is detected (requested session ID is invalid). This prevents problems with repeated detection of the same invalid session when the redirected request comes in.	16 years ago
Luke Taylor	04447bdbf0	SEC-1377: Extended HTML escaping functionality to take account of control characters, whitespace and to handle Unicode supplementary characters (surrogate pairs).	16 years ago
Luke Taylor	0c10efbbf8	Revert SEC-1356. Checking the path of a submitted cookie will never work as the path is not sent by the browser, so will be null.	16 years ago
Luke Taylor	1a7f71fc0f	SEC-1372: Return an empty list rather than null from SessionRegistryImpl.getAllSessions() If the principal has no sessions, null is returned which contradicts the interface contract. In practice it didn't matter as the null was checked for, but it is cleaner to disallow a null value.	16 years ago
Luke Taylor	51dfc0fb39	Set versions to 3.0.2-CI-SNAPSHOT, post release.	16 years ago
Luke Taylor	05634f97dc	Updated version numbers for 3.0.1 release.	16 years ago
Luke Taylor	a9567a58d8	SEC-1359,SEC-1360,SEC-1361,SEC-1363,SEC-1364,SEC-1365,SEC-1366,SEC-1367: Minor doc and Javadoc typos.	16 years ago
Luke Taylor	3a8daa1bf4	Gradle build improvements. Added generation of source archives and trial support for maven deployment and pom generation, with "provided" configuration mapped to "provided" scope.	16 years ago
Luke Taylor	f62d97b092	SEC-1356: Fix broken tests. Test cookies now require that the path be set in order for them to be recognised for auto-login purposes..	16 years ago
Luke Taylor	6eff4d90b7	SEC-1356: Modify AbstractRememberMeService to check the cookie path as well as the name when extracting it from the incoming request. This makes things consistent with the cookie setting methods. If someone wants to share a cookie between multiple applications then they should modify the cookie extraction and setting methods to use a less-specific path.	16 years ago
Luke Taylor	2023ca283e	SEC-1358: Support empty context path in DefaultWebInvocationPrivilegeEvaluator This class was failing when an application was deployed at the root context because of an assertion which checked that the contexPath was not empty. An empty context path doesn't actually cause problems for the class so I've removed the assertion.	16 years ago
Luke Taylor	b323098167	Added gradle build files for taglibs, tutorial, contacts and openid. Changed build file names to match module names (by manipulating the project objects in the settings.gradle file).	16 years ago
Luke Taylor	e211f9b35f	SEC-1349: Allow configuration of OpenID with parameters which should be transferred to the return_to URL. The OpenIDAuthenticationFilter now has a returnToUrlParameters property (a Set). If this is set, the named parameters will be copied from the incoming submitted request to the return_to URL. If not set, it defaults to the "parameter" property of the AbstractRememberMeServices of the parent class. If remember-me is not in use, it defaults to the empty set. Enabled remember-me in the OpenID sample.	16 years ago
Luke Taylor	bc02fc2de1	Corrected "incorrect numer of tokens" error message in TokenBasedRememberMeServices.	16 years ago
Luke Taylor	052537c8b0	Removing $Id$ markers and stripping trailing whitespace from the codebase.	16 years ago
Luke Taylor	f5d36aef65	SEC-1350: Improved Javadoc for AbstractPreAuthenticatedProcessingFilter Added clarification that the credentials returned by the subclass should not be null or they will typically be rejected by the provider. Also added some general overview.	16 years ago
Luke Taylor	c6b8fe5e55	SEC-1346: Added missing 'return' statements after redirects. ConcurrentSessionFilter and SessionManagementFilter now return immediately after redirecting to the expired URL and invalid session URLs respectively. Extra tests added to check.	16 years ago
Luke Taylor	893f212fa5	Tidying	16 years ago
Luke Taylor	115d5b84ff	[maven-release-plugin] prepare for next development iteration	16 years ago

1 2 3 4

186 Commits (977bc2b164718a36360dcc6bf649938c7d7499b0)