This component already uses by default a URI that doesn't require
a CSRF token and aalready allows for configuring a cookie name.
So, by making it public and configurable in the DSL, both
of these tickets quite naturally close.
Closes gh-13841
Closes gh-14904
This commit removes unnecessary main-branch merges starting from
8750608b5b and adds the following
needed commit(s) that were made afterward:
- 5dce82c48b
- Add OAuth2ReactiveAuthorizationManagers
- Code to interfaces
- Align error message with the same in
AuthorityAuthorizationManager
- Adjust expectations in tests to confirm an
appropriately constructed authorizaion manager
- Add JavaDoc and reference documentation
Issue gh-13654
Previously, the default authority was ROLE_USER when using
oauth2Login() for both OAuth2 and OIDC providers.
* Default authority for OAuth2UserAuthority is now OAUTH2_USER
* Default authority for OidcUserAuthority is now OIDC_USER
Documentation has been updated to include this implementation detail.
Closes gh-7856
Before, Spring Security's @Enable* annotations were meta-annotated with @Configuration.
While convenient, this is not consistent with the rest of the Spring projects and most notably
Spring Framework's @Enable annotations. Additionally, the introduction of support for
@Configuration(proxyBeanMethods=false) in Spring Framework provides a compelling reason to
remove @Configuration meta-annotation from Spring Security's @Enable annotations and allow
users to opt into their preferred configuration mode.
Closes gh-6613
Signed-off-by: Joshua Sattler <joshua.sattler@mailbox.org>
Steve Riesenberg
Josh Cummings
Hero Wanders
Junhyunny
Rob Winch
Marcus Hert Da Coregio
MrJovanovic13
Krishna Chaitanya Surapaneni
Daniel Shuy
Steve Riesenberg
Rob Winch
Joe Grandja
Ger Roza
Joshua Sattler
André Luis Gomes
Yuriy Savchenko