Spring/spring-security
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
5,574 Commits 26 Branches 0 Tags
e945c19d7a9fe4d731865527aa248f97c1a56bd3
Commit Graph

365 Commits

Author SHA1 Message Date
Rob Winch
994117ad75 SEC-2436: Fix CsrfConfigurerNoWebMvcTests 2013-12-14 14:48:47 -06:00
Rob Winch
b7041ed00e SEC-2436: Add @EnableWebMvcSecurity 2013-12-14 14:40:01 -06:00
Rob Winch
053c890a69 SEC-2450: WebSecurityConfigurerAdapter have default Order of 100 2013-12-14 13:00:48 -06:00
Rob Winch
2df5541905 SEC-2448: Update to HSQL 2.3.1 2013-12-14 10:19:06 -06:00
Rob Winch
7f714ebb23 SEC-2422: Session timeout detection with CSRF protection 2013-12-11 17:38:17 -06:00
Rob Winch
00d668dc5c SEC-2431: UrlAuthorizationConfigurer missing <HttpSecurity> in doc 2013-12-11 11:07:05 -06:00
Rob Winch
f2fdc9d1f5 SEC-2425: Add Test for EnableGlobalMethodSecurity works on parent config 2013-12-04 14:54:56 -06:00
Rob Winch
2a632a061e SEC-2377: Hhandle EnableWebSecurity in both child & parent ApplicationContext 2013-12-03 10:45:25 -06:00
Rob Winch
0b996c669f SEC-2424: Document ObjectPostProcessor 2013-12-02 10:17:08 -06:00
Rob Winch
c7b93e6cee SEC-2404: Fix CSRF config tests 2013-11-21 15:35:26 -06:00
Rob Winch
9dbe30c81d SEC-2165: remember-me@token-validity-seconds can be parameterized 2013-11-15 14:58:53 -06:00
Rob Winch
6382b6341a SEC-2355: Add test to validate intercept-url PATCH works 2013-11-15 11:57:47 -06:00
Rob Winch
cda23443ac XsdDocumentedTests now uses asciidoc instead of asciidoctor 2013-11-01 09:32:05 -05:00
Rob Winch
26be54653b SEC-2382: AutowireBeanFactoryObjectPostProcessor works w/ BeanNameAutoProxyCreator 2013-10-30 11:20:42 -05:00
Rob Winch
9e7fbf8067 SEC-2321: Refine to use X-Requested-With: XMLHttpRequest 2013-10-28 14:00:56 -05:00
Rob Winch
5f290ba10f SEC-2371: Remove ObjectPostProcessor.QUIESENT_POSTPROCESSOR 2013-10-18 14:31:13 -05:00
Rob Winch
604c26eb0d Shis simplifies the class hieararchy significantly.EC-2366: Extract AbstractRequestMatcherRegistry from AbstractRequestMatcherConfigurer 
This simplifies the class hierarchy significantly.
 2013-10-17 13:37:51 -05:00
Rob Winch
348e3a22b6 SEC-2365: registerAuthentication->configure 2013-10-16 13:59:56 -05:00
Rob Winch
0978c12c47 SEC-2361: Java Config Sampels use @Autowired AuthenticationManagerBuilder 2013-10-15 12:35:32 -05:00
Rob Winch
0b0e7dbea9 SEC-2359: Merge DefaultLoginPageViewFilter w/ DefaultLoginPageGeneratingFilter 2013-10-14 15:00:24 -05:00
Rob Winch
51171efa7a SEC-2357: Move *RequestMatcher to .matcher package 2013-10-14 11:55:56 -05:00
Rob Winch
14b9050616 SEC-2357: Move *RequestMatchers to .matchers package 2013-10-14 10:36:31 -05:00
Rob Winch
4ef0460ef6 SEC-2321: Improve Java Config defaults for JavaScript clients 2013-10-11 14:53:11 -05:00
Rob Winch
5f10d84bf5 SEC-2303: WebSecurity sets the Bean resolver 2013-10-06 13:37:51 -05:00
Rob Winch
dd1c2483b5 SEC-2349: Fix documentation tests 2013-10-03 17:03:17 -05:00
Rob Winch
614c94187e SEC-2305: GlobalMethodSecurityConfiguration autowire PermissionEvaluator 
If a single PermissionEvaluator bean is found the
DefaultMethodSecurityExpressionHandler is configured with the
PermissionEvaluator. If multiple PermissionEvaluator beans are found, the
beans are ignored.
 2013-09-27 15:46:45 -05:00
Rob Winch
a09756745f SEC-2151: Support binding method arguments with Annotations 
This allow utilizing method arguments for method access control on
interfaces prior to JDK 8.
 2013-09-27 11:18:37 -05:00
Rob Winch
cea0cf9260 SEC-2243: Remove additional Debug Filter 2013-09-26 11:38:16 -05:00
Rob Winch
a888ddf8b3 SEC-2307: JavaConfig RequestCache ignores favicon.ico 2013-09-24 11:30:37 -05:00
Rob Winch
28fb6ba14b SEC-2328: Add hasAnyRole to ExpressionUrlAuthorizationConfiguration 2013-09-23 10:51:08 -05:00
Rob Winch
a3d112979f SEC-2301: GlobalMethodSecurityConfiguration sets DefaultWebSecurityExpressionHandler BeanResolver 2013-09-20 15:53:58 -05:00
Rob Winch
f294480e6b SEC-2329: JC @Autowire(required=false) AuthenticationTrustResolver 
Java Configuration now allows optional @Autowire of
AuthenticationTrustResolver. In the WebSecurityConfigurerAdapter this is
done by populating AuthenticationTrustResolver as a sharedObject.
 2013-09-20 15:28:50 -05:00
Rob Winch
5082a04626 SEC-2311: LogoutConfigurer allows other HTTP methods if CSRF is disabled 2013-09-19 16:05:26 -05:00
Rob Winch
8f8c6169e8 SEC-2331: Cache Control now includes Expires: 0 2013-09-19 14:06:37 -05:00
Rob Winch
c5c1419521 SEC-2332: GlobalMethodSecurityConfiguration includes proper voters 
Previously GlobalMethodSecurityConfiguration did not include the correct
voters. This updates the code and the tests to ensure that the proper
voters are added. Note this got past testing previously due to all the
voters abstaining, so tests were added for ensuring that methods could also
be invoked sucessfully using the configured annotation.
 2013-09-18 18:27:12 -05:00
Rob Winch
0114b457c0 SEC-2330: CacheControlHeadersWriter use a single header 2013-09-18 16:12:34 -05:00
Rob Winch
be8aad8306 SEC-2196: Demonstrate Method Security works on Generic methods 2013-09-13 16:20:43 -07:00
Rob Winch
662bb24370 SEC-1937: Added test to demonstrate SEC-1937 was invalid 2013-09-11 15:10:42 -07:00
Rob Winch
3c82e63ded Formatting cleanup 2013-09-11 15:10:20 -07:00
Rob Winch
ae368829f4 Tweak PermGen for tests 2013-08-28 13:30:25 -05:00
Rob Winch
d89cf6db29 SEC-2283: Update headers documentation and tests 2013-08-28 12:35:40 -05:00
Rob Winch
4761614c9f SEC-2291: Fix internal links within reference 
Instead of using xlink:href="# use linkend="
 2013-08-28 09:12:27 -05:00
Rob Winch
26166ef6e8 SEC-2272: CsrfRequestDataValueProcessor support Spring 4 and Spring 3 2013-08-27 16:26:16 -05:00
Rob Winch
48283ec004 SEC-2276: Delay saving CsrfToken until token is accessed 
This also removed the CsrfToken from the response headers to prevent the
token from being saved. If user's wish to return the CsrfToken in the
response headers, they should use the CsrfToken found on the request.
 2013-08-24 23:31:01 -05:00
Rob Winch
c131fb6379 SEC-2139: named-security-filter are all defined and ordered correctly 2013-08-24 15:18:22 -05:00
Rob Winch
379cbd2a8b SEC-2274: Add ApplicationContext as HttpSecurity shared object 2013-08-21 16:50:09 -05:00
Rob Winch
d62c2e0835 SEC-2244: Defaults based on loginPage are now updated when loginPage changes 2013-08-16 14:48:45 -05:00
Rob Winch
e9bb9e766e SEC-1574: Add CSRF Support 2013-08-15 14:49:21 -05:00
Rob Winch
797df51264 SEC-2135: Support HttpServletRequest#changeSessionId() 2013-08-15 13:59:16 -05:00
Rob Winch
13da42ca1b SEC-2137: Allow disabling session fixation and enable concurrency control 2013-08-15 12:50:40 -05:00