7f714ebb23
SEC-2422: Session timeout detection with CSRF protection
12 years ago
f9998d582a
Correct typo in AbstractRememberMeServices assertion
12 years ago
59e13e7bbb
SEC-2404: CsrfAuthenticationStrategy creates new valid CsrfToken
12 years ago
1a1f577a8b
SEC-2358: Add RequestHEaderRequestMatcher#toString()
12 years ago
e638f0a547
SEC-2357: old RequestMatcher interface extends new RequestMatcher
12 years ago
04b091c385
SEC-2369: PreAuthenticatedGrantedAuthoritiesUserDetailsService fix case to createUserDetails method
12 years ago
15a63c58a7
SEC-2368: DebugFilter outputs headers and HTTP method
12 years ago
1351c8bada
SEC-2362: Clarify AbstractRememberMeServices loginSuccess javadoc
12 years ago
e50b587d60
SEC-2360: AbstractRememberMeServices provide message for Assert on key fieldd
12 years ago
0b0e7dbea9
SEC-2359: Merge DefaultLoginPageViewFilter w/ DefaultLoginPageGeneratingFilter
12 years ago
51171efa7a
SEC-2357: Move *RequestMatcher to .matcher package
12 years ago
45ad74a0bd
SEC-2357: Fix package cycles
12 years ago
14b9050616
SEC-2357: Move *RequestMatchers to .matchers package
12 years ago
7d99436740
SEC-2358: Add RequestHeaderRequestMatcher
12 years ago
0ac1176152
Polish RequestMatcher logging and toString
13 years ago
cffbefadd1
SEC-2306: Fix Session Fixation logging race condition
...
Previously session fixation protection could output an incorrect warning
that session fixation protection did not work.
The code now synchronizes on WebUtils.getSessionMutex(..).
13 years ago
611a97023d
SEC-2352: HttpSessionCsrfTokenRepository lazy session creation
13 years ago
17efd25717
SEC-2331: Include Expires: 0 in security headers documentation
13 years ago
cea0cf9260
SEC-2243: Remove additional Debug Filter
13 years ago
b591881e95
SEC-2302: Provide beforeSpringSecurityFilterChain hook
...
This allows inserting filters before the springSecurityFilterChain.
13 years ago
ddc0ef7ab3
SEC-2339: Added Logical (Or, And, Negated) RequestMatchers
13 years ago
788ba9a1fa
SEC-2329: Allow injecting of AuthenticationTrustResolver
13 years ago
9133c33f1d
SEC-2246: HttpSessionRequestCache.getRequest casts to RequestCache
...
The method getRequest use to cast to DefaultRequestCache, but this
is not necessary.
Now the cast is to SavedRequest.
13 years ago
8f8c6169e8
SEC-2331: Cache Control now includes Expires: 0
13 years ago
0114b457c0
SEC-2330: CacheControlHeadersWriter use a single header
13 years ago
32e9239fd2
SEC-2320: AuthenticationPrincipal can be null on invalid type
...
Previously a ClassCastException was thrown if the type was invalid. Now
a flag exists on AuthenticationPrincipal which indicates if a
ClassCastException should be thrown or not with the default being no error.
13 years ago
b22acd0768
SEC-2314: AbstractSecurityWebApplicationInitializer.getSessionTrackingModes() uses EnumSet
13 years ago
8e74407381
SEC-2296: HttpServletRequest.login should throw ServletException if already authenticated
...
See throws documentation at
http://docs.oracle.com/javaee/6/api/javax/servlet/http/HttpServletRequest.html#login%28java.lang.String,%20java.lang.String%29
13 years ago
e8ac11641b
SEC-2297: Add DispatchType.ASYNC as default for AbstractSecurityWebApplicationInitializer
13 years ago
43f4d01cf3
SEC-2292: Add test to assert CSRF bypass of methods is case sensitive
...
HTTP methods should be case sensitive, so add test to ensure that this is
the case http://www.w3.org/Protocols/rfc2616/rfc2616-sec5.html#sec5.1.1
13 years ago
6e9fb7930b
SEC-2298: Add AuthenticationPrincipalArgumentResolver
13 years ago
086056f191
SEC-2289: Make compatible with Spring 4 as well
...
There are a few subtle changes in Spring 4 that this commit addresses
13 years ago
26166ef6e8
SEC-2272: CsrfRequestDataValueProcessor support Spring 4 and Spring 3
13 years ago
3f69847a4e
SEC-2286: Log invalid CSRF tokens at debug level
13 years ago
33db440961
SEC-2129: AntPathRequestMatcher also supports case sensitive comparisions
13 years ago
534989c8ea
SEC-2103: Fix tests to verify debug logging instead of info
13 years ago
acb2b680d0
SEC-2103: Change log of no results to debug
13 years ago
48283ec004
SEC-2276: Delay saving CsrfToken until token is accessed
...
This also removed the CsrfToken from the response headers to prevent the
token from being saved. If user's wish to return the CsrfToken in the
response headers, they should use the CsrfToken found on the request.
13 years ago
e9bb9e766e
SEC-1574: Add CSRF Support
13 years ago
797df51264
SEC-2135: Support HttpServletRequest#changeSessionId()
13 years ago
75fb971d23
SEC-2221: Fix the ignored media types to use includes instead of equals
13 years ago
13da42ca1b
SEC-2137: Allow disabling session fixation and enable concurrency control
13 years ago
867f02e8ac
SEC-2249: AbstractSecurityWebApplicationInitializer does not delegate WebApplicationInitializer
...
Previously AbstractSecurityWebApplicationInitializer delegated to a
WebApplicationInitializer, but it caused issues in some instances where
a container would pass the annonymous inner class to
SpringServletContainerInitializer which caused errors on startup.
Now AbstractSecurityWebApplicationInitializer registers the
ContextLoaderListener on its own instead of delegating.
13 years ago
e8278f3b9b
SEC-2249: AbstractSecurityWebApplicationInitializer allows register config
13 years ago
fdb73fac23
Remove @Override from interface define methods
13 years ago
94a73fee37
SEC-2230: Polish scoping and finals
13 years ago
606bddf598
SEC-2230: Add Header JavaConfig
...
Added JavaConfig for Headers. In the process, more HeaderWriter instances
were added so that we can reuse logic between the XML and JavaConfig. This
also prompted repackaging the writers.
13 years ago
c85328c5d1
SEC-2230: HTTP Strict Transport Security (HSTS)Add support for Strict
...
This is a distinct filter as apposed to reusing StaticHeaderWriter
since the specification specifies that the "Strict-Transport-Security"
header should only be set on secure requests. It would not make sense to
require DelegatingRequestMatcherHeaderWriter since this requirement is
in the specification.
13 years ago
8013cd54d6
SEC-2230: Added Cache Control support
13 years ago
7b164bb5e1
SEC-2230: Polish pull request
13 years ago
Rob Winch
David Alberto
Adrien be
kazuki43zoo