From e5eeacec5ffb772f1d1ece91cbc2487ee20ccf7d Mon Sep 17 00:00:00 2001 From: Vedran Pavic Date: Tue, 25 Oct 2022 20:35:36 +0200 Subject: [PATCH] Update security config in samples This commit updates security configuration in samples to: - use AuthorizationFilter instead of FilterSecurityInterceptor - update session creation policy in REST sample --- .../session/web/http/HeaderHttpSessionIdResolver.java | 1 + .../java/docs/security/RememberMeSecurityConfiguration.java | 2 +- .../src/main/java/sample/config/SecurityConfig.java | 2 +- .../src/main/java/sample/config/SecurityConfig.java | 2 +- .../src/main/java/sample/config/SecurityConfig.java | 2 +- .../src/main/java/sample/config/SecurityConfig.java | 2 +- .../src/main/java/sample/config/SecurityConfig.java | 2 +- .../src/main/java/sample/config/WebSecurityConfig.java | 2 +- .../src/main/java/sample/SecurityConfig.java | 5 ++++- 9 files changed, 12 insertions(+), 8 deletions(-) diff --git a/spring-session-core/src/main/java/org/springframework/session/web/http/HeaderHttpSessionIdResolver.java b/spring-session-core/src/main/java/org/springframework/session/web/http/HeaderHttpSessionIdResolver.java index f4e49445..c510559b 100644 --- a/spring-session-core/src/main/java/org/springframework/session/web/http/HeaderHttpSessionIdResolver.java +++ b/spring-session-core/src/main/java/org/springframework/session/web/http/HeaderHttpSessionIdResolver.java @@ -98,6 +98,7 @@ public class HeaderHttpSessionIdResolver implements HttpSessionIdResolver { @Override public List resolveSessionIds(HttpServletRequest request) { String headerValue = request.getHeader(this.headerName); + System.out.println(headerValue); return (headerValue != null) ? Collections.singletonList(headerValue) : Collections.emptyList(); } diff --git a/spring-session-docs/modules/ROOT/examples/java/docs/security/RememberMeSecurityConfiguration.java b/spring-session-docs/modules/ROOT/examples/java/docs/security/RememberMeSecurityConfiguration.java index bcbd5e70..dba2ed0e 100644 --- a/spring-session-docs/modules/ROOT/examples/java/docs/security/RememberMeSecurityConfiguration.java +++ b/spring-session-docs/modules/ROOT/examples/java/docs/security/RememberMeSecurityConfiguration.java @@ -51,7 +51,7 @@ public class RememberMeSecurityConfiguration { return http .formLogin(Customizer.withDefaults()) - .authorizeRequests((authorize) -> authorize + .authorizeHttpRequests((authorize) -> authorize .anyRequest().authenticated() ).build(); } diff --git a/spring-session-samples/spring-session-sample-boot-findbyusername/src/main/java/sample/config/SecurityConfig.java b/spring-session-samples/spring-session-sample-boot-findbyusername/src/main/java/sample/config/SecurityConfig.java index af89a682..5ad1223f 100644 --- a/spring-session-samples/spring-session-sample-boot-findbyusername/src/main/java/sample/config/SecurityConfig.java +++ b/spring-session-samples/spring-session-sample-boot-findbyusername/src/main/java/sample/config/SecurityConfig.java @@ -36,7 +36,7 @@ public class SecurityConfig { @Bean SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception { return http - .authorizeRequests((authorize) -> authorize + .authorizeHttpRequests((authorize) -> authorize .requestMatchers(PathRequest.toStaticResources().atCommonLocations()).permitAll() .anyRequest().authenticated() ) diff --git a/spring-session-samples/spring-session-sample-boot-hazelcast/src/main/java/sample/config/SecurityConfig.java b/spring-session-samples/spring-session-sample-boot-hazelcast/src/main/java/sample/config/SecurityConfig.java index 9bf849be..965e44bc 100644 --- a/spring-session-samples/spring-session-sample-boot-hazelcast/src/main/java/sample/config/SecurityConfig.java +++ b/spring-session-samples/spring-session-sample-boot-hazelcast/src/main/java/sample/config/SecurityConfig.java @@ -35,7 +35,7 @@ public class SecurityConfig { @Bean SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception { return http - .authorizeRequests((authorize) -> authorize + .authorizeHttpRequests((authorize) -> authorize .requestMatchers(PathRequest.toStaticResources().atCommonLocations()).permitAll() .anyRequest().authenticated() ) diff --git a/spring-session-samples/spring-session-sample-boot-jdbc/src/main/java/sample/config/SecurityConfig.java b/spring-session-samples/spring-session-sample-boot-jdbc/src/main/java/sample/config/SecurityConfig.java index f07c5953..7dc8de2e 100644 --- a/spring-session-samples/spring-session-sample-boot-jdbc/src/main/java/sample/config/SecurityConfig.java +++ b/spring-session-samples/spring-session-sample-boot-jdbc/src/main/java/sample/config/SecurityConfig.java @@ -45,7 +45,7 @@ public class SecurityConfig { @Bean SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception { return http - .authorizeRequests((authorize) -> authorize + .authorizeHttpRequests((authorize) -> authorize .requestMatchers(PathRequest.toStaticResources().atCommonLocations()).permitAll() .anyRequest().authenticated() ) diff --git a/spring-session-samples/spring-session-sample-boot-redis-json/src/main/java/sample/config/SecurityConfig.java b/spring-session-samples/spring-session-sample-boot-redis-json/src/main/java/sample/config/SecurityConfig.java index f2e65dc6..1415588c 100644 --- a/spring-session-samples/spring-session-sample-boot-redis-json/src/main/java/sample/config/SecurityConfig.java +++ b/spring-session-samples/spring-session-sample-boot-redis-json/src/main/java/sample/config/SecurityConfig.java @@ -35,7 +35,7 @@ public class SecurityConfig { @Bean SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception { return http - .authorizeRequests((authorize) -> authorize + .authorizeHttpRequests((authorize) -> authorize .requestMatchers(PathRequest.toStaticResources().atCommonLocations()).permitAll() .anyRequest().authenticated() ) diff --git a/spring-session-samples/spring-session-sample-boot-redis/src/main/java/sample/config/SecurityConfig.java b/spring-session-samples/spring-session-sample-boot-redis/src/main/java/sample/config/SecurityConfig.java index e3ed80a1..30e99dc0 100644 --- a/spring-session-samples/spring-session-sample-boot-redis/src/main/java/sample/config/SecurityConfig.java +++ b/spring-session-samples/spring-session-sample-boot-redis/src/main/java/sample/config/SecurityConfig.java @@ -36,7 +36,7 @@ public class SecurityConfig { @Bean SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception { return http - .authorizeRequests((authorize) -> authorize + .authorizeHttpRequests((authorize) -> authorize .requestMatchers(PathRequest.toStaticResources().atCommonLocations()).permitAll() .anyRequest().authenticated() ) diff --git a/spring-session-samples/spring-session-sample-boot-websocket/src/main/java/sample/config/WebSecurityConfig.java b/spring-session-samples/spring-session-sample-boot-websocket/src/main/java/sample/config/WebSecurityConfig.java index bf7b32a3..1c767a8c 100644 --- a/spring-session-samples/spring-session-sample-boot-websocket/src/main/java/sample/config/WebSecurityConfig.java +++ b/spring-session-samples/spring-session-sample-boot-websocket/src/main/java/sample/config/WebSecurityConfig.java @@ -54,7 +54,7 @@ public class WebSecurityConfig { @Bean SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception { return http - .authorizeRequests((authorize) -> authorize + .authorizeHttpRequests((authorize) -> authorize .requestMatchers(PathRequest.toStaticResources().atCommonLocations()).permitAll() .anyRequest().authenticated() ) diff --git a/spring-session-samples/spring-session-sample-javaconfig-rest/src/main/java/sample/SecurityConfig.java b/spring-session-samples/spring-session-sample-javaconfig-rest/src/main/java/sample/SecurityConfig.java index 80beb226..c86ef120 100644 --- a/spring-session-samples/spring-session-sample-javaconfig-rest/src/main/java/sample/SecurityConfig.java +++ b/spring-session-samples/spring-session-sample-javaconfig-rest/src/main/java/sample/SecurityConfig.java @@ -23,6 +23,7 @@ import org.springframework.security.config.Customizer; import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder; import org.springframework.security.config.annotation.web.builders.HttpSecurity; import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity; +import org.springframework.security.config.http.SessionCreationPolicy; import org.springframework.security.core.userdetails.User; import org.springframework.security.web.SecurityFilterChain; import org.springframework.security.web.savedrequest.NullRequestCache; @@ -35,13 +36,15 @@ public class SecurityConfig { @Bean SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception { return http - .authorizeRequests((authorize) -> authorize + .authorizeHttpRequests((authorize) -> authorize .anyRequest().authenticated() ) .requestCache((requestCache) -> requestCache .requestCache(new NullRequestCache()) ) .httpBasic(Customizer.withDefaults()) + .sessionManagement((sessionManagement) -> sessionManagement + .sessionCreationPolicy(SessionCreationPolicy.IF_REQUIRED)) .build(); } // @formatter:on