spring-boot

Commit Graph

Author	SHA1	Message	Date
Madhura Bhave	d9d161cd6b	Allow previously authorized users to access the error page Prior to this commit, the `ErrorPageSecurityFilter` verified if access to the error page was allowed by invoking the `WebInvocationPrivilegeEvaluator` with the Authentication from the `SecurityContextHolder`. This meant that access to the error page was denied for a `null` Authentication or `AnonymousAuthenticationToken` in cases where the error page required authenticated access. This prevented authorized users from accessing the error page in case the Authentication wasn't retrievable for the error dispatch, which is the case for `@Transient` authentication or stateless session policy. This commit updates the `ErrorPageSecurityFilter` to check access to the error page only if the error is an authn or authz error in cases where an authentication object is not found in the SecurityContextHolder. This makes the error response consistent when bad credentials or no credentials are used while also allowing access to previously authorized users. Fixes gh-28953	3 years ago
Scott Frederick	4eed637481	Merge branch '2.5.x' Closes gh-28789	3 years ago
Scott Frederick	12244a8edd	Remove use of Thymeleaf from smoke tests Closes gh-28788	3 years ago
Madhura Bhave	dd1d1482dc	Deny unauthorized access to the error page Fixes gh-26356 Co-authored-by Andy Wilkinson <wilkinsona@vmware.com>	3 years ago
Madhura Bhave	0818f27f44	Configure WebSecurity using WebSecurityCustomizer Replace `WebSecurityConfigurer` and `WebSecurityConfigurerAdapter` configurations with `WebSecurityCustomizer` or `SecurityFilterChain` beans. Closes gh-23421	4 years ago
Phillip Webb	6675f49334	Switch to multi-line security configuration Now that we have lambda style security configuration we can further improve readability by switching to one statement per line. See gh-17525	5 years ago
Madhura Bhave	39a7b9da38	Switch to lambda style security configuration Closes gh-17525	5 years ago
Madhura Bhave	d9466f5659	Move smoke tests under spring-boot-test See gh-17393	5 years ago

8 Commits (d27e6fbf25c5acd7738253018160504dc64fb1fa)