Remove error page security filter
Spring Security now re-applies the authorization rules to the error page by default. Additionally, it configures RequestAttributeSecurityContextRepository as the default for stateless applications allowing those applications to have access to the original authentication during an error dispatch. Closes gh-31703
This commit is contained in:
@@ -65,15 +65,6 @@ abstract class AbstractErrorPageTests {
|
||||
assertThat(jsonResponse).isNull();
|
||||
}
|
||||
|
||||
@Test
|
||||
void testPublicNotFoundPage() {
|
||||
final ResponseEntity<JsonNode> response = this.testRestTemplate.exchange(this.pathPrefix + "/public/notfound",
|
||||
HttpMethod.GET, null, JsonNode.class);
|
||||
assertThat(response.getStatusCode()).isEqualTo(HttpStatus.NOT_FOUND);
|
||||
JsonNode jsonResponse = response.getBody();
|
||||
assertThat(jsonResponse.get("error").asText()).isEqualTo("Not Found");
|
||||
}
|
||||
|
||||
@Test
|
||||
void testPublicNotFoundPageWithCorrectCredentials() {
|
||||
final ResponseEntity<JsonNode> response = this.testRestTemplate.withBasicAuth("username", "password")
|
||||
|
||||
@@ -47,7 +47,6 @@ class CustomServletPathErrorPageTests extends AbstractErrorPageTests {
|
||||
http.authorizeHttpRequests((requests) -> {
|
||||
requests.antMatchers("/custom/servlet/path/public/**").permitAll();
|
||||
requests.anyRequest().fullyAuthenticated();
|
||||
requests.shouldFilterAllDispatcherTypes(false);
|
||||
});
|
||||
http.httpBasic();
|
||||
http.formLogin((form) -> form.loginPage("/custom/servlet/path/login").permitAll());
|
||||
|
||||
@@ -46,7 +46,6 @@ class ErrorPageTests extends AbstractErrorPageTests {
|
||||
http.authorizeHttpRequests((requests) -> {
|
||||
requests.antMatchers("/public/**").permitAll();
|
||||
requests.anyRequest().fullyAuthenticated();
|
||||
requests.shouldFilterAllDispatcherTypes(false);
|
||||
});
|
||||
http.httpBasic();
|
||||
http.formLogin((form) -> form.loginPage("/login").permitAll());
|
||||
|
||||
@@ -48,7 +48,6 @@ class NoSessionErrorPageTests extends AbstractErrorPageTests {
|
||||
.authorizeHttpRequests((requests) -> {
|
||||
requests.antMatchers("/public/**").permitAll();
|
||||
requests.anyRequest().authenticated();
|
||||
requests.shouldFilterAllDispatcherTypes(false);
|
||||
});
|
||||
http.httpBasic();
|
||||
return http.build();
|
||||
|
||||
Reference in New Issue
Block a user