Previously, RemoteDevToolsAutoConfiguration would try to configure
Spring Security if it was on the classpath. This led to a failure if
Spring Security was on the classpath but its auto-configuration was
disabled.
This commit updates the auto-configuration to be conditional on the
presence of Spring Security’s ObjectPostProcessor bean.
See gh-3889
Previously, if an app had Spring Security on the classpath the remote
devtools server would be secured using basic authentication. This
prevented RemoteSpringApplication from uploading changes to the server
as they would be rejected with a 401.
This commit updates RemoteDevToolsAutoConfiguration to allow anonymous
access to the remote server. CSRF protection is also disabled so that
POST requests without a CSRF token will be accepted.
Closes gh-3889
Since the meta-data now provide an explicit support for value hints, we
should not copy/paste them in the description as the IDE is able to
process them any way it wants.
Closes gh-3863
All the filters added explicitly by Spring Boot now have order <=
FilterRegistrationBean.REQUEST_WRAPPER_FILTER_MAX_ORDER (value 0).
There is nothing we can do about the DispatcherServlet and anything
else downstream of the filter chain.
Fixes gh-3613
Refine commit 8a96481 to set the web environment to false if spring web
is not available in the classpath. Thanks to @mjustin for spotting that
mistake.
Closes gh-3856
Previously, deployment tests were storing the container archives in the
default location (that is `/tmp`) for a total weight of 160MB. In case
the temp directory is cleaned on CI, these have to be downloaded again.
We're now configuring cargo to store these archives in the home directory
instead. This should improve the speed and the stability of the
deployment tests
Closes gh-3861
Spring HATEOAS 0.19.0.RELEASE provide support for resolving a link’s
title by looking up the key _links.$rel.title. For us to take advantage
of this in Spring Boot, HalHandlerInstantiator must be created using
the link relation message source that’s automatically created by
HateoasConfiguration.
Closes gh-3860
When the configuration property name is not resolved against
the target bean's property descriptors and the property name
is delimited by `underscore` instead of `dot`, then `RelaxedDataBinder`
doesn't bind those properties to the target if the property is
of type Map.
With thanks to @ilayaperumalg for the original PR.
Updated by @dsyer to recognize that the property is of type Map, rather
than blindly trying all combinations of property paths.
Fixes gh-3836
SpringApplication wrongly expects spring-web to be on the classpath to
figure out whether or not the web environment should be enabled for a
custom context class.
We now properly guard this check so that the web environment is not
enabled (read: not checked) if `spring-web` is not available.
Closes gh-3856
Phillip Webb
Andy Wilkinson
Stephane Nicoll
james
Barry Lagerweij
Tommy Ludwig
Dave Syer