spring-security

spring-security copied to clipboard

RoleHierarchy is ignored with GlobalMethodSecurityConfiguration and @Secured annotation

7

**Describe the bug** Using `@EnableGlobalMethodSecurity(securedEnabled = true)` does not work with injected `RoleHierarchy` For `@Secured` based version of interceptor the only Voters configured in `AffirmativeBased` are `RoleVoter` and `AuthenticatedVoter`. Injected...

mkrasuski

IpAddressMatcher.matches(null) returns true

1

**Describe the bug** IpAddressMatcher.matches(var) returns true when var is null **To Reproduce** create a new IpAddressMatcher with an ip address or subnet to check against, afterwards check a variable with...

BeauTaapken

**Describe the bug** Consider the following controller: ``` @RestController public class SecuredController { @GetMapping(path = "/rolesAllowed_GUEST") @RolesAllowed("GUEST") public String rolesAllowed_GUEST() { return "GUEST"; } @GetMapping(path = "/rolesAllowed_ROLE_GUEST") @RolesAllowed("ROLE_GUEST") public String...

mgr32

jzheaux

codes in spring security docs fail to work

7

**Describe the bug** I tried all codes in https://docs.spring.io/spring-security/reference/servlet/authorization/authorize-http-requests.html, but they all failed to work **To Reproduce** configure codes in a SecurityConfig.java file in my springboot, which is migrated from...

cokeBeer

When attempting to run tests on the `5.7.x` branch using the built-in Gradle runner, the tests fail to compile and reporting missing classes in `Saml2LoginConfigurerTests`. However, when configuring to run...

jgrandja

Spring-security-oauth2.xsd is not published to http://www.springframework.org/schema/security

14

**Summary** Spring-security-oauth2.xsd should be published under https://www.springframework.org/schema/security/ Or was this removal intentional? Because it crashes our application based on spring. **Actual Behavior** Spring-security-oauth2.xsd is not available under https://www.springframework.org/schema/security/ causing XML...

lukasondrak96

Spring Security Observability for Authentication and Authorization

2

By doing: ```java @Bean ApplicationListener securityEventListener() { ObservationRegistry observationRegistry = ObservationRegistry.create(); observationRegistry.observationConfig().observationHandler(new ObservationTextPublisher()); return DelegatingObservationSecurityEventListener.withDefaults(observationRegistry).build(); } ``` Then all `AuthenticationSuccessEvent`s, `AuthenticationFailureEvent`s, `AuthorizationGrantedEvent`s, and `AuthorizationDeniedEvent`s will be handled by Micrometer. Specifically,...

jzheaux

Gh 11661 Configurable authentication converter for resource-servers with token introspection

4

This could close https://github.com/spring-projects/spring-security/issues/11661 It adds configurable authentication converter for resource-servers with token introspection (something very similar to what `JwtAuthenticationConverter` does for resource-servers with JWT decoder). The new `(Reactive)OpaqueTokenAuthenticationConverter` is...

ch4mpy

Add the ability to swallow exceptions for specific dispatcher types

1

The `FilterSecurityInterceptor` and `AuthorizationFilter` now apply to every request by default. This led to a problem from the Spring Boot's perspective: Consider the following configuration: ```java @Bean SecurityFilterChain appSecurity(HttpSecurity http)...

marcusdacoregio