diff --git a/spring-boot-project/spring-boot-actuator-autoconfigure/src/test/java/org/springframework/boot/actuate/autoconfigure/logging/LoggersEndpointAutoConfigurationTests.java b/spring-boot-project/spring-boot-actuator-autoconfigure/src/test/java/org/springframework/boot/actuate/autoconfigure/logging/LoggersEndpointAutoConfigurationTests.java index 5a6f469b63..940a8ed83c 100644 --- a/spring-boot-project/spring-boot-actuator-autoconfigure/src/test/java/org/springframework/boot/actuate/autoconfigure/logging/LoggersEndpointAutoConfigurationTests.java +++ b/spring-boot-project/spring-boot-actuator-autoconfigure/src/test/java/org/springframework/boot/actuate/autoconfigure/logging/LoggersEndpointAutoConfigurationTests.java @@ -54,7 +54,7 @@ public class LoggersEndpointAutoConfigurationTests { } @Test - public void runWithNoneLoggerEndpointShouldNotHaveEndpointBean() { + public void runWithNoneLoggingSystemShouldNotHaveEndpointBean() { this.contextRunner .withSystemProperties( "org.springframework.boot.logging.LoggingSystem=none") diff --git a/spring-boot-project/spring-boot-actuator/src/test/java/org/springframework/boot/actuate/endpoint/invoker/cache/CachingOperationInvokerAdvisorTests.java b/spring-boot-project/spring-boot-actuator/src/test/java/org/springframework/boot/actuate/endpoint/invoker/cache/CachingOperationInvokerAdvisorTests.java index 6811ecf3ea..31d641b484 100644 --- a/spring-boot-project/spring-boot-actuator/src/test/java/org/springframework/boot/actuate/endpoint/invoker/cache/CachingOperationInvokerAdvisorTests.java +++ b/spring-boot-project/spring-boot-actuator/src/test/java/org/springframework/boot/actuate/endpoint/invoker/cache/CachingOperationInvokerAdvisorTests.java @@ -69,7 +69,7 @@ public class CachingOperationInvokerAdvisorTests { @Test public void applyWhenHasAtLeaseOneMandatoryParameterShouldNotAddAdvise() { - OperationParameters parameters = getParameters("getWithParameter", String.class, + OperationParameters parameters = getParameters("getWithParameters", String.class, String.class); OperationInvoker advised = this.advisor.apply("foo", OperationType.READ, parameters, this.invoker); @@ -104,7 +104,7 @@ public class CachingOperationInvokerAdvisorTests { } @Test - public void applyWithAllOptionalParameterShouldAddAdvise() { + public void applyWithAllOptionalParametersShouldAddAdvise() { OperationParameters parameters = getParameters("getWithAllOptionalParameters", String.class, String.class); given(this.timeToLive.apply(any())).willReturn(100L); @@ -138,7 +138,7 @@ public class CachingOperationInvokerAdvisorTests { return ""; } - public String getWithParameter(@Nullable String foo, String bar) { + public String getWithParameters(@Nullable String foo, String bar) { return ""; } diff --git a/spring-boot-project/spring-boot-actuator/src/test/java/org/springframework/boot/actuate/endpoint/invoker/cache/CachingOperationInvokerTests.java b/spring-boot-project/spring-boot-actuator/src/test/java/org/springframework/boot/actuate/endpoint/invoker/cache/CachingOperationInvokerTests.java index 905776a7d9..f1c60e8f6d 100644 --- a/spring-boot-project/spring-boot-actuator/src/test/java/org/springframework/boot/actuate/endpoint/invoker/cache/CachingOperationInvokerTests.java +++ b/spring-boot-project/spring-boot-actuator/src/test/java/org/springframework/boot/actuate/endpoint/invoker/cache/CachingOperationInvokerTests.java @@ -81,7 +81,7 @@ public class CachingOperationInvokerTests { } @Test - public void targetAlwaysInvokedWithArguments() { + public void targetAlwaysInvokedWithParameters() { OperationInvoker target = mock(OperationInvoker.class); Map parameters = new HashMap<>(); parameters.put("test", "value"); diff --git a/spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/security/servlet/UserDetailsServiceAutoConfiguration.java b/spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/security/servlet/UserDetailsServiceAutoConfiguration.java index 1470b435fc..92570aee64 100644 --- a/spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/security/servlet/UserDetailsServiceAutoConfiguration.java +++ b/spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/security/servlet/UserDetailsServiceAutoConfiguration.java @@ -23,6 +23,7 @@ import org.apache.commons.logging.Log; import org.apache.commons.logging.LogFactory; import org.springframework.beans.factory.ObjectProvider; +import org.springframework.boot.autoconfigure.EnableAutoConfiguration; import org.springframework.boot.autoconfigure.condition.ConditionalOnBean; import org.springframework.boot.autoconfigure.condition.ConditionalOnClass; import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean; @@ -39,10 +40,11 @@ import org.springframework.security.provisioning.InMemoryUserDetailsManager; import org.springframework.util.StringUtils; /** - * Configuration for a Spring Security in-memory {@link AuthenticationManager}. Adds an - * {@link InMemoryUserDetailsManager} with a default user and generated password. This can - * be disabled by providing a bean of type {@link AuthenticationManager}, - * {@link AuthenticationProvider} or {@link UserDetailsService}. + * {@link EnableAutoConfiguration Auto-configuration} for a Spring Security in-memory + * {@link AuthenticationManager}. Adds an {@link InMemoryUserDetailsManager} with a + * default user and generated password. This can be disabled by providing a bean of type + * {@link AuthenticationManager}, {@link AuthenticationProvider} or + * {@link UserDetailsService}. * * @author Dave Syer * @author Rob Winch @@ -67,7 +69,7 @@ public class UserDetailsServiceAutoConfiguration { @ConditionalOnMissingBean(type = "org.springframework.security.oauth2.client.registration.ClientRegistrationRepository") public InMemoryUserDetailsManager inMemoryUserDetailsManager( SecurityProperties properties, - ObjectProvider passwordEncoder) throws Exception { + ObjectProvider passwordEncoder) { SecurityProperties.User user = properties.getUser(); List roles = user.getRoles(); return new InMemoryUserDetailsManager(User.withUsername(user.getName()) diff --git a/spring-boot-project/spring-boot-docs/src/main/asciidoc/howto.adoc b/spring-boot-project/spring-boot-docs/src/main/asciidoc/howto.adoc index 23f533af94..6152c502bd 100644 --- a/spring-boot-project/spring-boot-docs/src/main/asciidoc/howto.adoc +++ b/spring-boot-project/spring-boot-docs/src/main/asciidoc/howto.adoc @@ -2335,8 +2335,8 @@ If you define a `@Configuration` with a `WebSecurityConfigurerAdapter` in your a it switches off the default webapp security settings in Spring Boot. -[[howto-change-the-authenticationmanager-and-add-user-accounts]] -=== Change the AuthenticationManager and Add User Accounts +[[howto-change-the-user-details-service-and-add-user-accounts]] +=== Change the UserDetailsService and Add User Accounts If you provide a `@Bean` of type `AuthenticationManager`, `AuthenticationProvider`, or `UserDetailsService`, the default `@Bean` for `InMemoryUserDetailsManager` is not created, so you have the full feature set of Spring Security available (such as diff --git a/spring-boot-project/spring-boot-docs/src/main/asciidoc/production-ready-features.adoc b/spring-boot-project/spring-boot-docs/src/main/asciidoc/production-ready-features.adoc index e2a3fb69d4..8051b11921 100644 --- a/spring-boot-project/spring-boot-docs/src/main/asciidoc/production-ready-features.adoc +++ b/spring-boot-project/spring-boot-docs/src/main/asciidoc/production-ready-features.adoc @@ -643,8 +643,8 @@ NOTE: Range requests are not supported when using Jersey. An operation on a web endpoint or a web-specific endpoint extension can receive the current `java.security.Principal` or `org.springframework.boot.actuate.endpoint.SecurityContext` as a method parameter. The -former is typically used in conjuction with `@Nullable` to provide different behaviour for -authenticated and unauthenticated users. The latter is typically used to perform +former is typically used in conjunction with `@Nullable` to provide different behaviour +for authenticated and unauthenticated users. The latter is typically used to perform authorization checks using its `isUserInRole(String)` method. @@ -664,7 +664,7 @@ possible. ==== Controller endpoints `@ControllerEndpoint` and `@RestControllerEndpoint` can be used to implement an endpoint that is only exposed by Spring MVC or Spring WebFlux. Methods are mapped using the -standard annotations Spring MVC and Spring WevFlux annotations such as `@RequestMapping` +standard annotations Spring MVC and Spring WebFlux annotations such as `@RequestMapping` and `@GetMapping`, with the endpoint's ID being used as a prefix for the path. Controller endpoints provide deeper integration with Spring's web frameworks but at the expense of portability. The `@Endpoint` and `@WebEndpoint` annotations should be preferred whenever diff --git a/spring-boot-project/spring-boot-docs/src/main/asciidoc/spring-boot-features.adoc b/spring-boot-project/spring-boot-docs/src/main/asciidoc/spring-boot-features.adoc index bd26ff15fe..8a0bc3a64f 100644 --- a/spring-boot-project/spring-boot-docs/src/main/asciidoc/spring-boot-features.adoc +++ b/spring-boot-project/spring-boot-docs/src/main/asciidoc/spring-boot-features.adoc @@ -2034,8 +2034,8 @@ for Webjars. To use version agnostic URLs for Webjars, add the `webjars-locator-core` dependency. Then declare your Webjar. Using jQuery as an example, adding -`"/webjars/jquery/dist/jquery.min.js"` results in -`"/webjars/jquery/x.y.z/dist/jquery.min.js"`. where `x.y.z` is the Webjar version. +`"/webjars/jquery/jquery.min.js"` results in +`"/webjars/jquery/x.y.z/jquery.min.js"`. where `x.y.z` is the Webjar version. NOTE: If you use JBoss, you need to declare the `webjars-locator-jboss-vfs` dependency instead of the `webjars-locator-core`. Otherwise, all Webjars resolve as a @@ -3012,13 +3012,13 @@ that you can see how to set things up. [[boot-features-security]] == Security If {spring-security}[Spring Security] is on the classpath, then web applications are -secure by default. Spring Boot relies on Spring Security’s content-negotiation strategy to -determine whether to use `httpBasic` or `formLogin`. To add method-level security to a web -application, you can also add `@EnableGlobalMethodSecurity` with your desired settings. -Additional information can be found in the {spring-security-reference}#jc-method[Spring -Security Reference Guide]. +secured by default. Spring Boot relies on Spring Security’s content-negotiation strategy +to determine whether to use `httpBasic` or `formLogin`. To add method-level security to a +web application, you can also add `@EnableGlobalMethodSecurity` with your desired +settings. Additional information can be found in the +{spring-security-reference}#jc-method[Spring Security Reference Guide]. -The default `AuthenticationManager` has a single user. The user name is `user`, and the +The default `UserDetailsService` has a single user. The user name is `user`, and the password is random and is printed at INFO level when the application starts, as shown in the following example: @@ -3049,14 +3049,15 @@ You can provide a different `AuthenticationEventPublisher` by adding a bean for [[boot-features-security-mvc]] === MVC Security -The default security configuration is implemented in `SecurityAutoConfiguration` and in -the classes imported from there (`SpringBootWebSecurityConfiguration` for web security -and `AuthenticationManagerConfiguration` for authentication configuration, which is also -relevant in non-web applications). To switch off the default web application security +The default security configuration is implemented in `SecurityAutoConfiguration` and +`UserDetailsServiceAutoConfiguration`. `SecurityAutoConfiguration` imports +`SpringBootWebSecurityConfiguration` for web security and +`UserDetailsServiceAutoConfiguration` configures authentication, which is also +relevant in non-web applications. To switch off the default web application security configuration completely, you can add a bean of type `WebSecurityConfigurerAdapter` (doing -so does not disable the authentication manager configuration or Actuator's security). +so does not disable the `UserDetailsService` configuration or Actuator's security). -To also switch off the authentication manager configuration, you can add a bean of type +To also switch off the `UserDetailsService` configuration, you can add a bean of type `UserDetailsService`, `AuthenticationProvider`, or `AuthenticationManager`. There are several secure applications in the {github-code}/spring-boot-samples/[Spring Boot samples] to get you started with common use cases. @@ -3074,14 +3075,14 @@ commonly used locations. === WebFlux Security Similar to Spring MVC applications, you can secure your WebFlux applications by adding the `spring-boot-starter-security` dependency. The default security configuration is -implemented in `ReactiveSecurityAutoConfiguration` and in the classes imported from there -(`WebFluxSecurityConfiguration` for web security and -`ReactiveAuthenticationManagerConfiguration` for authentication configuration, which is -also relevant in non-web applications). To switch off the default web application security +implemented in `ReactiveSecurityAutoConfiguration` and +`UserDetailsServiceAutoConfiguration`. `ReactiveSecurityAutoConfiguration` imports +`WebFluxSecurityConfiguration` for web security and `UserDetailsServiceAutoConfiguration` +configures authentication, which is also relevant in non-web applications. To switch off the default web application security configuration completely, you can add a bean of type `WebFilterChainProxy` (doing so does -not disable the authentication manager configuration or Actuator's security). +not disable the `UserDetailsService` configuration or Actuator's security). -To also switch off the authentication manager configuration, you can add a bean of type +To also switch off the `UserDetailsService` configuration, you can add a bean of type `ReactiveUserDetailsService` or `ReactiveAuthenticationManager`. Access rules can be configured by adding a custom `SecurityWebFilterChain`. Spring diff --git a/spring-boot-project/spring-boot-tools/spring-boot-gradle-plugin/src/main/asciidoc/integrating-with-actuator.adoc b/spring-boot-project/spring-boot-tools/spring-boot-gradle-plugin/src/main/asciidoc/integrating-with-actuator.adoc index 8577974b88..434b2dbaf9 100644 --- a/spring-boot-project/spring-boot-tools/spring-boot-gradle-plugin/src/main/asciidoc/integrating-with-actuator.adoc +++ b/spring-boot-project/spring-boot-tools/spring-boot-gradle-plugin/src/main/asciidoc/integrating-with-actuator.adoc @@ -52,7 +52,7 @@ include::../gradle/integrating-with-actuator/build-info-custom-values.gradle[tag The default value for `build.time` is the instant at which the project is being built. A side-effect of this is that the task will never be up-to-date and, therefore, builds will -take slighly longer as more tasks will have to be executed. Another side-effect is that +take slightly longer as more tasks will have to be executed. Another side-effect is that the task's output will always change and, therefore, the build will not be truly repeatable. If you value build performance or repeatability more highly than the accuracy of the `build.time` property, set `time` to `null` or a fixed value. diff --git a/spring-boot-project/spring-boot/src/main/java/org/springframework/boot/util/LambdaSafe.java b/spring-boot-project/spring-boot/src/main/java/org/springframework/boot/util/LambdaSafe.java index 13b878e1ad..390cbd5c38 100644 --- a/spring-boot-project/spring-boot/src/main/java/org/springframework/boot/util/LambdaSafe.java +++ b/spring-boot-project/spring-boot/src/main/java/org/springframework/boot/util/LambdaSafe.java @@ -63,7 +63,7 @@ public final class LambdaSafe { * interface}) * @param callbackInstance the callback instance (may be a lambda) * @param argument the primary argument passed to the callback - * @param additionalArguments any additional argument passed to the callback + * @param additionalArguments any additional arguments passed to the callback * @param the callback type * @param the primary argument type * @return a {@link Callback} instance that can be invoked. @@ -77,13 +77,13 @@ public final class LambdaSafe { } /** - * Start a call to a single callback instance, dealing with common generic type + * Start a call to callback instances, dealing with common generic type * concerns and exceptions. * @param callbackType the callback type (a {@link FunctionalInterface functional * interface}) * @param callbackInstances the callback instances (elements may be lambdas) * @param argument the primary argument passed to the callbacks - * @param additionalArguments any additional argument passed to the callbacks + * @param additionalArguments any additional arguments passed to the callbacks * @param the callback type * @param the primary argument type * @return a {@link Callbacks} instance that can be invoked. @@ -141,7 +141,7 @@ public final class LambdaSafe { } /** - * Use a specific filter to determine when a callback should apply. If not + * Use a specific filter to determine when a callback should apply. If no * explicit filter is set filter will be attempted using the generic type on the * callback type. * @param filter the filter to use @@ -230,7 +230,7 @@ public final class LambdaSafe { public static final class Callback extends LambdaSafeCallback> { - private C callbackInstance; + private final C callbackInstance; private Callback(Class callbackType, C callbackInstance, A argument, Object[] additionalArguments) { @@ -272,7 +272,7 @@ public final class LambdaSafe { public static final class Callbacks extends LambdaSafeCallback> { - private Collection callbackInstances; + private final Collection callbackInstances; private Callbacks(Class callbackType, Collection callbackInstances, A argument, @@ -299,7 +299,7 @@ public final class LambdaSafe { * Invoke the callback instances where the callback method returns a result. * @param invoker the invoker used to invoke the callback * @param the result type - * @return the results of the invocation (may be an empty stream if not callbacks + * @return the results of the invocation (may be an empty stream if no callbacks * could be called) */ public Stream invokeAnd(Function invoker) { diff --git a/spring-boot-project/spring-boot/src/test/java/org/springframework/boot/security/servlet/ApplicationContextRequestMatcherTests.java b/spring-boot-project/spring-boot/src/test/java/org/springframework/boot/security/servlet/ApplicationContextRequestMatcherTests.java index 58e6b9a1ba..0660594eba 100644 --- a/spring-boot-project/spring-boot/src/test/java/org/springframework/boot/security/servlet/ApplicationContextRequestMatcherTests.java +++ b/spring-boot-project/spring-boot/src/test/java/org/springframework/boot/security/servlet/ApplicationContextRequestMatcherTests.java @@ -67,7 +67,7 @@ public class ApplicationContextRequestMatcherTests { } @Test - public void matchesWhenContextClassIsBeanThatDoesntExistShouldSupplyException() { + public void matchesWhenContextClassIsBeanThatDoesNotExistShouldSupplyException() { StaticWebApplicationContext context = createWebApplicationContext(); Supplier supplier = new TestApplicationContextRequestMatcher<>( ExistingBean.class).callMatchesAndReturnProvidedContext(context);