7 Commits (816728186abea0cf85bab0d12ddc448f9f6f42bd)

Author	SHA1	Message	Date
Andy Wilkinson	48f8021d88	Migrate @Local*Port annotations to spring-boot-test ... Closes gh-29589	3 years ago
Madhura Bhave	3460c24a16	Ignore context path when calling privilege evaluator ... Previously, the error page security filter passed the request's URI to the privilege evaluator. This was incorrect in applications with a custom context path as the privilege evaluator must be passed a path that does not include the context path and the request URI includes the context path. This commit updates the filter to use UrlPathHelper's pathWithinApplication instead. The path within the application does not include the context path. In addition, pathWithinAppliation also correctly handles applications configured with a servlet mapping other than the default of /. Closes gh-29299 Co-Authored-By: Andy Wilkinson <wilkinsona@vmware.com>	3 years ago
Madhura Bhave	d9d161cd6b	Allow previously authorized users to access the error page ... Prior to this commit, the `ErrorPageSecurityFilter` verified if access to the error page was allowed by invoking the `WebInvocationPrivilegeEvaluator` with the Authentication from the `SecurityContextHolder`. This meant that access to the error page was denied for a `null` Authentication or `AnonymousAuthenticationToken` in cases where the error page required authenticated access. This prevented authorized users from accessing the error page in case the Authentication wasn't retrievable for the error dispatch, which is the case for `@Transient` authentication or stateless session policy. This commit updates the `ErrorPageSecurityFilter` to check access to the error page only if the error is an authn or authz error in cases where an authentication object is not found in the SecurityContextHolder. This makes the error response consistent when bad credentials or no credentials are used while also allowing access to previously authorized users. Fixes gh-28953	3 years ago
Scott Frederick	4eed637481	Merge branch '2.5.x' ... Closes gh-28789	3 years ago
Scott Frederick	12244a8edd	Remove use of Thymeleaf from smoke tests ... Closes gh-28788	3 years ago
Madhura Bhave	dd1d1482dc	Deny unauthorized access to the error page ... Fixes gh-26356 Co-authored-by Andy Wilkinson <wilkinsona@vmware.com>	3 years ago
Madhura Bhave	d9466f5659	Move smoke tests under spring-boot-test ... See gh-17393	5 years ago