Spring/spring-security
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Remove Deprecation Markers

Browse Source 
Since Spring Security still needs these methods and classes, we
should wait on deprecating them if we can.

Instead, this commit changes the original classes to have a
boolean property that is currently false, but will switch to true
in 6.0.

At that time, BearerTokenAuthenticationFilter can change to use
the handler.

Closes gh-11932
This commit is contained in:
Josh Cummings
2022-10-13 12:07:07 -06:00
parent 200b7fecd3
commit 099aaa33ff
9 changed files with 114 additions and 271 deletions
Download Patch File Download Diff File Expand all files Collapse all files

25
web/src/main/java/org/springframework/security/web/authentication/AuthenticationEntryPointFailureHandler.java
View File

@@ -22,6 +22,7 @@ import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import org.springframework.security.authentication.AuthenticationServiceException;
import org.springframework.security.core.AuthenticationException;
import org.springframework.security.web.AuthenticationEntryPoint;
import org.springframework.util.Assert;
@@ -31,11 +32,11 @@ import org.springframework.util.Assert;
*
* @author Sergey Bespalov
* @since 5.2.0
* @deprecated Use {@link AuthenticationEntryPointFailureHandlerAdapter} instead
*/
@Deprecated
public class AuthenticationEntryPointFailureHandler implements AuthenticationFailureHandler {
private boolean rethrowAuthenticationServiceException = false;
private final AuthenticationEntryPoint authenticationEntryPoint;
public AuthenticationEntryPointFailureHandler(AuthenticationEntryPoint authenticationEntryPoint) {
@@ -46,7 +47,25 @@ public class AuthenticationEntryPointFailureHandler implements AuthenticationFai
@Override
public void onAuthenticationFailure(HttpServletRequest request, HttpServletResponse response,
AuthenticationException exception) throws IOException, ServletException {
this.authenticationEntryPoint.commence(request, response, exception);
if (!this.rethrowAuthenticationServiceException) {
this.authenticationEntryPoint.commence(request, response, exception);
return;
}
if (!AuthenticationServiceException.class.isAssignableFrom(exception.getClass())) {
this.authenticationEntryPoint.commence(request, response, exception);
return;
}
throw exception;
}
/**
* Set whether to rethrow {@link AuthenticationServiceException}s (defaults to false)
* @param rethrowAuthenticationServiceException whether to rethrow
* {@link AuthenticationServiceException}s
* @since 5.8
*/
public void setRethrowAuthenticationServiceException(boolean rethrowAuthenticationServiceException) {
this.rethrowAuthenticationServiceException = rethrowAuthenticationServiceException;
}
}

56
web/src/main/java/org/springframework/security/web/authentication/AuthenticationEntryPointFailureHandlerAdapter.java
View File

@@ -1,56 +0,0 @@
/*
* Copyright 2002-2022 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* https://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.springframework.security.web.authentication;
import java.io.IOException;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import org.springframework.security.authentication.AuthenticationServiceException;
import org.springframework.security.core.AuthenticationException;
import org.springframework.security.web.AuthenticationEntryPoint;
import org.springframework.util.Assert;
/**
* Adapts a {@link AuthenticationEntryPoint} into a {@link AuthenticationFailureHandler}.
* When the failure is an {@link AuthenticationServiceException}, it re-throws, to produce
* an HTTP 500 error.
*
* @author Daniel Garnier-Moiroux
* @since 5.8
*/
public final class AuthenticationEntryPointFailureHandlerAdapter implements AuthenticationFailureHandler {
private final AuthenticationEntryPoint authenticationEntryPoint;
public AuthenticationEntryPointFailureHandlerAdapter(AuthenticationEntryPoint authenticationEntryPoint) {
Assert.notNull(authenticationEntryPoint, "authenticationEntryPoint cannot be null");
this.authenticationEntryPoint = authenticationEntryPoint;
}
@Override
public void onAuthenticationFailure(HttpServletRequest request, HttpServletResponse response,
AuthenticationException failure) throws IOException, ServletException {
if (AuthenticationServiceException.class.isAssignableFrom(failure.getClass())) {
throw failure;
}
this.authenticationEntryPoint.commence(request, response, failure);
}
}

23
web/src/main/java/org/springframework/security/web/server/authentication/ServerAuthenticationEntryPointFailureHandler.java
View File

@@ -18,6 +18,7 @@ package org.springframework.security.web.server.authentication;
import reactor.core.publisher.Mono;
import org.springframework.security.authentication.AuthenticationServiceException;
import org.springframework.security.core.AuthenticationException;
import org.springframework.security.web.server.ServerAuthenticationEntryPoint;
import org.springframework.security.web.server.WebFilterExchange;
@@ -29,13 +30,13 @@ import org.springframework.util.Assert;
*
* @author Rob Winch
* @since 5.0
* @deprecated use {@link ServerAuthenticationEntryPointFailureHandlerAdapter} instead.
*/
@Deprecated
public class ServerAuthenticationEntryPointFailureHandler implements ServerAuthenticationFailureHandler {
private final ServerAuthenticationEntryPoint authenticationEntryPoint;
private boolean rethrowAuthenticationServiceException = false;
public ServerAuthenticationEntryPointFailureHandler(ServerAuthenticationEntryPoint authenticationEntryPoint) {
Assert.notNull(authenticationEntryPoint, "authenticationEntryPoint cannot be null");
this.authenticationEntryPoint = authenticationEntryPoint;
@@ -43,7 +44,23 @@ public class ServerAuthenticationEntryPointFailureHandler implements ServerAuthe
@Override
public Mono<Void> onAuthenticationFailure(WebFilterExchange webFilterExchange, AuthenticationException exception) {
return this.authenticationEntryPoint.commence(webFilterExchange.getExchange(), exception);
if (!this.rethrowAuthenticationServiceException) {
return this.authenticationEntryPoint.commence(webFilterExchange.getExchange(), exception);
}
if (!AuthenticationServiceException.class.isAssignableFrom(exception.getClass())) {
return this.authenticationEntryPoint.commence(webFilterExchange.getExchange(), exception);
}
return Mono.error(exception);
}
/**
* Set whether to rethrow {@link AuthenticationServiceException}s (defaults to false)
* @param rethrowAuthenticationServiceException whether to rethrow
* {@link AuthenticationServiceException}s
* @since 5.8
*/
public void setRethrowAuthenticationServiceException(boolean rethrowAuthenticationServiceException) {
this.rethrowAuthenticationServiceException = rethrowAuthenticationServiceException;
}
}

53
web/src/main/java/org/springframework/security/web/server/authentication/ServerAuthenticationEntryPointFailureHandlerAdapter.java
View File

@@ -1,53 +0,0 @@
/*
* Copyright 2002-2022 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* https://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.springframework.security.web.server.authentication;
import reactor.core.publisher.Mono;
import org.springframework.security.authentication.AuthenticationServiceException;
import org.springframework.security.core.AuthenticationException;
import org.springframework.security.web.server.ServerAuthenticationEntryPoint;
import org.springframework.security.web.server.WebFilterExchange;
import org.springframework.util.Assert;
/**
* Adapts a {@link ServerAuthenticationEntryPoint} into a
* {@link ServerAuthenticationFailureHandler}. When the failure is an
* {@link AuthenticationServiceException}, it re-throws, to produce an HTTP 500 error.
*
* @author Daniel Garnier-Moiroux
* @since 5.8
*/
public class ServerAuthenticationEntryPointFailureHandlerAdapter implements ServerAuthenticationFailureHandler {
private final ServerAuthenticationEntryPoint authenticationEntryPoint;
public ServerAuthenticationEntryPointFailureHandlerAdapter(
ServerAuthenticationEntryPoint authenticationEntryPoint) {
Assert.notNull(authenticationEntryPoint, "authenticationEntryPoint cannot be null");
this.authenticationEntryPoint = authenticationEntryPoint;
}
@Override
public Mono<Void> onAuthenticationFailure(WebFilterExchange webFilterExchange, AuthenticationException exception) {
if (AuthenticationServiceException.class.isAssignableFrom(exception.getClass())) {
return Mono.error(exception);
}
return this.authenticationEntryPoint.commence(webFilterExchange.getExchange(), exception);
}
}