Skip to content

Commit 12b9f2e

Browse files
jzheauxjzheaux
committed
use-authorization-manager defaults to true
Closes gh-11929
1 parent 1aa3f14 commit 12b9f2e

File tree

162 files changed

+191
-105
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

162 files changed

+191
-105
lines changed

Diff for: ‎config/src/main/java/org/springframework/security/config/http/HttpConfigurationBuilder.java

+6-3
Original file line numberDiff line numberDiff line change
@@ -716,12 +716,15 @@ private void createRequestCacheFilter() {
716716
}
717717

718718
private void createFilterSecurity(BeanReference authManager) {
719-
boolean useAuthorizationManager = Boolean.parseBoolean(this.httpElt.getAttribute(ATT_USE_AUTHORIZATION_MGR));
720-
if (useAuthorizationManager) {
719+
if (StringUtils.hasText(this.httpElt.getAttribute(ATT_AUTHORIZATION_MGR))) {
721720
createAuthorizationFilter();
722721
return;
723722
}
724-
if (StringUtils.hasText(this.httpElt.getAttribute(ATT_AUTHORIZATION_MGR))) {
723+
boolean useAuthorizationManager = true;
724+
if (StringUtils.hasText(this.httpElt.getAttribute(ATT_USE_AUTHORIZATION_MGR))) {
725+
useAuthorizationManager = Boolean.parseBoolean(this.httpElt.getAttribute(ATT_USE_AUTHORIZATION_MGR));
726+
}
727+
if (useAuthorizationManager) {
725728
createAuthorizationFilter();
726729
return;
727730
}

Diff for: ‎config/src/main/java/org/springframework/security/config/method/InterceptMethodsBeanDefinitionDecorator.java

+5-2
Original file line numberDiff line numberDiff line change
@@ -93,10 +93,13 @@ protected BeanDefinition createInterceptorDefinition(Node node) {
9393

9494
boolean supports(Node node) {
9595
Element interceptMethodsElt = (Element) node;
96-
if (Boolean.parseBoolean(interceptMethodsElt.getAttribute(ATT_USE_AUTHORIZATION_MGR))) {
96+
if (StringUtils.hasText(interceptMethodsElt.getAttribute(ATT_AUTHORIZATION_MGR))) {
9797
return true;
9898
}
99-
return StringUtils.hasText(interceptMethodsElt.getAttribute(ATT_AUTHORIZATION_MGR));
99+
if (StringUtils.hasText(interceptMethodsElt.getAttribute(ATT_USE_AUTHORIZATION_MGR))) {
100+
return Boolean.parseBoolean(interceptMethodsElt.getAttribute(ATT_USE_AUTHORIZATION_MGR));
101+
}
102+
return true;
100103
}
101104

102105
private Pointcut pointcut(Element interceptorElt, Element protectElt) {

Diff for: ‎config/src/main/java/org/springframework/security/config/websocket/WebSocketMessageBrokerSecurityBeanDefinitionParser.java

+4-1
Original file line numberDiff line numberDiff line change
@@ -159,7 +159,10 @@ public BeanDefinition parse(Element element, ParserContext parserContext) {
159159
}
160160

161161
private String parseAuthorization(Element element, ParserContext parserContext) {
162-
boolean useAuthorizationManager = Boolean.parseBoolean(element.getAttribute(USE_AUTHORIZATION_MANAGER_ATTR));
162+
boolean useAuthorizationManager = true;
163+
if (StringUtils.hasText(element.getAttribute(USE_AUTHORIZATION_MANAGER_ATTR))) {
164+
useAuthorizationManager = Boolean.parseBoolean(element.getAttribute(USE_AUTHORIZATION_MANAGER_ATTR));
165+
}
163166
if (useAuthorizationManager) {
164167
return parseAuthorizationManager(element, parserContext);
165168
}

Diff for: ‎config/src/main/resources/org/springframework/security/config/spring-security-6.0.rnc

+3-3
Original file line numberDiff line numberDiff line change
@@ -178,7 +178,7 @@ intercept-methods.attlist &=
178178
## Optional AccessDecisionManager bean ID to be used by the created method security interceptor.
179179
attribute access-decision-manager-ref {xsd:token}?
180180
intercept-methods.attlist &=
181-
## Use the AuthorizationManager API instead of AccessDecisionManager (defaults to false)
181+
## Use the AuthorizationManager API instead of AccessDecisionManager (defaults to true)
182182
attribute use-authorization-manager {xsd:boolean}?
183183
intercept-methods.attlist &=
184184
## Use this AuthorizationManager instead of the default (supercedes use-authorization-manager)
@@ -306,7 +306,7 @@ websocket-message-broker.attrlist &=
306306
## Use this AuthorizationManager instead of deriving one from <intercept-message> elements
307307
attribute authorization-manager-ref {xsd:string}?
308308
websocket-message-broker.attrlist &=
309-
## Use AuthorizationManager API instead of SecurityMetadatasource
309+
## Use AuthorizationManager API instead of SecurityMetadatasource (defaults to true)
310310
attribute use-authorization-manager {xsd:boolean}?
311311
websocket-message-broker.attrlist &=
312312
## Use this SecurityContextHolderStrategy (note only supported in conjunction with the AuthorizationManager API)
@@ -368,7 +368,7 @@ http.attlist &=
368368
## If available, runs the request as the Subject acquired from the JaasAuthenticationToken. Defaults to "false".
369369
attribute jaas-api-provision {xsd:boolean}?
370370
http.attlist &=
371-
## Use AuthorizationManager API instead of SecurityMetadataSource
371+
## Use AuthorizationManager API instead of SecurityMetadataSource (defaults to true)
372372
attribute use-authorization-manager {xsd:boolean}?
373373
http.attlist &=
374374
## Use this AuthorizationManager instead of deriving one from <intercept-url> elements

Diff for: ‎config/src/main/resources/org/springframework/security/config/spring-security-6.0.xsd

+3-3
Original file line numberDiff line numberDiff line change
@@ -542,7 +542,7 @@
542542
</xs:attribute>
543543
<xs:attribute name="use-authorization-manager" type="xs:boolean">
544544
<xs:annotation>
545-
<xs:documentation>Use the AuthorizationManager API instead of AccessDecisionManager (defaults to false)
545+
<xs:documentation>Use the AuthorizationManager API instead of AccessDecisionManager (defaults to true)
546546
</xs:documentation>
547547
</xs:annotation>
548548
</xs:attribute>
@@ -967,7 +967,7 @@
967967
</xs:attribute>
968968
<xs:attribute name="use-authorization-manager" type="xs:boolean">
969969
<xs:annotation>
970-
<xs:documentation>Use AuthorizationManager API instead of SecurityMetadatasource
970+
<xs:documentation>Use AuthorizationManager API instead of SecurityMetadatasource (defaults to true)
971971
</xs:documentation>
972972
</xs:annotation>
973973
</xs:attribute>
@@ -1325,7 +1325,7 @@
13251325
</xs:attribute>
13261326
<xs:attribute name="use-authorization-manager" type="xs:boolean">
13271327
<xs:annotation>
1328-
<xs:documentation>Use AuthorizationManager API instead of SecurityMetadataSource
1328+
<xs:documentation>Use AuthorizationManager API instead of SecurityMetadataSource (defaults to true)
13291329
</xs:documentation>
13301330
</xs:annotation>
13311331
</xs:attribute>

Diff for: ‎config/src/test/java/org/springframework/security/config/http/FilterSecurityMetadataSourceBeanDefinitionParserTests.java

+1-1
Original file line numberDiff line numberDiff line change
@@ -108,7 +108,7 @@ public void interceptUrlsSupportPropertyPlaceholders() {
108108
public void parsingWithinFilterSecurityInterceptorIsSuccessful() {
109109
// @formatter:off
110110
setContext("<b:bean class=\"org.springframework.web.servlet.handler.HandlerMappingIntrospector\" name=\"mvcHandlerMappingIntrospector\"/>" +
111-
"<http auto-config='true' use-expressions='false'/>"
111+
"<http auto-config='true' use-expressions='false' use-authorization-manager='false'/>"
112112
+ "<b:bean id='fsi' class='org.springframework.security.web.access.intercept.FilterSecurityInterceptor' autowire='byType'>"
113113
+ " <b:property name='securityMetadataSource'>"
114114
+ " <filter-security-metadata-source use-expressions='false'>"

Diff for: ‎config/src/test/java/org/springframework/security/config/http/MiscHttpConfigTests.java

+2-2
Original file line numberDiff line numberDiff line change
@@ -84,6 +84,7 @@
8484
import org.springframework.security.web.FilterChainProxy;
8585
import org.springframework.security.web.access.ExceptionTranslationFilter;
8686
import org.springframework.security.web.access.channel.ChannelProcessingFilter;
87+
import org.springframework.security.web.access.intercept.AuthorizationFilter;
8788
import org.springframework.security.web.access.intercept.FilterSecurityInterceptor;
8889
import org.springframework.security.web.authentication.AnonymousAuthenticationFilter;
8990
import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter;
@@ -849,8 +850,7 @@ private void assertThatFiltersMatchExpectedAutoConfigList(String url) {
849850
assertThat(filters.next()).isInstanceOf(SecurityContextHolderAwareRequestFilter.class);
850851
assertThat(filters.next()).isInstanceOf(AnonymousAuthenticationFilter.class);
851852
assertThat(filters.next()).isInstanceOf(ExceptionTranslationFilter.class);
852-
assertThat(filters.next()).isInstanceOf(FilterSecurityInterceptor.class)
853-
.hasFieldOrPropertyWithValue("observeOncePerRequest", false);
853+
assertThat(filters.next()).isInstanceOf(AuthorizationFilter.class);
854854
}
855855

856856
private <T extends Filter> T getFilter(Class<T> filterClass) {

Diff for: ‎config/src/test/java/org/springframework/security/config/http/NamespaceHttpBasicTests.java

+1-1
Original file line numberDiff line numberDiff line change
@@ -99,7 +99,7 @@ public void httpBasicWithPasswordEncoder() throws Exception {
9999
@Test
100100
public void httpBasicCustomSecurityContextHolderStrategy() throws Exception {
101101
// @formatter:off
102-
loadContext("<http auto-config=\"true\" use-expressions=\"false\" security-context-holder-strategy-ref=\"ref\"/>\n"
102+
loadContext("<http auto-config=\"true\" use-expressions=\"false\" security-context-holder-strategy-ref=\"ref\" use-authorization-manager=\"false\"/>\n"
103103
+ "<authentication-manager id=\"authenticationManager\">\n"
104104
+ " <authentication-provider>\n"
105105
+ " <user-service>\n"

Diff for: ‎config/src/test/resources/org/springframework/security/config/http/CsrfConfigTests-AutoConfig.xml

+3-1
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,9 @@
2323
http://www.springframework.org/schema/beans https://www.springframework.org/schema/beans/spring-beans.xsd">
2424

2525
<http-firewall ref="firewall"/>
26-
<http auto-config="true"/>
26+
<http auto-config="true">
27+
<intercept-url pattern="/**" access="permitAll"/>
28+
</http>
2729

2830
<b:import resource="CsrfConfigTests-shared-userservice.xml"/>
2931

Diff for: ‎config/src/test/resources/org/springframework/security/config/http/CsrfConfigTests-CsrfDisabled.xml

+1
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,7 @@
2323

2424
<http auto-config="true">
2525
<csrf disabled="true"/>
26+
<intercept-url pattern="/**" access="permitAll"/>
2627
</http>
2728

2829
<b:import resource="CsrfConfigTests-shared-userservice.xml"/>

Diff for: ‎config/src/test/resources/org/springframework/security/config/http/CsrfConfigTests-CsrfEnabled.xml

+1
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,7 @@
2525
<http-firewall ref="firewall"/>
2626
<http auto-config="true">
2727
<intercept-url pattern="/authenticated/**" access="authenticated"/>
28+
<intercept-url pattern="/**" access="permitAll"/>
2829
<csrf/>
2930
</http>
3031

Diff for: ‎config/src/test/resources/org/springframework/security/config/http/CsrfConfigTests-WithRequestMatcher.xml

+1-1
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@
2121
xsi:schemaLocation="http://www.springframework.org/schema/security https://www.springframework.org/schema/security/spring-security.xsd
2222
http://www.springframework.org/schema/beans https://www.springframework.org/schema/beans/spring-beans.xsd">
2323

24-
<http auto-config="true" use-expressions="false">
24+
<http auto-config="true" use-expressions="false" use-authorization-manager="false">
2525
<csrf request-matcher-ref="requestMatcher"/>
2626
</http>
2727

Diff for: ‎config/src/test/resources/org/springframework/security/config/http/CsrfConfigTests-WithSessionManagement.xml

+1-1
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@
2121
xsi:schemaLocation="http://www.springframework.org/schema/security https://www.springframework.org/schema/security/spring-security.xsd
2222
http://www.springframework.org/schema/beans https://www.springframework.org/schema/beans/spring-beans.xsd">
2323

24-
<http auto-config="true" use-expressions="false">
24+
<http auto-config="true" use-expressions="false" use-authorization-manager="false">
2525
<session-management invalid-session-url="/error/sessionError"/>
2626
<csrf/>
2727
</http>

Diff for: ‎config/src/test/resources/org/springframework/security/config/http/CsrfConfigTests-WithXorCsrfTokenRequestAttributeHandler.xml

+1
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,7 @@
2424

2525
<http auto-config="true">
2626
<csrf request-handler-ref="requestHandler"/>
27+
<intercept-url pattern="/**" access="permitAll"/>
2728
</http>
2829

2930
<b:bean id="requestHandler" class="org.springframework.security.web.csrf.XorCsrfTokenRequestAttributeHandler"

Diff for: ‎config/src/test/resources/org/springframework/security/config/http/FormLoginConfigTests-ForSec2919.xml

+1-1
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@
2424
http://www.springframework.org/schema/beans
2525
https://www.springframework.org/schema/beans/spring-beans.xsd">
2626

27-
<http auto-config="true" use-expressions="false">
27+
<http auto-config="true" use-expressions="false" use-authorization-manager="false">
2828
<form-login login-page="/login"/>
2929
</http>
3030

Diff for: ‎config/src/test/resources/org/springframework/security/config/http/FormLoginConfigTests-ForSec3147.xml

+1-1
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@
2424
http://www.springframework.org/schema/beans
2525
https://www.springframework.org/schema/beans/spring-beans.xsd">
2626

27-
<http auto-config="true" use-expressions="false">
27+
<http auto-config="true" use-expressions="false" use-authorization-manager="false">
2828
<form-login login-page="/login"/>
2929
</http>
3030

Diff for: ‎config/src/test/resources/org/springframework/security/config/http/FormLoginConfigTests-NoLeadingSlashDefaultTargetUrl.xml

+1-1
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@
2424
http://www.springframework.org/schema/beans
2525
https://www.springframework.org/schema/beans/spring-beans.xsd">
2626

27-
<http auto-config="true" use-expressions="false">
27+
<http auto-config="true" use-expressions="false" use-authorization-manager="false">
2828
<form-login default-target-url="noLeadingSlash"/>
2929
</http>
3030

Diff for: ‎config/src/test/resources/org/springframework/security/config/http/FormLoginConfigTests-NoLeadingSlashLoginPage.xml

+1-1
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@
2424
http://www.springframework.org/schema/beans
2525
https://www.springframework.org/schema/beans/spring-beans.xsd">
2626

27-
<http auto-config="true" use-expressions="false">
27+
<http auto-config="true" use-expressions="false" use-authorization-manager="false">
2828
<form-login login-page="noLeadingSlash"/>
2929
</http>
3030

Diff for: ‎config/src/test/resources/org/springframework/security/config/http/FormLoginConfigTests-UsingSpel.xml

+1-1
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@
2424
http://www.springframework.org/schema/beans
2525
https://www.springframework.org/schema/beans/spring-beans.xsd">
2626

27-
<http auto-config="true" use-expressions="false">
27+
<http auto-config="true" use-expressions="false" use-authorization-manager="false">
2828
<intercept-url pattern="/**" access="ROLE_USER"/>
2929
<form-login
3030
default-target-url="#{T(org.springframework.security.config.http.WebConfigUtilsTests).URL}/default"

Diff for: ‎config/src/test/resources/org/springframework/security/config/http/FormLoginConfigTests-WithAntRequestMatcher.xml

+1-1
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@
2424
http://www.springframework.org/schema/beans
2525
https://www.springframework.org/schema/beans/spring-beans.xsd">
2626

27-
<http auto-config="true" use-expressions="false" request-matcher="ant">
27+
<http auto-config="true" use-expressions="false" request-matcher="ant" use-authorization-manager="false">
2828
<intercept-url pattern="/**" access="ROLE_USER"/>
2929
<form-login/>
3030
</http>

Diff for: ‎config/src/test/resources/org/springframework/security/config/http/FormLoginConfigTests-WithCsrfDisabled.xml

+1-1
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@
2424
http://www.springframework.org/schema/beans
2525
https://www.springframework.org/schema/beans/spring-beans.xsd">
2626

27-
<http auto-config="true" use-expressions="false">
27+
<http auto-config="true" use-expressions="false" use-authorization-manager="false">
2828
<csrf disabled="true"/>
2929
</http>
3030

Diff for: ‎config/src/test/resources/org/springframework/security/config/http/FormLoginConfigTests-WithCsrfEnabled.xml

+1-1
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@
2424
http://www.springframework.org/schema/beans
2525
https://www.springframework.org/schema/beans/spring-beans.xsd">
2626

27-
<http auto-config="true" use-expressions="false">
27+
<http auto-config="true" use-expressions="false" use-authorization-manager="false">
2828
<csrf disabled="false"/>
2929
</http>
3030

Diff for: ‎config/src/test/resources/org/springframework/security/config/http/FormLoginConfigTests-WithCustomSecurityContextHolderStrategy.xml

+2-1
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,8 @@
2424
http://www.springframework.org/schema/beans
2525
https://www.springframework.org/schema/beans/spring-beans.xsd">
2626

27-
<http auto-config="true" use-expressions="false" security-context-holder-strategy-ref="ref">
27+
<http auto-config="true" security-context-holder-strategy-ref="ref">
28+
<intercept-url pattern="/**" access="permitAll"/>
2829
</http>
2930

3031
<b:bean id="ref" class="org.mockito.Mockito" factory-method="spy">

Diff for: ‎config/src/test/resources/org/springframework/security/config/http/FormLoginConfigTests-WithDefaultTargetUrl.xml

+1-1
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@
2424
http://www.springframework.org/schema/beans
2525
https://www.springframework.org/schema/beans/spring-beans.xsd">
2626

27-
<http auto-config="true" use-expressions="false">
27+
<http auto-config="true" use-expressions="false" use-authorization-manager="false">
2828
<intercept-url pattern="/**" access="ROLE_USER"/>
2929
<form-login always-use-default-target="true" default-target-url="/default"/>
3030
</http>

Diff for: ‎config/src/test/resources/org/springframework/security/config/http/FormLoginConfigTests-WithSuccessAndFailureHandlers.xml

+1-1
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@
2424
http://www.springframework.org/schema/beans
2525
https://www.springframework.org/schema/beans/spring-beans.xsd">
2626

27-
<http auto-config="true" use-expressions="false" request-matcher="ant">
27+
<http auto-config="true" use-expressions="false" request-matcher="ant" use-authorization-manager="false">
2828
<intercept-url pattern="/**" access="ROLE_USER"/>
2929
<form-login authentication-success-handler-ref="fsh" authentication-failure-handler-ref="fsh"/>
3030
</http>

Diff for: ‎config/src/test/resources/org/springframework/security/config/http/FormLoginConfigTests-WithUsernameAndPasswordParameters.xml

+1-1
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@
2424
http://www.springframework.org/schema/beans
2525
https://www.springframework.org/schema/beans/spring-beans.xsd">
2626

27-
<http auto-config="true" use-expressions="false">
27+
<http auto-config="true" use-expressions="false" use-authorization-manager="false">
2828
<form-login username-parameter="xname" password-parameter="xpass"/>
2929
</http>
3030

Diff for: ‎config/src/test/resources/org/springframework/security/config/http/HttpConfigTests-Minimal.xml

+1-1
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@
2424
http://www.springframework.org/schema/beans
2525
https://www.springframework.org/schema/beans/spring-beans.xsd">
2626

27-
<http auto-config="true" use-expressions="false">
27+
<http auto-config="true" use-expressions="false" use-authorization-manager="false">
2828
<intercept-url pattern="/**" access="ROLE_USER"/>
2929
</http>
3030

Diff for: ‎config/src/test/resources/org/springframework/security/config/http/HttpConfigTests-MinimalAuthorizationManager.xml

+1-1
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@
2424
http://www.springframework.org/schema/beans
2525
https://www.springframework.org/schema/beans/spring-beans.xsd">
2626

27-
<http auto-config="true" use-authorization-manager="true">
27+
<http auto-config="true">
2828
<intercept-url pattern="/**" access="hasRole('USER')"/>
2929
</http>
3030

Diff for: ‎config/src/test/resources/org/springframework/security/config/http/HttpCorsConfigTests-RequiresMvc.xml

+1-1
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@
2525
https://www.springframework.org/schema/beans/spring-beans.xsd">
2626

2727

28-
<http auto-config="true" use-expressions="false">
28+
<http auto-config="true" use-expressions="false" use-authorization-manager="false">
2929
<cors/>
3030
</http>
3131
</b:beans>

Diff for: ‎config/src/test/resources/org/springframework/security/config/http/HttpHeadersConfigTests-CacheControlDisabled.xml

+1
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,7 @@
2828
<headers>
2929
<cache-control disabled="true"/>
3030
</headers>
31+
<intercept-url pattern="/**" access="permitAll"/>
3132
</http>
3233

3334
<b:bean name="simple" class="org.springframework.security.config.http.HttpHeadersConfigTests.SimpleController"/>

Diff for: ‎config/src/test/resources/org/springframework/security/config/http/HttpHeadersConfigTests-ContentSecurityPolicyWithEmptyDirectives.xml

+1-1
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@
2424
http://www.springframework.org/schema/beans
2525
https://www.springframework.org/schema/beans/spring-beans.xsd">
2626

27-
<http auto-config="true" use-expressions="false">
27+
<http auto-config="true" use-expressions="false" use-authorization-manager="false">
2828
<headers>
2929
<content-security-policy policy-directives=""/>
3030
</headers>

Diff for: ‎config/src/test/resources/org/springframework/security/config/http/HttpHeadersConfigTests-ContentSecurityPolicyWithPolicyDirectives.xml

+1-1
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@
2424
http://www.springframework.org/schema/beans
2525
https://www.springframework.org/schema/beans/spring-beans.xsd">
2626

27-
<http auto-config="true" use-expressions="false">
27+
<http auto-config="true" use-expressions="false" use-authorization-manager="false">
2828
<headers>
2929
<content-security-policy policy-directives="default-src 'self'"/>
3030
</headers>

Diff for: ‎config/src/test/resources/org/springframework/security/config/http/HttpHeadersConfigTests-ContentSecurityPolicyWithReportOnly.xml

+1-1
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@
2424
http://www.springframework.org/schema/beans
2525
https://www.springframework.org/schema/beans/spring-beans.xsd">
2626

27-
<http auto-config="true" use-expressions="false">
27+
<http auto-config="true" use-expressions="false" use-authorization-manager="false">
2828
<headers>
2929
<content-security-policy
3030
policy-directives="default-src https:; report-uri https://example.org/"

Diff for: ‎config/src/test/resources/org/springframework/security/config/http/HttpHeadersConfigTests-ContentTypeOptionsDisabled.xml

+1
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,7 @@
2828
<headers>
2929
<content-type-options disabled="true"/>
3030
</headers>
31+
<intercept-url pattern="/**" access="permitAll"/>
3132
</http>
3233

3334
<b:bean name="simple" class="org.springframework.security.config.http.HttpHeadersConfigTests.SimpleController"/>

Diff for: ‎config/src/test/resources/org/springframework/security/config/http/HttpHeadersConfigTests-DefaultConfig.xml

+3-1
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,9 @@
2424
http://www.springframework.org/schema/beans
2525
https://www.springframework.org/schema/beans/spring-beans.xsd">
2626

27-
<http auto-config="true"/>
27+
<http auto-config="true">
28+
<intercept-url pattern="/**" access="permitAll"/>
29+
</http>
2830

2931
<b:bean name="simple" class="org.springframework.security.config.http.HttpHeadersConfigTests.SimpleController"/>
3032

Diff for: ‎config/src/test/resources/org/springframework/security/config/http/HttpHeadersConfigTests-DefaultsDisabledWithCacheControl.xml

+1
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,7 @@
2828
<headers defaults-disabled="true">
2929
<cache-control/>
3030
</headers>
31+
<intercept-url pattern="/**" access="permitAll"/>
3132
</http>
3233

3334
<b:bean name="simple" class="org.springframework.security.config.http.HttpHeadersConfigTests.SimpleController"/>

Diff for: ‎config/src/test/resources/org/springframework/security/config/http/HttpHeadersConfigTests-DefaultsDisabledWithContentSecurityPolicy.xml

+1
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,7 @@
2828
<headers defaults-disabled="true">
2929
<content-security-policy policy-directives="default-src 'self'"/>
3030
</headers>
31+
<intercept-url pattern="/**" access="permitAll"/>
3132
</http>
3233

3334
<b:bean name="simple" class="org.springframework.security.config.http.HttpHeadersConfigTests.SimpleController"/>

0 commit comments

Comments
 (0)