Spring/spring-security
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
6,109 Commits 26 Branches 0 Tags
4392d4790887ca8efcbb52bb02f90545736c2c19
Commit Graph

128 Commits

Author SHA1 Message Date
Spring Buildmaster
7a7ce11ebb Release version 4.2.1.RELEASE 2016-12-21 17:23:28 +00:00
Johnny Lim
f94399cff9 Polish 2016-11-17 09:49:41 -06:00
Eddú Meléndez
23294c4c57 Add Referrer-Policy header support 
Fixes gh-4110
 2016-11-08 13:21:35 -06:00
Rob Winch
af9139b613 Add intercept-url@request-matcher-ref 
Fixes gh-4097
 2016-10-18 22:27:31 -05:00
Rob Winch
f019ea89e7 Remove unused lowercase-comparisons from XSD 
Fixes gh-3932
 2016-10-18 22:27:28 -05:00
Rob Winch
0d700628dc Add spring-security-4.2.xsd to spring.schemas 
Fixes gh-4098
 2016-10-18 22:27:22 -05:00
Rob Winch
6650429283 Polish SessionInformationExpiredStrategy 
* Fix passivity and add tests
* Introduce SessionInformationExpiredEvent as a value object
* Rename ExpiredSessionStrategy to SessionInformationExpiredStrategy
  to account for the need of SessionInformation
* Switch to Constructor Injection
* Move the changes to the xsd to 4.2 xsd instead of 4.1

Issue gh-3808
 2016-09-15 14:30:52 -05:00
Marten Deinum
b88418b94a Configuration of session management strategies 
This commit adds an ExpiredSessionStrategy for the ConcurrentSessionFilter
analogous to the InvalidSessionStrategy for the SessionManagementFilter. It also
adds a configuration option for both the InvalidSessionStrategy and
ExpiredSessionStrategy to the XML namespace and Java configuration.

Fixes gh-3794
Fixes gh-3795
 2016-09-15 11:10:17 -05:00
Joe Grandja
e080905a79 MvcRequestMatcher servletPath Polish / XML Config 
Fixes gh-4014
 2016-08-09 16:29:30 -05:00
Rob Winch
3befb1c8a6 MvcRequestMatcher servletPath / JavaConfig 
Issue: gh-3987
 2016-08-09 16:29:30 -05:00
Rob Winch
e297706e8b Polish allow unlimitted sessions 
Update the rnc file

Issue gh-3900
 2016-07-07 14:31:40 -05:00
Michael J. Simons
e3ff4130a5 Allow negative values to configure unlimited sessions 2016-07-07 14:29:18 -05:00
Rob Winch
50d7d3287f Add spring-security-4.2.xsd 2016-07-07 14:19:01 -05:00
Johnny Lim
310bb39a0d Fix typo 2016-07-06 16:22:33 -05:00
Rob Winch
e4c13e3c0e Add MvcRequestMatcher 
Fixes gh-3964
 2016-07-06 15:47:23 -05:00
Rob Winch
13bc70f693 Add CorsFilter support 2016-07-05 14:28:04 -05:00
Spring Buildmaster
24d0069668 Release version 4.1.0.RC2 2016-04-21 01:47:25 +00:00
Johnny Lim
fe94d654ed Fix typos (#228) 2016-04-12 11:11:51 -05:00
Quinten De Swaef
d05fe8ec07 Fix typo in xsd 
Fixes gh-3229
 2016-04-05 09:47:48 -05:00
Joe Grandja
2f7f2ff589 Adds support for Content Security Policy 
Fixes gh-2342
 2016-03-22 21:59:13 -05:00
Shazin Sadakath
e33e21fe6b Add Forward after authentication attempt config support 
Fixes gh-3728
 2016-03-11 10:49:30 -06:00
Tim Ysewyn
331c7e91b7 HTTP Public Key Pinning 
HTTP Public Key Pinning (HPKP) is a security mechanism which allows HTTPS websites
to resist impersonation by attackers using mis-issued or otherwise fraudulent certificates.
(For example, sometimes attackers can compromise certificate authorities,
 and then can mis-issue certificates for a web origin.)
The HTTPS web server serves a list of public key hashes, and on subsequent connections
clients expect that server to use 1 or more of those public keys in its certificate chain.

This commit will add this new functionality.

Fixes gh-3706
 2016-03-03 14:21:46 -06:00
Rob Winch
dab4cf18b8 SEC-3032: Correct documented logout-success-url default 2015-07-22 13:48:07 -05:00
Rob Winch
64938ebcfc SEC-2996: Suport configuring SecurityExpressionHandler<Message<Object>> 2015-07-13 22:45:35 -05:00
Rob Winch
c94a5cf8e2 SEC-2916: disable-url-rewriting=true by default 2015-03-25 13:14:15 -05:00
Rob Winch
cf9f58a4ac SEC-2915: XML spaces->tabs 2015-03-25 13:08:52 -05:00
Rob Winch
5f57e5b0c3 SEC-2873: Remember Me XML Configuration Defaults Should Match Java Config 2015-02-24 20:49:56 -06:00
Kazuki Shimizu
67cd8465c3 SEC-2826: Add remember-me-cookie attribute in xml namespace 2015-02-24 17:54:54 -06:00
Rob Winch
b9563f6102 SEC-2830: Cleanup disabling Same Origin SockJS 
- Defaults for properties false
- Add XML Namespace support
 2015-02-24 10:28:33 -06:00
Rob Winch
b9e2a57131 SEC-2854: Add intercept-message@message-type 2015-02-20 11:43:16 -06:00
Rob Winch
fea03536d6 SEC-2853: Rename WebSocket XML Namespace elements 2015-02-20 11:43:15 -06:00
Rob Winch
c4fe630f8e SEC-2846: Security HTTP Response Headers Configuration Cleanup 2015-02-10 10:36:00 -06:00
Spring Buildmaster
49b69196de Release version 4.0.0.RC1 2014-12-11 20:36:55 -06:00
Rob Winch
c67ff42b8a SEC-2783: XML Configuration Defaults Should Match JavaConfig 
* j_username -> username
* j_password -> password
* j_spring_security_check -> login
* j_spring_cas_security_check -> login/cas
* j_spring_cas_security_proxyreceptor -> login/cas/proxyreceptor
* j_spring_openid_security_login -> login/openid
* j_spring_security_switch_user -> login/impersonate
* j_spring_security_exit_user -> logout/impersonate
* login_error -> error
* use-expressions=true by default
 2014-12-08 15:09:15 -06:00
Rob Winch
6e204fff72 SEC-2781: Remove deprecations 2014-12-04 15:28:40 -06:00
Rob Winch
2cb2657f5b SEC-2702: Clean WebSocket Namespace documentation 2014-11-25 12:27:29 -06:00
Rob Winch
8ad16b01f5 SEC-2702: Add WebSocket Security XML Namespace Support 2014-11-25 09:45:32 -06:00
Rob Winch
4392205f63 SEC-2347: CSRF Enabled by default w/ XML Config 2014-11-21 21:32:56 -06:00
Rob Winch
eedbf44235 SEC-2348: Security HTTP Response Headers enabled by default w/ XML 2014-11-21 16:06:29 -06:00
Rob Winch
9dbe30c81d SEC-2165: remember-me@token-validity-seconds can be parameterized 2013-11-15 14:58:53 -06:00
Rob Winch
afddb5eb39 SEC-2373: Update XSD doc to state security="none" 2013-11-15 13:50:49 -06:00
Collin Peters
85cd5627b6 SEC-2355: Add PATCH to intercept-url xsd 2013-11-15 11:46:34 -06:00
Rob Winch
8087cde628 SEC-2331: Include Expires: 0 in xsd and appendix 2013-09-27 17:10:42 -05:00
Rob Winch
18bd82e7d4 SEC-2131: Update doc to state session authentication sends 401 if no page 2013-08-25 11:37:23 -05:00
Rob Winch
c131fb6379 SEC-2139: named-security-filter are all defined and ordered correctly 2013-08-24 15:18:22 -05:00
Rob Winch
e9bb9e766e SEC-1574: Add CSRF Support 2013-08-15 14:49:21 -05:00
Rob Winch
797df51264 SEC-2135: Support HttpServletRequest#changeSessionId() 2013-08-15 13:59:16 -05:00
Rob Winch
c85328c5d1 SEC-2230: HTTP Strict Transport Security (HSTS)Add support for Strict 
This is a distinct filter as apposed to reusing StaticHeaderWriter
since the specification specifies that the "Strict-Transport-Security"
header should only be set on secure requests. It would not make sense to
require DelegatingRequestMatcherHeaderWriter since this requirement is
in the specification.
 2013-07-31 10:39:52 -05:00
Rob Winch
8013cd54d6 SEC-2230: Added Cache Control support 2013-07-31 10:39:45 -05:00
Marten Deinum
d0b40cd2ae - Created HeaderFactory abstraction 
- Implemented different ALLOW-FROM strategies as specified in the proposal.

Conflicts:
	config/src/main/java/org/springframework/security/config/http/HeadersBeanDefinitionParser.java
	config/src/test/groovy/org/springframework/security/config/http/HttpHeadersConfigTests.groovy
 2013-07-25 16:22:43 -05:00