Remove error page security filter

Spring Security now re-applies the authorization rules
to the error page by default. Additionally, it configures
RequestAttributeSecurityContextRepository as the default for
stateless applications allowing those applications to have access
to the original authentication during an error dispatch.

Closes gh-31703
This commit is contained in:
Madhura Bhave
2022-10-18 21:17:21 -07:00
parent 8621be6bba
commit cedd553b83
10 changed files with 1 additions and 376 deletions

View File

@@ -65,15 +65,6 @@ abstract class AbstractErrorPageTests {
assertThat(jsonResponse).isNull();
}
@Test
void testPublicNotFoundPage() {
final ResponseEntity<JsonNode> response = this.testRestTemplate.exchange(this.pathPrefix + "/public/notfound",
HttpMethod.GET, null, JsonNode.class);
assertThat(response.getStatusCode()).isEqualTo(HttpStatus.NOT_FOUND);
JsonNode jsonResponse = response.getBody();
assertThat(jsonResponse.get("error").asText()).isEqualTo("Not Found");
}
@Test
void testPublicNotFoundPageWithCorrectCredentials() {
final ResponseEntity<JsonNode> response = this.testRestTemplate.withBasicAuth("username", "password")

View File

@@ -47,7 +47,6 @@ class CustomServletPathErrorPageTests extends AbstractErrorPageTests {
http.authorizeHttpRequests((requests) -> {
requests.antMatchers("/custom/servlet/path/public/**").permitAll();
requests.anyRequest().fullyAuthenticated();
requests.shouldFilterAllDispatcherTypes(false);
});
http.httpBasic();
http.formLogin((form) -> form.loginPage("/custom/servlet/path/login").permitAll());

View File

@@ -46,7 +46,6 @@ class ErrorPageTests extends AbstractErrorPageTests {
http.authorizeHttpRequests((requests) -> {
requests.antMatchers("/public/**").permitAll();
requests.anyRequest().fullyAuthenticated();
requests.shouldFilterAllDispatcherTypes(false);
});
http.httpBasic();
http.formLogin((form) -> form.loginPage("/login").permitAll());

View File

@@ -48,7 +48,6 @@ class NoSessionErrorPageTests extends AbstractErrorPageTests {
.authorizeHttpRequests((requests) -> {
requests.antMatchers("/public/**").permitAll();
requests.anyRequest().authenticated();
requests.shouldFilterAllDispatcherTypes(false);
});
http.httpBasic();
return http.build();