Spring/spring-security
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Add CSRF Exception

Browse Source 
Issue gh-13653
This commit is contained in:
Josh Cummings
2023-08-16 16:32:05 -06:00
parent 87ae2d41b3
commit 3ba5cc0e40
2 changed files with 31 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
saml2/saml2-service-provider/src/main/java/org/springframework/security/saml2/provider/service/web/authentication/Saml2WebSsoAuthenticationFilter.java
View File

@@ -35,6 +35,9 @@ import org.springframework.security.saml2.provider.service.web.Saml2Authenticati
import org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter;
import org.springframework.security.web.authentication.AuthenticationConverter;
import org.springframework.security.web.authentication.session.ChangeSessionIdAuthenticationStrategy;
import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
import org.springframework.security.web.util.matcher.OrRequestMatcher;
import org.springframework.security.web.util.matcher.RequestMatcher;
import org.springframework.util.Assert;
/**
@@ -44,6 +47,10 @@ public class Saml2WebSsoAuthenticationFilter extends AbstractAuthenticationProce
public static final String DEFAULT_FILTER_PROCESSES_URI = "/login/saml2/sso/{registrationId}";
private static final RequestMatcher DEFAULT_REQUEST_MATCHER = new OrRequestMatcher(
new AntPathRequestMatcher(DEFAULT_FILTER_PROCESSES_URI),
new AntPathRequestMatcher("/login/saml2/sso"));
private final AuthenticationConverter authenticationConverter;
private Saml2AuthenticationRequestRepository<AbstractSaml2AuthenticationRequest> authenticationRequestRepository = new HttpSessionSaml2AuthenticationRequestRepository();
@@ -75,6 +82,21 @@ public class Saml2WebSsoAuthenticationFilter extends AbstractAuthenticationProce
"filterProcessesUrl must contain a {registrationId} match variable");
}
/**
* Creates a {@link Saml2WebSsoAuthenticationFilter} that is configured to use the
* {@link #DEFAULT_FILTER_PROCESSES_URI} processing URL
* @param authenticationConverter the strategy for converting an
* {@link HttpServletRequest} into an {@link Authentication}
* @since 6.2
*/
public Saml2WebSsoAuthenticationFilter(AuthenticationConverter authenticationConverter) {
super(DEFAULT_REQUEST_MATCHER);
Assert.notNull(authenticationConverter, "authenticationConverter cannot be null");
this.authenticationConverter = authenticationConverter;
setAllowSessionCreation(true);
setSessionAuthenticationStrategy(new ChangeSessionIdAuthenticationStrategy());
}
/**
* Creates a {@link Saml2WebSsoAuthenticationFilter} given the provided parameters
* @param authenticationConverter the strategy for converting an