spring-security

Commit Graph

Author	SHA1	Message	Date
Zhivko Delchev	e97c5a533b	Reverse content type check When MultipartFormData is enabled currently the CsrfWebFilter compares the content-type header against MULTIPART_FORM_DATA MediaType which leads to NullPointerExecption when there is no content-type header. This commit reverse the check to compare the MULTIPART_FORM_DATA MediaType against the content-type which contains null check and avoids the exception. closes gh-11204 Closes gh-11205	4 years ago
Rob Winch	077c9e0b3e	StrictHttpFirewall allows CJKV characters Closes gh-11264	4 years ago
Rob Winch	70863952ae	AntRegexRequestMatcher Optimization Closes gh-11234	4 years ago
Rob Winch	af95be34c6	Extract rejectNonPrintableAsciiCharactersInFieldName Closes gh-11234	4 years ago
Marcus Da Coregio	c67632225d	Use ServletContext in AuthorizationManagerWebInvocationPrivilegeEvaluator Closes gh-10908	4 years ago
Marcus Da Coregio	70b67cd2f1	AuthorizationManagerWebInvocationPrivilegeEvaluator grant access when AuthorizationManager abstains Closes gh-10950	4 years ago
Josh Cummings	f0c548cee7	Invert Log Messages Closes gh-10909	4 years ago
Josh Cummings	f53c65b3a0	Polish ignoring() log messaging - Public API remains unchanged Issue gh-9334	4 years ago
Manuel Jordan	0be772ff5b	Print ignore message DefaultSecurityFilterChain When either `web.ignoring().mvcMatchers(...)` or `web.ignoring().antMatchers(...)` methods are used, for all their variations, the DefaultSecurityFilterChain class now indicates correctly through its ouput what paths are ignored according the `ignoring()` settings. Closes gh-9334	4 years ago
Marcus Da Coregio	a041e7c943	RequestMatcherDelegatingWebInvocationPrivilegeEvaluator doesn't provided access to the ServletContext Closes gh-10779	4 years ago
Rob Winch	04f3bbcefa	javax.xml.bind:jaxb-api -> jakarta.xml.bind:jakarta.xml.bind-api Issue gh-10501	4 years ago
Rob Winch	c67ee6f2a8	javax.servlet:javax.servlet-api -> jakarta.servlet:jakarta.servlet-api Issue gh-10501	4 years ago
Josh Cummings	6c5ac0d8ec	Use noNullElements Collection#contains(null) does not work for all collection types Closes gh-10703	4 years ago
Marcus Da Coregio	e7e3f06044	Fix @since tag Issue gh-10590, gh-10554	4 years ago
Marcus Da Coregio	994e93741b	Configure WebInvocationPrivilegeEvaluator bean for multiple filter chains Closes gh-10554	4 years ago
Marcus Da Coregio	04e1a11e35	Add RequestMatcherEntry	4 years ago
Marcus Da Coregio	547056d5cc	Introduce AuthorizationManagerWebInvocationPrivilegeEvaluator Closes gh-10590	4 years ago
Steve Riesenberg	c7ffd2513a	Update copyright year Issue gh-10557	4 years ago
Steve Riesenberg	b3e0f167ff	Fix case sensitive headers comparison Closes gh-10557	4 years ago
Marcus Da Coregio	caad3d57e2	Improve log message when no CSRF token found Closes gh-10436	4 years ago
Emil Sierżęga	04b47c5928	Fixed various broken links in Javadocs	4 years ago
Emil Sierżęga	a188138715	Javadocs author tag doesn't work in methods	4 years ago
Rob Winch	f836897190	Checkstyle Fixes - Javadoc tag ordering - Private constructors before inner classes Issue gh-10394	4 years ago
Rob Winch	e1f4ec1137	Fix Jackson	4 years ago
Marcus Da Coregio	faec20bc69	Update DefaultWebInvocationPrivilegeEvaluator to use current ServletContext Closes gh-10208	4 years ago
Josh Cummings	7b98c2ea95	Restructure SwitchUserFilter Logs Issue gh-6311	4 years ago
Marcus Da Coregio	02b2fcc6f0	Restore ManagementConfigurationPlugin Issue gh-9615	4 years ago
Marcus Da Coregio	d2e5f2ae0d	Update Gradle to 7.2 Closes gh-9615	4 years ago
Eleftheria Stein	7d81a52780	Allow AuthenticationPrincipal argument type to be primitive Closes gh-10172	4 years ago
heowc	84d173c310	Fix typo	4 years ago
Bogdan Ilchyshyn	a4c088a3b3	Introducing WebSessionServerLogoutHandler Closes gh-4838	5 years ago
Hiroshi Shirosaki	6f3e346b76	Add SecurityContextHolder#addListener Closes gh-10032	5 years ago
Josh Cummings	b8d51725c7	Immutable SecurityContext Issue gh-10032	5 years ago
Rob Winch	f73f213f50	Remove DependencySetPlugin Closes gh-10070	5 years ago
Rob Winch	f800d2c993	Add hamcrest dependency	5 years ago
Rob Winch	b6ff4d3674	Fix mockito UnnecessaryStubbingException	5 years ago
Rob Winch	3e93b024d6	openrewrite Junit Migration	5 years ago
Rob Winch	14240b2559	Remove Powermock Powermock does not support JUnit5 yet, so we need to remove it to support JUnit 5. Additionally, maintaining additional libraries adds extra work for the team. Mockito now supports final classes and static method mocking. This commit replaces Powermock with mockito-inline. Closes gh-6025	5 years ago
Evgeniy Cheban	d121ab9565	Support A Well-Known URL for Changing Passwords Closes gh-8657	5 years ago
Alexey Markevich	3219fd554d	DigestAuthenticationFilter decodes nonce only once Closes gh-8455	5 years ago
Steve Riesenberg	3bb8e1d200	Remove redundant translations in spring-security-web	5 years ago
Ruben Suarez Alvarez	7cd344acab	Add spanish translation of insufficient authentication and cookie stolen	5 years ago
Josh Cummings	ca76c54471	Polish CsrfWebFilterTests Issue gh-9113	5 years ago
Tomoki Tsubaki	0c8b6df82a	Cache Mono that generate the CSRF token Closes gh-9113	5 years ago
AlexeyAnufriev	baac9e0cf2	Properly clean cookies with context path after logout Closes gh-8846	5 years ago
Marcus Hert da Coregio	2a7998d0fc	Adjust createNewSessionIfAllowed to prevent NPE Ensure that isTransientAuthentication reuses the same authentication object from saveContext Closes gh-8947	5 years ago
César Revert	cf74ad3a52	Anonymous in ExceptionTranslationWebFilter The ExceptionTranslationWebFilter does not support correctly when anonymous authentication is enabled. With this enabled provoked always the execution of the access denied handler, and with this fix it behaves like the ExceptionTranslationFilter (servlet), executing the access denied handler only if the principal is not empty and neither anonymous. Closes gh-9130	5 years ago
Craig Andrews	a7fbae8355	Add test for RequestedUrlRedirectInvalidSessionStrategy	5 years ago
Craig Andrews	0e6d47b082	Add guard around debug logging involving string concatenation	5 years ago
Craig Andrews	0af74ce134	Use ServletUriComponentsBuilder instead of UrlPathHelper	5 years ago

1 2 3 4 5 ...

1166 Commits (5.6.6)