Skip to content

Commit 35b2bca

Browse files
wilkinsonawilkinsona
committed
Merge branch 'gh-3703'
2 parents 9dec097 + 9066858 commit 35b2bca

File tree

4 files changed

+103
-17
lines changed

4 files changed

+103
-17
lines changed

‎spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/security/SecurityFilterAutoConfiguration.java

+59
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
/*
2+
* Copyright 2012-2015 the original author or authors.
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
package org.springframework.boot.autoconfigure.security;
17+
18+
import javax.servlet.Filter;
19+
20+
import org.springframework.beans.factory.annotation.Qualifier;
21+
import org.springframework.boot.autoconfigure.AutoConfigureAfter;
22+
import org.springframework.boot.autoconfigure.EnableAutoConfiguration;
23+
import org.springframework.boot.autoconfigure.condition.ConditionalOnBean;
24+
import org.springframework.boot.autoconfigure.condition.ConditionalOnWebApplication;
25+
import org.springframework.boot.context.embedded.FilterRegistrationBean;
26+
import org.springframework.boot.context.properties.EnableConfigurationProperties;
27+
import org.springframework.context.annotation.Bean;
28+
import org.springframework.context.annotation.Configuration;
29+
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfiguration;
30+
import org.springframework.security.web.context.AbstractSecurityWebApplicationInitializer;
31+
32+
/**
33+
* {@link EnableAutoConfiguration Auto-configuration} for Spring Security's Filter.
34+
* Configured separately from {@link SpringBootWebSecurityConfiguration} to ensure that
35+
* the filter's order is still configured when a user-provided
36+
* {@link WebSecurityConfiguration} exists.
37+
*
38+
* @author Rob Winch
39+
* @since 1.3
40+
*/
41+
@Configuration
42+
@ConditionalOnWebApplication
43+
@EnableConfigurationProperties
44+
@AutoConfigureAfter(SpringBootWebSecurityConfiguration.class)
45+
public class SecurityFilterAutoConfiguration {
46+
47+
@Bean
48+
@ConditionalOnBean(name = AbstractSecurityWebApplicationInitializer.DEFAULT_FILTER_NAME)
49+
public FilterRegistrationBean securityFilterChainRegistration(
50+
@Qualifier(AbstractSecurityWebApplicationInitializer.DEFAULT_FILTER_NAME) Filter securityFilter,
51+
SecurityProperties securityProperties) {
52+
FilterRegistrationBean registration = new FilterRegistrationBean(securityFilter);
53+
registration.setOrder(securityProperties.getFilterOrder());
54+
registration
55+
.setName(AbstractSecurityWebApplicationInitializer.DEFAULT_FILTER_NAME);
56+
return registration;
57+
}
58+
59+
}

‎spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/security/SpringBootWebSecurityConfiguration.java

-17
Original file line numberDiff line numberDiff line change
@@ -20,21 +20,17 @@
2020
import java.util.Arrays;
2121
import java.util.List;
2222

23-
import javax.servlet.Filter;
2423
import javax.servlet.http.HttpServletRequest;
2524

2625
import org.springframework.beans.factory.annotation.Autowired;
27-
import org.springframework.beans.factory.annotation.Qualifier;
2826
import org.springframework.boot.autoconfigure.EnableAutoConfiguration;
29-
import org.springframework.boot.autoconfigure.condition.ConditionalOnBean;
3027
import org.springframework.boot.autoconfigure.condition.ConditionalOnClass;
3128
import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean;
3229
import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
3330
import org.springframework.boot.autoconfigure.condition.ConditionalOnWebApplication;
3431
import org.springframework.boot.autoconfigure.security.SecurityProperties.Headers;
3532
import org.springframework.boot.autoconfigure.web.ErrorController;
3633
import org.springframework.boot.autoconfigure.web.ServerProperties;
37-
import org.springframework.boot.context.embedded.FilterRegistrationBean;
3834
import org.springframework.boot.context.properties.EnableConfigurationProperties;
3935
import org.springframework.context.annotation.Bean;
4036
import org.springframework.context.annotation.Configuration;
@@ -50,7 +46,6 @@
5046
import org.springframework.security.config.annotation.web.configurers.HeadersConfigurer;
5147
import org.springframework.security.web.AuthenticationEntryPoint;
5248
import org.springframework.security.web.authentication.www.BasicAuthenticationEntryPoint;
53-
import org.springframework.security.web.context.AbstractSecurityWebApplicationInitializer;
5449
import org.springframework.security.web.header.writers.HstsHeaderWriter;
5550
import org.springframework.security.web.util.matcher.AnyRequestMatcher;
5651
import org.springframework.security.web.util.matcher.RequestMatcher;
@@ -98,18 +93,6 @@ public IgnoredPathsWebSecurityConfigurerAdapter ignoredPathsWebSecurityConfigure
9893
return new IgnoredPathsWebSecurityConfigurerAdapter();
9994
}
10095

101-
@Bean
102-
@ConditionalOnBean(name = AbstractSecurityWebApplicationInitializer.DEFAULT_FILTER_NAME)
103-
public FilterRegistrationBean securityFilterChainRegistration(
104-
@Qualifier(AbstractSecurityWebApplicationInitializer.DEFAULT_FILTER_NAME) Filter securityFilter,
105-
SecurityProperties securityProperties) {
106-
FilterRegistrationBean registration = new FilterRegistrationBean(securityFilter);
107-
registration.setOrder(securityProperties.getFilterOrder());
108-
registration
109-
.setName(AbstractSecurityWebApplicationInitializer.DEFAULT_FILTER_NAME);
110-
return registration;
111-
}
112-
11396
public static void configureHeaders(HeadersConfigurer<?> configurer,
11497
SecurityProperties.Headers headers) throws Exception {
11598
if (headers.getHsts() != Headers.HSTS.NONE) {

‎spring-boot-autoconfigure/src/main/resources/META-INF/spring.factories

+1
Original file line numberDiff line numberDiff line change
@@ -56,6 +56,7 @@ org.springframework.boot.autoconfigure.orm.jpa.HibernateJpaAutoConfiguration,\
5656
org.springframework.boot.autoconfigure.reactor.ReactorAutoConfiguration,\
5757
org.springframework.boot.autoconfigure.redis.RedisAutoConfiguration,\
5858
org.springframework.boot.autoconfigure.security.SecurityAutoConfiguration,\
59+
org.springframework.boot.autoconfigure.security.SecurityFilterAutoConfiguration,\
5960
org.springframework.boot.autoconfigure.security.FallbackWebSecurityAutoConfiguration,\
6061
org.springframework.boot.autoconfigure.security.oauth2.OAuth2AutoConfiguration,\
6162
org.springframework.boot.autoconfigure.sendgrid.SendGridAutoConfiguration,\

‎spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/security/SecurityAutoConfigurationTests.java

+43
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,7 @@
3131
import org.springframework.boot.test.EnvironmentTestUtils;
3232
import org.springframework.context.ApplicationEvent;
3333
import org.springframework.context.ApplicationListener;
34+
import org.springframework.context.annotation.AnnotationConfigApplicationContext;
3435
import org.springframework.context.annotation.Bean;
3536
import org.springframework.context.annotation.Configuration;
3637
import org.springframework.core.annotation.Order;
@@ -45,6 +46,7 @@
4546
import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
4647
import org.springframework.security.config.annotation.authentication.configurers.GlobalAuthenticationConfigurerAdapter;
4748
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
49+
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
4850
import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
4951
import org.springframework.security.core.Authentication;
5052
import org.springframework.security.core.AuthenticationException;
@@ -55,6 +57,7 @@
5557
import org.springframework.web.context.support.AnnotationConfigWebApplicationContext;
5658

5759
import static org.junit.Assert.assertEquals;
60+
import static org.junit.Assert.assertFalse;
5861
import static org.junit.Assert.assertNotNull;
5962
import static org.junit.Assert.assertTrue;
6063
import static org.junit.Assert.fail;
@@ -63,6 +66,7 @@
6366
* Tests for {@link SecurityAutoConfiguration}.
6467
*
6568
* @author Dave Syer
69+
* @author Rob Winch
6670
*/
6771
public class SecurityAutoConfigurationTests {
6872

@@ -90,11 +94,43 @@ public void testWebConfiguration() throws Exception {
9094
assertEquals(5, filterChains.size());
9195
}
9296

97+
@Test
98+
public void testDefaultFilterOrderWithSecurityAdapter() throws Exception {
99+
this.context = new AnnotationConfigWebApplicationContext();
100+
this.context.setServletContext(new MockServletContext());
101+
this.context.register(WebSecurity.class, SecurityAutoConfiguration.class,
102+
SecurityFilterAutoConfiguration.class,
103+
ServerPropertiesAutoConfiguration.class,
104+
PropertyPlaceholderAutoConfiguration.class);
105+
this.context.refresh();
106+
assertEquals(
107+
0,
108+
this.context.getBean("securityFilterChainRegistration",
109+
FilterRegistrationBean.class).getOrder());
110+
}
111+
112+
@Test
113+
public void testFilterIsNotRegisteredInNonWeb() throws Exception {
114+
AnnotationConfigApplicationContext context = new AnnotationConfigApplicationContext();
115+
context.register(SecurityAutoConfiguration.class,
116+
SecurityFilterAutoConfiguration.class,
117+
ServerPropertiesAutoConfiguration.class,
118+
PropertyPlaceholderAutoConfiguration.class);
119+
try {
120+
context.refresh();
121+
assertFalse(context.containsBean("securityFilterChainRegistration"));
122+
}
123+
finally {
124+
context.close();
125+
}
126+
}
127+
93128
@Test
94129
public void testDefaultFilterOrder() throws Exception {
95130
this.context = new AnnotationConfigWebApplicationContext();
96131
this.context.setServletContext(new MockServletContext());
97132
this.context.register(SecurityAutoConfiguration.class,
133+
SecurityFilterAutoConfiguration.class,
98134
ServerPropertiesAutoConfiguration.class,
99135
PropertyPlaceholderAutoConfiguration.class);
100136
this.context.refresh();
@@ -110,6 +146,7 @@ public void testCustomFilterOrder() throws Exception {
110146
EnvironmentTestUtils.addEnvironment(this.context, "security.filter-order:12345");
111147
this.context.setServletContext(new MockServletContext());
112148
this.context.register(SecurityAutoConfiguration.class,
149+
SecurityFilterAutoConfiguration.class,
113150
ServerPropertiesAutoConfiguration.class,
114151
PropertyPlaceholderAutoConfiguration.class);
115152
this.context.refresh();
@@ -411,4 +448,10 @@ public UserDetailsService getUserDetails() {
411448

412449
}
413450

451+
@Configuration
452+
@EnableWebSecurity
453+
static class WebSecurity extends WebSecurityConfigurerAdapter {
454+
455+
}
456+
414457
}

0 commit comments

Comments
 (0)