Spring/spring-boot
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Migrate to Spring Security lambda config

Browse Source 
Closes gh-35011
This commit is contained in:
Phillip Webb
2023-04-14 17:39:26 -07:00
parent 899ae9c37c
commit 00dc942e94
45 changed files with 172 additions and 141 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
spring-boot-tests/spring-boot-smoke-tests/spring-boot-smoke-test-actuator-custom-security/src/main/java/smoketest/actuator/customsecurity/SecurityConfiguration.java
View File

@@ -24,7 +24,6 @@ import org.springframework.boot.actuate.web.mappings.MappingsEndpoint;
import org.springframework.boot.autoconfigure.security.servlet.PathRequest;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.Customizer;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.User.UserBuilder;
@@ -32,6 +31,8 @@ import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.provisioning.InMemoryUserDetailsManager;
import org.springframework.security.web.SecurityFilterChain;
import static org.springframework.security.config.Customizer.withDefaults;
@Configuration(proxyBeanMethods = false)
public class SecurityConfiguration {
@@ -65,8 +66,8 @@ public class SecurityConfiguration {
requests.requestMatchers("/error").permitAll();
requests.requestMatchers("/**").hasRole("USER");
});
http.cors(Customizer.withDefaults());
http.httpBasic();
http.cors(withDefaults());
http.httpBasic(withDefaults());
return http.build();
}

2
spring-boot-tests/spring-boot-smoke-tests/spring-boot-smoke-test-actuator/src/test/java/smoketest/actuator/ShutdownSampleActuatorApplicationTests.java
View File

@@ -74,7 +74,7 @@ class ShutdownSampleActuatorApplicationTests {
@Bean
SecurityFilterChain configure(HttpSecurity http) throws Exception {
http.csrf().disable();
http.csrf((csrf) -> csrf.disable());
return http.build();
}

5
spring-boot-tests/spring-boot-smoke-tests/spring-boot-smoke-test-secure-jersey/src/main/java/smoketest/secure/jersey/SecurityConfiguration.java
View File

@@ -20,6 +20,7 @@ import org.springframework.boot.actuate.autoconfigure.security.servlet.EndpointR
import org.springframework.boot.actuate.web.mappings.MappingsEndpoint;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.Customizer;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.provisioning.InMemoryUserDetailsManager;
@@ -28,8 +29,8 @@ import org.springframework.security.web.SecurityFilterChain;
@Configuration
public class SecurityConfiguration {
@SuppressWarnings("deprecation")
@Bean
@SuppressWarnings("deprecation")
public InMemoryUserDetailsManager inMemoryUserDetailsManager() {
return new InMemoryUserDetailsManager(
User.withDefaultPasswordEncoder()
@@ -52,7 +53,7 @@ public class SecurityConfiguration {
.hasRole("ACTUATOR");
requests.requestMatchers("/**").hasRole("USER");
});
http.httpBasic();
http.httpBasic(Customizer.withDefaults());
return http.build();
}

3
spring-boot-tests/spring-boot-smoke-tests/spring-boot-smoke-test-secure-webflux/src/test/java/smoketest/secure/webflux/ManagementPortSampleSecureWebFluxTests.java
View File

@@ -35,6 +35,7 @@ import org.springframework.security.web.server.SecurityWebFilterChain;
import org.springframework.test.web.reactive.server.WebTestClient;
import static org.assertj.core.api.Assertions.assertThat;
import static org.springframework.security.config.Customizer.withDefaults;
/**
* Integration tests for separate management and main service ports.
@@ -119,7 +120,7 @@ class ManagementPortSampleSecureWebFluxTests {
exchanges.pathMatchers("/login").permitAll();
exchanges.anyExchange().authenticated();
});
http.httpBasic();
http.httpBasic(withDefaults());
return http.build();
}

5
spring-boot-tests/spring-boot-smoke-tests/spring-boot-smoke-test-secure-webflux/src/test/java/smoketest/secure/webflux/SampleSecureWebFluxCustomSecurityTests.java
View File

@@ -29,13 +29,14 @@ import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.http.HttpStatus;
import org.springframework.http.MediaType;
import org.springframework.security.config.Customizer;
import org.springframework.security.config.web.server.ServerHttpSecurity;
import org.springframework.security.core.userdetails.MapReactiveUserDetailsService;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.web.server.SecurityWebFilterChain;
import org.springframework.test.web.reactive.server.WebTestClient;
import static org.springframework.security.config.Customizer.withDefaults;
/**
* Integration tests for a secure reactive application with custom security.
*
@@ -165,7 +166,7 @@ class SampleSecureWebFluxCustomSecurityTests {
exchanges.pathMatchers("/login").permitAll();
exchanges.anyExchange().authenticated();
});
http.httpBasic(Customizer.withDefaults());
http.httpBasic(withDefaults());
return http.build();
}

11
spring-boot-tests/spring-boot-smoke-tests/spring-boot-smoke-test-session-hazelcast/src/main/java/smoketest/session/hazelcast/SecurityConfiguration.java
View File

@@ -1,5 +1,5 @@
/*
* Copyright 2012-2022 the original author or authors.
* Copyright 2012-2023 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -20,10 +20,11 @@ import org.springframework.boot.actuate.autoconfigure.security.servlet.EndpointR
import org.springframework.boot.actuate.health.HealthEndpoint;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.Customizer;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.web.SecurityFilterChain;
import static org.springframework.security.config.Customizer.withDefaults;
/**
* Security configuration.
*
@@ -38,9 +39,9 @@ class SecurityConfiguration {
requests.requestMatchers(EndpointRequest.to(HealthEndpoint.class)).permitAll();
requests.anyRequest().authenticated();
});
http.formLogin(Customizer.withDefaults());
http.httpBasic(Customizer.withDefaults());
http.csrf().disable();
http.formLogin(withDefaults());
http.httpBasic(withDefaults());
http.csrf((csrf) -> csrf.disable());
return http.build();
}

11
spring-boot-tests/spring-boot-smoke-tests/spring-boot-smoke-test-session-jdbc/src/main/java/smoketest/session/SecurityConfiguration.java
View File

@@ -1,5 +1,5 @@
/*
* Copyright 2012-2022 the original author or authors.
* Copyright 2012-2023 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -20,10 +20,11 @@ import org.springframework.boot.actuate.autoconfigure.security.servlet.EndpointR
import org.springframework.boot.actuate.health.HealthEndpoint;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.Customizer;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.web.SecurityFilterChain;
import static org.springframework.security.config.Customizer.withDefaults;
/**
* Security configuration.
*
@@ -38,9 +39,9 @@ class SecurityConfiguration {
requests.requestMatchers(EndpointRequest.to(HealthEndpoint.class)).permitAll();
requests.anyRequest().authenticated();
});
http.formLogin(Customizer.withDefaults());
http.httpBasic(Customizer.withDefaults());
http.csrf().disable();
http.formLogin(withDefaults());
http.httpBasic(withDefaults());
http.csrf((csrf) -> csrf.disable());
return http.build();
}

11
spring-boot-tests/spring-boot-smoke-tests/spring-boot-smoke-test-session-mongo/src/main/java/smoketest/session/mongodb/SecurityConfiguration.java
View File

@@ -1,5 +1,5 @@
/*
* Copyright 2012-2022 the original author or authors.
* Copyright 2012-2023 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -20,10 +20,11 @@ import org.springframework.boot.actuate.autoconfigure.security.servlet.EndpointR
import org.springframework.boot.actuate.health.HealthEndpoint;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.Customizer;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.web.SecurityFilterChain;
import static org.springframework.security.config.Customizer.withDefaults;
/**
* Security configuration.
*
@@ -38,9 +39,9 @@ class SecurityConfiguration {
requests.requestMatchers(EndpointRequest.to(HealthEndpoint.class)).permitAll();
requests.anyRequest().authenticated();
});
http.formLogin(Customizer.withDefaults());
http.httpBasic(Customizer.withDefaults());
http.csrf().disable();
http.formLogin(withDefaults());
http.httpBasic(withDefaults());
http.csrf((csrf) -> csrf.disable());
return http.build();
}

11
spring-boot-tests/spring-boot-smoke-tests/spring-boot-smoke-test-session-redis/src/main/java/smoketest/session/redis/SecurityConfiguration.java
View File

@@ -1,5 +1,5 @@
/*
* Copyright 2012-2022 the original author or authors.
* Copyright 2012-2023 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -20,10 +20,11 @@ import org.springframework.boot.actuate.autoconfigure.security.servlet.EndpointR
import org.springframework.boot.actuate.health.HealthEndpoint;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.Customizer;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.web.SecurityFilterChain;
import static org.springframework.security.config.Customizer.withDefaults;
/**
* Security configuration.
*
@@ -38,9 +39,9 @@ class SecurityConfiguration {
requests.requestMatchers(EndpointRequest.to(HealthEndpoint.class)).permitAll();
requests.anyRequest().authenticated();
});
http.formLogin(Customizer.withDefaults());
http.httpBasic(Customizer.withDefaults());
http.csrf().disable();
http.formLogin(withDefaults());
http.httpBasic(withDefaults());
http.csrf((csrf) -> csrf.disable());
return http.build();
}

19
spring-boot-tests/spring-boot-smoke-tests/spring-boot-smoke-test-session-webflux-mongo/src/main/java/smoketest/session/SampleSessionWebFluxMongoApplication.java
View File

@@ -1,5 +1,5 @@
/*
* Copyright 2012-2022 the original author or authors.
* Copyright 2012-2023 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -23,6 +23,8 @@ import org.springframework.security.config.web.server.ServerHttpSecurity;
import org.springframework.security.web.server.SecurityWebFilterChain;
import org.springframework.security.web.server.context.WebSessionServerSecurityContextRepository;
import static org.springframework.security.config.Customizer.withDefaults;
@SpringBootApplication
public class SampleSessionWebFluxMongoApplication {
@@ -32,17 +34,10 @@ public class SampleSessionWebFluxMongoApplication {
@Bean
public SecurityWebFilterChain springSecurityFilterChain(ServerHttpSecurity http) {
// @formatter:off
return http
.authorizeExchange()
.anyExchange().authenticated()
.and()
.httpBasic().securityContextRepository(new WebSessionServerSecurityContextRepository())
.and()
.formLogin()
.and()
.build();
// @formatter:on
http.authorizeExchange((exchange) -> exchange.anyExchange().authenticated());
http.httpBasic((basic) -> basic.securityContextRepository(new WebSessionServerSecurityContextRepository()));
http.formLogin(withDefaults());
return http.build();
}
}

19
spring-boot-tests/spring-boot-smoke-tests/spring-boot-smoke-test-session-webflux-redis/src/main/java/smoketest/session/SampleSessionWebFluxRedisApplication.java
View File

@@ -1,5 +1,5 @@
/*
* Copyright 2012-2022 the original author or authors.
* Copyright 2012-2023 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -23,6 +23,8 @@ import org.springframework.security.config.web.server.ServerHttpSecurity;
import org.springframework.security.web.server.SecurityWebFilterChain;
import org.springframework.security.web.server.context.WebSessionServerSecurityContextRepository;
import static org.springframework.security.config.Customizer.withDefaults;
@SpringBootApplication
public class SampleSessionWebFluxRedisApplication {
@@ -32,17 +34,10 @@ public class SampleSessionWebFluxRedisApplication {
@Bean
public SecurityWebFilterChain springSecurityFilterChain(ServerHttpSecurity http) {
// @formatter:off
return http
.authorizeExchange()
.anyExchange().authenticated()
.and()
.httpBasic().securityContextRepository(new WebSessionServerSecurityContextRepository())
.and()
.formLogin()
.and()
.build();
// @formatter:on
http.authorizeExchange((exchange) -> exchange.anyExchange().authenticated());
http.httpBasic((basic) -> basic.securityContextRepository(new WebSessionServerSecurityContextRepository()));
http.formLogin(withDefaults());
return http.build();
}
}

10
spring-boot-tests/spring-boot-smoke-tests/spring-boot-smoke-test-web-method-security/src/main/java/smoketest/security/method/SampleMethodSecurityApplication.java
View File

@@ -36,6 +36,8 @@ import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.servlet.config.annotation.ViewControllerRegistry;
import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;
import static org.springframework.security.config.Customizer.withDefaults;
@SpringBootApplication
@EnableMethodSecurity(securedEnabled = true)
public class SampleMethodSecurityApplication implements WebMvcConfigurer {
@@ -73,12 +75,12 @@ public class SampleMethodSecurityApplication implements WebMvcConfigurer {
@Bean
SecurityFilterChain configure(HttpSecurity http) throws Exception {
http.csrf().disable();
http.csrf((csrf) -> csrf.disable());
http.authorizeHttpRequests((requests) -> {
requests.dispatcherTypeMatchers(DispatcherType.FORWARD).permitAll();
requests.anyRequest().fullyAuthenticated();
});
http.httpBasic();
http.httpBasic(withDefaults());
http.formLogin((form) -> form.loginPage("/login").permitAll());
http.exceptionHandling((exceptions) -> exceptions.accessDeniedPage("/access"));
return http.build();
@@ -92,10 +94,10 @@ public class SampleMethodSecurityApplication implements WebMvcConfigurer {
@Bean
SecurityFilterChain actuatorSecurity(HttpSecurity http) throws Exception {
http.csrf().disable();
http.csrf((csrf) -> csrf.disable());
http.securityMatcher(EndpointRequest.toAnyEndpoint());
http.authorizeHttpRequests((requests) -> requests.anyRequest().authenticated());
http.httpBasic();
http.httpBasic(withDefaults());
return http.build();
}

4
spring-boot-tests/spring-boot-smoke-tests/spring-boot-smoke-test-web-secure-custom/src/main/java/smoketest/web/secure/custom/SampleWebSecureCustomApplication.java
View File

@@ -1,5 +1,5 @@
/*
* Copyright 2012-2022 the original author or authors.
* Copyright 2012-2023 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -45,7 +45,7 @@ public class SampleWebSecureCustomApplication implements WebMvcConfigurer {
@Bean
SecurityFilterChain configure(HttpSecurity http) throws Exception {
http.csrf().disable();
http.csrf((csrf) -> csrf.disable());
http.authorizeHttpRequests((requests) -> {
requests.dispatcherTypeMatchers(DispatcherType.FORWARD).permitAll();
requests.anyRequest().fullyAuthenticated();

4
spring-boot-tests/spring-boot-smoke-tests/spring-boot-smoke-test-web-secure-jdbc/src/main/java/smoketest/web/secure/jdbc/SampleWebSecureJdbcApplication.java
View File

@@ -1,5 +1,5 @@
/*
* Copyright 2012-2022 the original author or authors.
* Copyright 2012-2023 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -48,7 +48,7 @@ public class SampleWebSecureJdbcApplication implements WebMvcConfigurer {
@Bean
SecurityFilterChain configure(HttpSecurity http) throws Exception {
http.csrf().disable();
http.csrf((csrf) -> csrf.disable());
http.authorizeHttpRequests((requests) -> {
requests.dispatcherTypeMatchers(DispatcherType.FORWARD).permitAll();
requests.anyRequest().fullyAuthenticated();

6
spring-boot-tests/spring-boot-smoke-tests/spring-boot-smoke-test-web-secure/src/test/java/smoketest/web/secure/CustomServletPathErrorPageTests.java
View File

@@ -1,5 +1,5 @@
/*
* Copyright 2012-2022 the original author or authors.
* Copyright 2012-2023 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -22,6 +22,8 @@ import org.springframework.context.annotation.Bean;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.web.SecurityFilterChain;
import static org.springframework.security.config.Customizer.withDefaults;
/**
* Tests to ensure that the error page with a custom servlet path is accessible only to
* authorized users.
@@ -48,7 +50,7 @@ class CustomServletPathErrorPageTests extends AbstractErrorPageTests {
requests.requestMatchers("/public/**").permitAll();
requests.anyRequest().fullyAuthenticated();
});
http.httpBasic();
http.httpBasic(withDefaults());
http.formLogin((form) -> form.loginPage("/custom/servlet/path/login").permitAll());
return http.build();
}

6
spring-boot-tests/spring-boot-smoke-tests/spring-boot-smoke-test-web-secure/src/test/java/smoketest/web/secure/CustomServletPathUnauthenticatedErrorPageTests.java
View File

@@ -1,5 +1,5 @@
/*
* Copyright 2012-2022 the original author or authors.
* Copyright 2012-2023 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -21,6 +21,8 @@ import org.springframework.context.annotation.Bean;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.web.SecurityFilterChain;
import static org.springframework.security.config.Customizer.withDefaults;
/**
* Tests for error page that permits access to all with a custom servlet path.
*
@@ -48,7 +50,7 @@ class CustomServletPathUnauthenticatedErrorPageTests extends AbstractUnauthentic
requests.requestMatchers("/public/**").permitAll();
requests.anyRequest().authenticated();
});
http.httpBasic();
http.httpBasic(withDefaults());
return http.build();
}

6
spring-boot-tests/spring-boot-smoke-tests/spring-boot-smoke-test-web-secure/src/test/java/smoketest/web/secure/ErrorPageTests.java
View File

@@ -1,5 +1,5 @@
/*
* Copyright 2012-2022 the original author or authors.
* Copyright 2012-2023 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -22,6 +22,8 @@ import org.springframework.context.annotation.Bean;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.web.SecurityFilterChain;
import static org.springframework.security.config.Customizer.withDefaults;
/**
* Tests to ensure that the error page is accessible only to authorized users.
*
@@ -47,7 +49,7 @@ class ErrorPageTests extends AbstractErrorPageTests {
requests.requestMatchers("/public/**").permitAll();
requests.anyRequest().fullyAuthenticated();
});
http.httpBasic();
http.httpBasic(withDefaults());
http.formLogin((form) -> form.loginPage("/login").permitAll());
return http.build();
}

4
spring-boot-tests/spring-boot-smoke-tests/spring-boot-smoke-test-web-secure/src/test/java/smoketest/web/secure/NoSessionErrorPageTests.java
View File

@@ -23,6 +23,8 @@ import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.http.SessionCreationPolicy;
import org.springframework.security.web.SecurityFilterChain;
import static org.springframework.security.config.Customizer.withDefaults;
/**
* Tests for error page when a stateless session creation policy is used.
*
@@ -49,7 +51,7 @@ class NoSessionErrorPageTests extends AbstractErrorPageTests {
requests.requestMatchers("/public/**").permitAll();
requests.anyRequest().authenticated();
});
http.httpBasic();
http.httpBasic(withDefaults());
return http.build();
}

7
spring-boot-tests/spring-boot-smoke-tests/spring-boot-smoke-test-web-secure/src/test/java/smoketest/web/secure/SampleWebSecureApplicationTests.java
View File

@@ -1,5 +1,5 @@
/*
* Copyright 2012-2022 the original author or authors.
* Copyright 2012-2023 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -39,6 +39,7 @@ import org.springframework.util.LinkedMultiValueMap;
import org.springframework.util.MultiValueMap;
import static org.assertj.core.api.Assertions.assertThat;
import static org.springframework.security.config.Customizer.withDefaults;
/**
* Basic integration tests for demo application.
@@ -95,13 +96,13 @@ class SampleWebSecureApplicationTests {
@Bean
SecurityFilterChain configure(HttpSecurity http) throws Exception {
http.csrf().disable();
http.csrf((csrf) -> csrf.disable());
http.authorizeHttpRequests((requests) -> {
requests.requestMatchers("/public/**").permitAll();
requests.dispatcherTypeMatchers(DispatcherType.FORWARD).permitAll();
requests.anyRequest().fullyAuthenticated();
});
http.httpBasic();
http.httpBasic(withDefaults());
http.formLogin((form) -> form.loginPage("/login").permitAll());
return http.build();
}

6
spring-boot-tests/spring-boot-smoke-tests/spring-boot-smoke-test-web-secure/src/test/java/smoketest/web/secure/UnauthenticatedErrorPageTests.java
View File

@@ -1,5 +1,5 @@
/*
* Copyright 2012-2022 the original author or authors.
* Copyright 2012-2023 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -22,6 +22,8 @@ import org.springframework.context.annotation.Bean;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.web.SecurityFilterChain;
import static org.springframework.security.config.Customizer.withDefaults;
/**
* Tests for error page that permits access to all.
*
@@ -48,7 +50,7 @@ class UnauthenticatedErrorPageTests extends AbstractUnauthenticatedErrorPageTest
requests.requestMatchers("/public/**").permitAll();
requests.anyRequest().authenticated();
});
http.httpBasic();
http.httpBasic(withDefaults());
return http.build();
}