f269373442
IDE-791: Remove explicit Spring LDAP class dependencies from LdapServerBDP.
18 years ago
4f6b4e4bfd
Make sample login pages use c:out for data output
18 years ago
8b2c0468ff
OPEN - issue SEC-834: Session fixation attack protection will cause problems with URL rewriting
...
http://jira.springframework.org/browse/SEC-834 . Modified HttpSecurityBDP to add session-fixation parameters to openId and form-login filters. Also added sessionRegistry property to AbstractProcessingFilter so that it doesn't conflict with concurrent session control.
18 years ago
d17a2da9e0
SEC-834: Session fixation attack protection will cause problems with URL rewriting
...
http://jira.springframework.org/browse/SEC-834 . Changed position of SessionFixationProtectionFilter and modified it to make a decision about whether authentication has taken place prior to calling doFilter(). Previously it did this on the return through the filter chain, which caused the problem described in this issue.
18 years ago
7f38c656ca
SEC-820: Expand regular expression used in hierarchical roles.
18 years ago
6493df13f8
SEC-803: Removed use of websphere SubjectHelper class.
18 years ago
d4defb10fe
SEC-833: Fixed login-failure-url in contacts sample app.
18 years ago
59543af4fb
SEC-826: Support for JPA PersistenceContext annotation broken
...
http://jira.springframework.org/browse/SEC-826 Moved all injection post-processing to BeanPostProcessors (and deleted bean factory post-processor) to prevent early instantiation problems. Beas should now all be instantiated before the injection takes place.
18 years ago
332f8fe5a1
SEC-624: Minor updates to docs
18 years ago
7a8eec11da
SEC-765: Brief outline of preauth sample
18 years ago
ff61644219
SEC-740: More on preauth
18 years ago
1fee538c7e
Fixed typo in setter method (uses of).
18 years ago
ae2470127c
Fixed typo in setter method "seAttributePrefix"
18 years ago
2a4d859812
SEC-829: Minor doc fix
18 years ago
15b893f9ae
SEC-809: OpenIDProcessingFilter updated to set authentication details (to make compatible with concurrent session control).
18 years ago
de886e36fa
SEC-624: Expanded general info on obtaining samples and added pointers to ldap and cas versions
18 years ago
ad9a667b75
SEC-624: Inserted sub-sections for key class definitions so they appear in toc
18 years ago
f70701d55a
SEC-624: Added section on 'getting the source' for reference from samples chapter
18 years ago
e1b226ee57
Added 2.0.2 namespace file
18 years ago
af0153d833
Extended intro to Authentication part to include pointers to tech overview and namespace config
18 years ago
d78a021fe1
Added basic intro to preauth
18 years ago
e1c17450b3
Updated faqs to add infinite loop and access denied debug message
18 years ago
add2649397
Javadoc typo.
18 years ago
781d88bd30
OPEN - issue SEC-825: Query string isn't beig stripped from URLs when ant matcher is in use (regression issue)
...
http://jira.springframework.org/browse/SEC-825 . Make sure the property is set on DefaultFilterInvocationDefinitionSource when ant paths are in use.
18 years ago
1030dca353
SEC-786: Added information on the need ofor a UserDetailsService if using auto-config/remember-me
18 years ago
b99f9d343d
SEC-624: Added some info on use of role-prefix
18 years ago
c0e829a41d
SEC-700: Added info on new remember-me imlementation and namespace config examples
18 years ago
5a1258a4ca
Corrected references to parts and reading order
18 years ago
883b92e7bd
SEC-822: Converted to long arithmetic to prevent integer overflowing with long token validity periods
18 years ago
301d021bf5
SEC-817: NPE in org.springframework.security.config.FilterChainProxyPostProcessor
...
Reversed order of beanName.equals() call as suggested.
18 years ago
8ad2d681ab
SEC-818: Changed redirect URL validation to ignore potential property placeholders at parsing time and report a warning through the parser context rather than an error. Also validated the URLs in the beans themselves using Asserts, so an exception will occur later when the beans have been created rather than while assembling the bean definitions.
18 years ago
5cf0c84e2f
SEC-814: Added standard bean config to ldap example and updated doc to provide some pointers to DefaultLdapAuthoritiesPopulator
18 years ago
afc757e618
Removed reference to LdapDataAccessException since it isn't actually mentioned except in javadoc
18 years ago
c333070fe3
Javadoc tidying
18 years ago
fca3a2a709
SEC-812: Added missing TextUtils file
18 years ago
fa44c74993
SEC-812: Added entity-escaping of username stored under last username key, to prevent problems if it is rendered in a page without escaping the text.
18 years ago
06719053f1
Removed commons lang dependency.
18 years ago
e7b6fe09e1
Corrected css for 'poweredBy'
18 years ago
9961c7f867
Moved to correct build location.
18 years ago
7a2e1e13d3
SEC-811: Provide a mechanism to allocate and rebuild cryptographically strong, randomised tokens.
18 years ago
a599ef5398
[maven-release-plugin] prepare for next development iteration
18 years ago
3e808335a4
[maven-release-plugin] prepare release spring-security-parent-2.0.1
18 years ago
054e2f6c38
SEC-624: Start of preauth document
18 years ago
79ca0d1612
Set correct 'test' scope on core-tests dependency
18 years ago
18a9965b80
Moved dummy file out of default package for easy exclusion from javadoc
18 years ago
de179c3e46
Fixed javadoc links
18 years ago
fc498954c6
Updated sample context files to point at 2.0.1 schema
18 years ago
014f21ee85
Deleted attributes sample
18 years ago
6ecfa0541f
SEC-806: Osgi-ified more modules
18 years ago
4984d4be65
OPEN - issue SEC-757: Add validation of redirect URLs on namespace
...
http://jira.springframework.org/browse/SEC-757 . Added validation method to ConfigUtils and calls to it for url attributes.
18 years ago
Luke Taylor
Ben Alex