From f4cf722c27aa50ac488d8000ca69fd89ec0c0382 Mon Sep 17 00:00:00 2001 From: Madhura Bhave Date: Wed, 9 Nov 2022 15:26:31 -0800 Subject: [PATCH] Align default security filter dispatcher types with Spring Security Fixes gh-33090 --- .../boot/autoconfigure/security/SecurityProperties.java | 4 ++-- .../security/servlet/SecurityAutoConfigurationTests.java | 3 ++- .../security/method/SampleMethodSecurityApplication.java | 7 ++++++- .../secure/custom/SampleWebSecureCustomApplication.java | 7 ++++++- .../web/secure/jdbc/SampleWebSecureJdbcApplication.java | 7 ++++++- .../web/secure/SampleWebSecureApplicationTests.java | 2 ++ 6 files changed, 24 insertions(+), 6 deletions(-) diff --git a/spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/security/SecurityProperties.java b/spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/security/SecurityProperties.java index 7142e43010..4ad92e79fb 100644 --- a/spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/security/SecurityProperties.java +++ b/spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/security/SecurityProperties.java @@ -83,8 +83,8 @@ public class SecurityProperties { /** * Security filter chain dispatcher types. */ - private Set dispatcherTypes = new HashSet<>( - Arrays.asList(DispatcherType.ASYNC, DispatcherType.ERROR, DispatcherType.REQUEST)); + private Set dispatcherTypes = new HashSet<>(Arrays.asList(DispatcherType.ASYNC, + DispatcherType.ERROR, DispatcherType.REQUEST, DispatcherType.FORWARD, DispatcherType.INCLUDE)); public int getOrder() { return this.order; diff --git a/spring-boot-project/spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/security/servlet/SecurityAutoConfigurationTests.java b/spring-boot-project/spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/security/servlet/SecurityAutoConfigurationTests.java index 1c5b4b1d6b..264d8d33c4 100644 --- a/spring-boot-project/spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/security/servlet/SecurityAutoConfigurationTests.java +++ b/spring-boot-project/spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/security/servlet/SecurityAutoConfigurationTests.java @@ -161,7 +161,8 @@ class SecurityAutoConfigurationTests { DelegatingFilterProxyRegistrationBean.class); assertThat(bean) .extracting("dispatcherTypes", InstanceOfAssertFactories.iterable(DispatcherType.class)) - .containsOnly(DispatcherType.ASYNC, DispatcherType.ERROR, DispatcherType.REQUEST); + .containsOnly(DispatcherType.ASYNC, DispatcherType.ERROR, DispatcherType.REQUEST, + DispatcherType.INCLUDE, DispatcherType.FORWARD); }); } diff --git a/spring-boot-tests/spring-boot-smoke-tests/spring-boot-smoke-test-web-method-security/src/main/java/smoketest/security/method/SampleMethodSecurityApplication.java b/spring-boot-tests/spring-boot-smoke-tests/spring-boot-smoke-test-web-method-security/src/main/java/smoketest/security/method/SampleMethodSecurityApplication.java index 0f15ca638e..e4ae797af2 100644 --- a/spring-boot-tests/spring-boot-smoke-tests/spring-boot-smoke-test-web-method-security/src/main/java/smoketest/security/method/SampleMethodSecurityApplication.java +++ b/spring-boot-tests/spring-boot-smoke-tests/spring-boot-smoke-test-web-method-security/src/main/java/smoketest/security/method/SampleMethodSecurityApplication.java @@ -16,6 +16,8 @@ package smoketest.security.method; +import jakarta.servlet.DispatcherType; + import org.springframework.boot.actuate.autoconfigure.security.servlet.EndpointRequest; import org.springframework.boot.autoconfigure.SpringBootApplication; import org.springframework.boot.builder.SpringApplicationBuilder; @@ -71,7 +73,10 @@ public class SampleMethodSecurityApplication implements WebMvcConfigurer { @Bean SecurityFilterChain configure(HttpSecurity http) throws Exception { http.csrf().disable(); - http.authorizeHttpRequests((requests) -> requests.anyRequest().fullyAuthenticated()); + http.authorizeHttpRequests((requests) -> { + requests.dispatcherTypeMatchers(DispatcherType.FORWARD).permitAll(); + requests.anyRequest().fullyAuthenticated(); + }); http.httpBasic(); http.formLogin((form) -> form.loginPage("/login").permitAll()); http.exceptionHandling((exceptions) -> exceptions.accessDeniedPage("/access")); diff --git a/spring-boot-tests/spring-boot-smoke-tests/spring-boot-smoke-test-web-secure-custom/src/main/java/smoketest/web/secure/custom/SampleWebSecureCustomApplication.java b/spring-boot-tests/spring-boot-smoke-tests/spring-boot-smoke-test-web-secure-custom/src/main/java/smoketest/web/secure/custom/SampleWebSecureCustomApplication.java index 799ae4efba..271c7e55ba 100644 --- a/spring-boot-tests/spring-boot-smoke-tests/spring-boot-smoke-test-web-secure-custom/src/main/java/smoketest/web/secure/custom/SampleWebSecureCustomApplication.java +++ b/spring-boot-tests/spring-boot-smoke-tests/spring-boot-smoke-test-web-secure-custom/src/main/java/smoketest/web/secure/custom/SampleWebSecureCustomApplication.java @@ -16,6 +16,8 @@ package smoketest.web.secure.custom; +import jakarta.servlet.DispatcherType; + import org.springframework.boot.autoconfigure.SpringBootApplication; import org.springframework.boot.builder.SpringApplicationBuilder; import org.springframework.context.annotation.Bean; @@ -44,7 +46,10 @@ public class SampleWebSecureCustomApplication implements WebMvcConfigurer { @Bean SecurityFilterChain configure(HttpSecurity http) throws Exception { http.csrf().disable(); - http.authorizeHttpRequests((requests) -> requests.anyRequest().fullyAuthenticated()); + http.authorizeHttpRequests((requests) -> { + requests.dispatcherTypeMatchers(DispatcherType.FORWARD).permitAll(); + requests.anyRequest().fullyAuthenticated(); + }); http.formLogin((form) -> form.loginPage("/login").permitAll()); return http.build(); } diff --git a/spring-boot-tests/spring-boot-smoke-tests/spring-boot-smoke-test-web-secure-jdbc/src/main/java/smoketest/web/secure/jdbc/SampleWebSecureJdbcApplication.java b/spring-boot-tests/spring-boot-smoke-tests/spring-boot-smoke-test-web-secure-jdbc/src/main/java/smoketest/web/secure/jdbc/SampleWebSecureJdbcApplication.java index aa978130a0..b632e3c186 100644 --- a/spring-boot-tests/spring-boot-smoke-tests/spring-boot-smoke-test-web-secure-jdbc/src/main/java/smoketest/web/secure/jdbc/SampleWebSecureJdbcApplication.java +++ b/spring-boot-tests/spring-boot-smoke-tests/spring-boot-smoke-test-web-secure-jdbc/src/main/java/smoketest/web/secure/jdbc/SampleWebSecureJdbcApplication.java @@ -18,6 +18,8 @@ package smoketest.web.secure.jdbc; import javax.sql.DataSource; +import jakarta.servlet.DispatcherType; + import org.springframework.boot.autoconfigure.SpringBootApplication; import org.springframework.boot.builder.SpringApplicationBuilder; import org.springframework.context.annotation.Bean; @@ -47,7 +49,10 @@ public class SampleWebSecureJdbcApplication implements WebMvcConfigurer { @Bean SecurityFilterChain configure(HttpSecurity http) throws Exception { http.csrf().disable(); - http.authorizeHttpRequests((requests) -> requests.anyRequest().fullyAuthenticated()); + http.authorizeHttpRequests((requests) -> { + requests.dispatcherTypeMatchers(DispatcherType.FORWARD).permitAll(); + requests.anyRequest().fullyAuthenticated(); + }); http.formLogin((form) -> form.loginPage("/login").permitAll()); return http.build(); } diff --git a/spring-boot-tests/spring-boot-smoke-tests/spring-boot-smoke-test-web-secure/src/test/java/smoketest/web/secure/SampleWebSecureApplicationTests.java b/spring-boot-tests/spring-boot-smoke-tests/spring-boot-smoke-test-web-secure/src/test/java/smoketest/web/secure/SampleWebSecureApplicationTests.java index bfbffdbc12..1b40843a5c 100644 --- a/spring-boot-tests/spring-boot-smoke-tests/spring-boot-smoke-test-web-secure/src/test/java/smoketest/web/secure/SampleWebSecureApplicationTests.java +++ b/spring-boot-tests/spring-boot-smoke-tests/spring-boot-smoke-test-web-secure/src/test/java/smoketest/web/secure/SampleWebSecureApplicationTests.java @@ -18,6 +18,7 @@ package smoketest.web.secure; import java.util.Collections; +import jakarta.servlet.DispatcherType; import org.junit.jupiter.api.Test; import org.springframework.beans.factory.annotation.Autowired; @@ -97,6 +98,7 @@ class SampleWebSecureApplicationTests { http.csrf().disable(); http.authorizeHttpRequests((requests) -> { requests.requestMatchers("/public/**").permitAll(); + requests.dispatcherTypeMatchers(DispatcherType.FORWARD).permitAll(); requests.anyRequest().fullyAuthenticated(); }); http.httpBasic();