Rob Winch comments

Results 236 comments of


                                            Rob Winch

Resource Server Package Name Inconsistencies

I'd have to give this some thought. At first glance I'd say that they should be in web.authentication. I'm trying to remember if there were any conscious decisions to make...

Support OAuth2 client authentication using X.509 certificate

@maskedpirate No updates. Would you be interested in submitting a pull request?

Support OAuth2 client authentication using X.509 certificate

No updates at this time.

Add 'filterChainMatcher' as an alias of 'requestMatcher'

Are you speaking about making it more explicit between the matchers on `HttpSecurity` and the authorization rules?

Add 'filterChainMatcher' as an alias of 'requestMatcher'

I think that makes sense and have thought about it a bit. I'd prefer not exposing implementation details like `filterChainMatchers` in the DSL. I think something like this would be...

Add 'filterChainMatcher' as an alias of 'requestMatcher'

I think my concern is that the DLS tries to hide the implementation details (i.e that FilterChainProxy is used under the covers). Instead, I think it makes more sense to...

Thread-unsafe usage of HttpServletResponse corrupting jetty HttpFields state in reactive ResponseBodyEmitter handlers

@rstoyanchev It looks like @SpComb analysis is correct. Spring Security's `OnComittedResponseWrapper` is detecting that the response is about to be committed, so it then tries to write the headers before...

CSRF enabled /logout could return 405 instead of 404 for non-POST requests

Since this is a breaking change, we should consider this for 6.0.x or close the issue

BREACH attack protection for CSRF tokens

I think this is a good start. I agree with you that we should create specific interfaces. An interesting observation is that CsrfAuthenticationStrategy can reuse the logic for setting the...

CookieServerCsrfTokenRepository does not add cookie

Thanks for the feedback. Generally speaking the reactive repositories won't save the token unless something subscribed to the result. This is because if nothing subscribed, there is no way that...