9287892863
Release version 3.2.1.RELEASE
12 years ago
7f99a2dfbb
SEC-2487: Update to Spring 3.2.8.RELEASE
12 years ago
ec8b48150d
SEC-2474: Update poms
12 years ago
8d8475deb1
SEC-2455: form-login@login-processing-url & logout@logout-url use matchers
...
Remove the deprecation warnings of using setFilterProcessingUrl by invoking
the matcher methods instead.
12 years ago
2df5541905
SEC-2448: Update to HSQL 2.3.1
12 years ago
ca1080fb96
SEC-2439: HttpSessionCsrfTokenRepository setHeaderName sets header instead of parameter
12 years ago
a34178bc40
SEC-2434: Update to Spring 3.2.6 and Spring 4.0 GA
12 years ago
aaa7cec32e
SEC-2326: CsrfRequestDataValueProcessor implements RequestDataValueProcessor
...
Previously there was unecessary complexity in CsrfRequestDataValueProcessor
due to the non-passive changes in RequestDataValueProcessor. Now it simply
implements the interface with the methods for both versions of the interface.
This works since linking happens at runtime.
12 years ago
7f714ebb23
SEC-2422: Session timeout detection with CSRF protection
12 years ago
4460e84b29
Updates to pom.xml author and repo
12 years ago
59e13e7bbb
SEC-2404: CsrfAuthenticationStrategy creates new valid CsrfToken
12 years ago
2c8946c406
Next development version
12 years ago
9c703a3051
Release version 3.2.0.RC2
12 years ago
1a1f577a8b
SEC-2358: Add RequestHEaderRequestMatcher#toString()
12 years ago
e638f0a547
SEC-2357: old RequestMatcher interface extends new RequestMatcher
12 years ago
04b091c385
SEC-2369: PreAuthenticatedGrantedAuthoritiesUserDetailsService fix case to createUserDetails method
12 years ago
15a63c58a7
SEC-2368: DebugFilter outputs headers and HTTP method
12 years ago
1351c8bada
SEC-2362: Clarify AbstractRememberMeServices loginSuccess javadoc
12 years ago
e50b587d60
SEC-2360: AbstractRememberMeServices provide message for Assert on key fieldd
12 years ago
0b0e7dbea9
SEC-2359: Merge DefaultLoginPageViewFilter w/ DefaultLoginPageGeneratingFilter
12 years ago
51171efa7a
SEC-2357: Move *RequestMatcher to .matcher package
12 years ago
45ad74a0bd
SEC-2357: Fix package cycles
12 years ago
14b9050616
SEC-2357: Move *RequestMatchers to .matchers package
12 years ago
7d99436740
SEC-2358: Add RequestHeaderRequestMatcher
12 years ago
0ac1176152
Polish RequestMatcher logging and toString
12 years ago
cffbefadd1
SEC-2306: Fix Session Fixation logging race condition
...
Previously session fixation protection could output an incorrect warning
that session fixation protection did not work.
The code now synchronizes on WebUtils.getSessionMutex(..).
12 years ago
611a97023d
SEC-2352: HttpSessionCsrfTokenRepository lazy session creation
12 years ago
17efd25717
SEC-2331: Include Expires: 0 in security headers documentation
13 years ago
cea0cf9260
SEC-2243: Remove additional Debug Filter
13 years ago
b591881e95
SEC-2302: Provide beforeSpringSecurityFilterChain hook
...
This allows inserting filters before the springSecurityFilterChain.
13 years ago
88f41cdf62
SEC-2341: Update to Gradle 1.8
...
Some dependencies were necessary to update due to issues with JUnit
integration.
13 years ago
ddc0ef7ab3
SEC-2339: Added Logical (Or, And, Negated) RequestMatchers
13 years ago
788ba9a1fa
SEC-2329: Allow injecting of AuthenticationTrustResolver
13 years ago
9133c33f1d
SEC-2246: HttpSessionRequestCache.getRequest casts to RequestCache
...
The method getRequest use to cast to DefaultRequestCache, but this
is not necessary.
Now the cast is to SavedRequest.
13 years ago
8f8c6169e8
SEC-2331: Cache Control now includes Expires: 0
13 years ago
0114b457c0
SEC-2330: CacheControlHeadersWriter use a single header
13 years ago
32e9239fd2
SEC-2320: AuthenticationPrincipal can be null on invalid type
...
Previously a ClassCastException was thrown if the type was invalid. Now
a flag exists on AuthenticationPrincipal which indicates if a
ClassCastException should be thrown or not with the default being no error.
13 years ago
b22acd0768
SEC-2314: AbstractSecurityWebApplicationInitializer.getSessionTrackingModes() uses EnumSet
13 years ago
8e74407381
SEC-2296: HttpServletRequest.login should throw ServletException if already authenticated
...
See throws documentation at
http://docs.oracle.com/javaee/6/api/javax/servlet/http/HttpServletRequest.html#login%28java.lang.String,%20java.lang.String%29
13 years ago
e8ac11641b
SEC-2297: Add DispatchType.ASYNC as default for AbstractSecurityWebApplicationInitializer
13 years ago
3d2f23602f
SEC-2294: Update Spring Version to 3.2.4.RELEASE
13 years ago
43f4d01cf3
SEC-2292: Add test to assert CSRF bypass of methods is case sensitive
...
HTTP methods should be case sensitive, so add test to ensure that this is
the case http://www.w3.org/Protocols/rfc2616/rfc2616-sec5.html#sec5.1.1
13 years ago
6e9fb7930b
SEC-2298: Add AuthenticationPrincipalArgumentResolver
13 years ago
086056f191
SEC-2289: Make compatible with Spring 4 as well
...
There are a few subtle changes in Spring 4 that this commit addresses
13 years ago
26166ef6e8
SEC-2272: CsrfRequestDataValueProcessor support Spring 4 and Spring 3
13 years ago
3f69847a4e
SEC-2286: Log invalid CSRF tokens at debug level
13 years ago
d60108eaf6
SEC-2229: Add optional dependencies to spring-security-config
...
spring-tx and spring-jdbc aren't pulled in transitively from
spring-security-web now, so we must include them as optional dependencies.
13 years ago
33db440961
SEC-2129: AntPathRequestMatcher also supports case sensitive comparisions
13 years ago
7d1d856729
SEC-2229: spring-security-web dependency polish
...
- remove direct dependency on spring-aop
- spring-tx and spring-jdbc optional
13 years ago
534989c8ea
SEC-2103: Fix tests to verify debug logging instead of info
13 years ago
Spring Buildmaster
Rob Winch
Adrien be
kazuki43zoo