Spring/spring-boot
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Migrate to Spring Security lambda config

Browse Source 
Closes gh-35011
This commit is contained in:
Phillip Webb
2023-04-14 17:39:26 -07:00
parent 899ae9c37c
commit 00dc942e94
45 changed files with 172 additions and 141 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
spring-boot-project/spring-boot-actuator-autoconfigure/src/main/java/org/springframework/boot/actuate/autoconfigure/security/reactive/ReactiveManagementWebSecurityAutoConfiguration.java
View File

@@ -1,5 +1,5 @@
/*
* Copyright 2012-2022 the original author or authors.
* Copyright 2012-2023 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -29,7 +29,6 @@ import org.springframework.boot.autoconfigure.security.oauth2.client.reactive.Re
import org.springframework.boot.autoconfigure.security.oauth2.resource.reactive.ReactiveOAuth2ResourceServerAutoConfiguration;
import org.springframework.boot.autoconfigure.security.reactive.ReactiveSecurityAutoConfiguration;
import org.springframework.context.annotation.Bean;
import org.springframework.security.config.Customizer;
import org.springframework.security.config.annotation.web.reactive.EnableWebFluxSecurity;
import org.springframework.security.config.web.server.SecurityWebFiltersOrder;
import org.springframework.security.config.web.server.ServerHttpSecurity;
@@ -38,6 +37,8 @@ import org.springframework.security.web.server.WebFilterChainProxy;
import org.springframework.web.cors.reactive.PreFlightRequestHandler;
import org.springframework.web.cors.reactive.PreFlightRequestWebFilter;
import static org.springframework.security.config.Customizer.withDefaults;
/**
* {@link EnableAutoConfiguration Auto-configuration} for Reactive Spring Security when
* actuator is on the classpath. Specifically, it permits access to the health endpoint
@@ -63,8 +64,8 @@ public class ReactiveManagementWebSecurityAutoConfiguration {
});
PreFlightRequestWebFilter filter = new PreFlightRequestWebFilter(handler);
http.addFilterAt(filter, SecurityWebFiltersOrder.CORS);
http.httpBasic(Customizer.withDefaults());
http.formLogin(Customizer.withDefaults());
http.httpBasic(withDefaults());
http.formLogin(withDefaults());
return http.build();
}

11
spring-boot-project/spring-boot-actuator-autoconfigure/src/main/java/org/springframework/boot/actuate/autoconfigure/security/servlet/ManagementWebSecurityAutoConfiguration.java
View File

@@ -1,5 +1,5 @@
/*
* Copyright 2012-2022 the original author or authors.
* Copyright 2012-2023 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -31,11 +31,12 @@ import org.springframework.boot.autoconfigure.security.saml2.Saml2RelyingPartyAu
import org.springframework.boot.autoconfigure.security.servlet.SecurityAutoConfiguration;
import org.springframework.context.annotation.Bean;
import org.springframework.core.annotation.Order;
import org.springframework.security.config.Customizer;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.util.ClassUtils;
import static org.springframework.security.config.Customizer.withDefaults;
/**
* {@link EnableAutoConfiguration Auto-configuration} for Spring Security when actuator is
* on the classpath. It allows unauthenticated access to the {@link HealthEndpoint}. If
@@ -63,10 +64,10 @@ public class ManagementWebSecurityAutoConfiguration {
requests.anyRequest().authenticated();
});
if (ClassUtils.isPresent("org.springframework.web.servlet.DispatcherServlet", null)) {
http.cors();
http.cors(withDefaults());
}
http.formLogin(Customizer.withDefaults());
http.httpBasic(Customizer.withDefaults());
http.formLogin(withDefaults());
http.httpBasic(withDefaults());
return http.build();
}

6
spring-boot-project/spring-boot-actuator-autoconfigure/src/test/java/org/springframework/boot/actuate/autoconfigure/security/reactive/ReactiveManagementWebSecurityAutoConfigurationTests.java
View File

@@ -47,7 +47,6 @@ import org.springframework.http.server.reactive.ServerHttpResponse;
import org.springframework.mock.http.server.reactive.MockServerHttpRequest;
import org.springframework.mock.http.server.reactive.MockServerHttpResponse;
import org.springframework.security.authentication.ReactiveAuthenticationManager;
import org.springframework.security.config.Customizer;
import org.springframework.security.config.web.server.ServerHttpSecurity;
import org.springframework.security.web.server.SecurityWebFilterChain;
import org.springframework.security.web.server.WebFilterChainProxy;
@@ -57,6 +56,7 @@ import org.springframework.web.server.adapter.HttpWebHandlerAdapter;
import static org.assertj.core.api.Assertions.assertThat;
import static org.mockito.Mockito.mock;
import static org.springframework.security.config.Customizer.withDefaults;
/**
* Tests for {@link ReactiveManagementWebSecurityAutoConfiguration}.
@@ -164,7 +164,7 @@ class ReactiveManagementWebSecurityAutoConfigurationTests {
exchanges.pathMatchers("/foo").permitAll();
exchanges.anyExchange().authenticated();
});
http.formLogin(Customizer.withDefaults());
http.formLogin(withDefaults());
return http.build();
}
@@ -192,7 +192,7 @@ class ReactiveManagementWebSecurityAutoConfigurationTests {
private List<SecurityWebFilterChain> getFilterChains(ServerHttpSecurity http) {
http.authorizeExchange((exchanges) -> exchanges.anyExchange().authenticated());
http.formLogin(Customizer.withDefaults());
http.formLogin(withDefaults());
return Collections.singletonList(http.build());
}

4
spring-boot-project/spring-boot-actuator-autoconfigure/src/test/java/org/springframework/boot/actuate/autoconfigure/security/servlet/AbstractEndpointRequestIntegrationTests.java
View File

@@ -48,6 +48,8 @@ import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.test.web.reactive.server.WebTestClient;
import static org.springframework.security.config.Customizer.withDefaults;
/**
* Abstract base class for {@link EndpointRequest} tests.
*
@@ -195,7 +197,7 @@ abstract class AbstractEndpointRequestIntegrationTests {
requests.requestMatchers(EndpointRequest.toAnyEndpoint()).authenticated();
requests.anyRequest().hasRole("ADMIN");
});
http.httpBasic();
http.httpBasic(withDefaults());
return http.build();
}

10
spring-boot-project/spring-boot-actuator-autoconfigure/src/test/java/org/springframework/boot/actuate/autoconfigure/security/servlet/ManagementWebSecurityAutoConfigurationTests.java
View File

@@ -44,7 +44,6 @@ import org.springframework.mock.web.MockFilterChain;
import org.springframework.mock.web.MockHttpServletRequest;
import org.springframework.mock.web.MockHttpServletResponse;
import org.springframework.mock.web.MockServletContext;
import org.springframework.security.config.Customizer;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.web.FilterChainProxy;
import org.springframework.security.web.SecurityFilterChain;
@@ -52,6 +51,7 @@ import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
import org.springframework.web.context.WebApplicationContext;
import static org.assertj.core.api.Assertions.assertThat;
import static org.springframework.security.config.Customizer.withDefaults;
/**
* Tests for {@link ManagementWebSecurityAutoConfiguration}.
@@ -181,8 +181,8 @@ class ManagementWebSecurityAutoConfigurationTests {
requests.requestMatchers(new AntPathRequestMatcher("/foo")).permitAll();
requests.anyRequest().authenticated();
});
http.formLogin(Customizer.withDefaults());
http.httpBasic();
http.formLogin(withDefaults());
http.httpBasic(withDefaults());
return http.build();
}
@@ -207,8 +207,8 @@ class ManagementWebSecurityAutoConfigurationTests {
@Order(SecurityProperties.BASIC_AUTH_ORDER - 1)
SecurityFilterChain testRemoteDevToolsSecurityFilterChain(HttpSecurity http) throws Exception {
http.securityMatcher(new AntPathRequestMatcher("/**"));
http.authorizeHttpRequests().anyRequest().anonymous();
http.csrf().disable();
http.authorizeHttpRequests((requests) -> requests.anyRequest().anonymous());
http.csrf((csrf) -> csrf.disable());
return http.build();
}