Update `ErrorPageSecurityFilter` to defensively check that the
`DispatcherType` is `ERROR`. Although this check isn't necessary
for regular applications, it is needed if MockMvc is being used.
Fixes gh-28759
This commit aligns `SpringBootTest`s to also use `ApplicationEnvironment`
instead of `StandardEnvironment`. This prevents the side-effect of active
profiles from `@ActiveProfiles` from being added to the environment when
doGetActiveProfiles is called. In this case, calling `addActiveProfiles()`
in the environment post processor would result in `@ActiveProfiles` being
added to the environment first, resulting in the wrong order.
The additional call to `setActiveProfiles()` is also not necessary when using
ApplicationEnvironment because that call was put in place to prevent the side-effect
which `ApplicationEnvironment` does not have.
Fixes gh-28530
The charset "default" is an alias for US-ASCII, not the JVM's default
charset. This commit updates the built-in Logback configuration to
use Charset.defaultCharset().name() in place of "default" in the
Java-based configuration. In the XML-based configuration where
Charset.defaultCharset().name() cannot be called, we emulate its
behaviour [1] by using the file.encoding system property, falling back
to UTF-8 when it's not set.
Fixes gh-27230
[1] 19be6113dd/jdk/src/share/classes/java/nio/charset/Charset.java (L604-L617)
Update Tomcat, Jetty and Undertow `ServletWebServerFactory`
implementations so that they can write SameSite cookie attributes.
The session cookie will be customized whenever the
`server.servlet.session.cookie.same-site` property is set.
Other cookies can be customized with the new `CookieSameSiteSupplier`
interface which can be registered using `@Bean` methods.
Closes gh-20971
Co-authored-by Andy Wilkinson <wilkinsona@vmware.com>
Relocate the recently introduced `spring.webflux.session` properties
to `server.reactive.session` and create a unified `Cookie` properties
class.
Reactive session properties now mirror the existing
`server.servlet.session` properties and better reflect the fact that
they are related to the server and not just for WebFlux.
See gh-26714
