Skip to content

Commit 3e59aba

Browse files
frederikzfrederikz
committed
use same request macther in configurer and filter
1 parent 39eb574 commit 3e59aba

File tree

31 files changed

+355
-193
lines changed

31 files changed

+355
-193
lines changed

‎oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/config/annotation/web/configurers/OAuth2AuthorizationEndpointConfigurer.java

+10-20
Original file line numberDiff line numberDiff line change
@@ -19,9 +19,6 @@
1919
import java.util.List;
2020
import java.util.function.Consumer;
2121

22-
import jakarta.servlet.http.HttpServletRequest;
23-
24-
import org.springframework.http.HttpMethod;
2522
import org.springframework.security.authentication.AuthenticationManager;
2623
import org.springframework.security.authentication.AuthenticationProvider;
2724
import org.springframework.security.config.annotation.ObjectPostProcessor;
@@ -45,12 +42,12 @@
4542
import org.springframework.security.web.authentication.AuthenticationSuccessHandler;
4643
import org.springframework.security.web.authentication.preauth.AbstractPreAuthenticatedProcessingFilter;
4744
import org.springframework.security.web.authentication.session.SessionAuthenticationStrategy;
48-
import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
49-
import org.springframework.security.web.util.matcher.OrRequestMatcher;
5045
import org.springframework.security.web.util.matcher.RequestMatcher;
5146
import org.springframework.util.Assert;
5247
import org.springframework.util.StringUtils;
5348

49+
import jakarta.servlet.http.HttpServletRequest;
50+
5451
/**
5552
* Configurer for the OAuth 2.0 Authorization Endpoint.
5653
*
@@ -208,33 +205,26 @@ void setSessionAuthenticationStrategy(SessionAuthenticationStrategy sessionAuthe
208205

209206
@Override
210207
void init(HttpSecurity httpSecurity) {
211-
AuthorizationServerSettings authorizationServerSettings = OAuth2ConfigurerUtils.getAuthorizationServerSettings(httpSecurity);
212-
this.requestMatcher = new OrRequestMatcher(
213-
new AntPathRequestMatcher(
214-
authorizationServerSettings.getAuthorizationEndpoint(),
215-
HttpMethod.GET.name()),
216-
new AntPathRequestMatcher(
217-
authorizationServerSettings.getAuthorizationEndpoint(),
218-
HttpMethod.POST.name()));
208+
AuthorizationServerSettings authorizationServerSettings = OAuth2ConfigurerUtils
209+
.getAuthorizationServerSettings(httpSecurity);
210+
this.requestMatcher = OAuth2AuthorizationEndpointFilter
211+
.createDefaultRequestMatcher(authorizationServerSettings.getAuthorizationEndpoint());
219212

220213
List<AuthenticationProvider> authenticationProviders = createDefaultAuthenticationProviders(httpSecurity);
221214
if (!this.authenticationProviders.isEmpty()) {
222215
authenticationProviders.addAll(0, this.authenticationProviders);
223216
}
224217
this.authenticationProvidersConsumer.accept(authenticationProviders);
225-
authenticationProviders.forEach(authenticationProvider ->
226-
httpSecurity.authenticationProvider(postProcess(authenticationProvider)));
218+
authenticationProviders.forEach(
219+
authenticationProvider -> httpSecurity.authenticationProvider(postProcess(authenticationProvider)));
227220
}
228221

229222
@Override
230223
void configure(HttpSecurity httpSecurity) {
231224
AuthenticationManager authenticationManager = httpSecurity.getSharedObject(AuthenticationManager.class);
232-
AuthorizationServerSettings authorizationServerSettings = OAuth2ConfigurerUtils.getAuthorizationServerSettings(httpSecurity);
233225

234-
OAuth2AuthorizationEndpointFilter authorizationEndpointFilter =
235-
new OAuth2AuthorizationEndpointFilter(
236-
authenticationManager,
237-
authorizationServerSettings.getAuthorizationEndpoint());
226+
OAuth2AuthorizationEndpointFilter authorizationEndpointFilter = new OAuth2AuthorizationEndpointFilter(
227+
authenticationManager, getRequestMatcher());
238228
List<AuthenticationConverter> authenticationConverters = createDefaultAuthenticationConverters();
239229
if (!this.authorizationRequestConverters.isEmpty()) {
240230
authenticationConverters.addAll(0, this.authorizationRequestConverters);

‎oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/config/annotation/web/configurers/OAuth2AuthorizationServerMetadataEndpointConfigurer.java

+3-6
Original file line numberDiff line numberDiff line change
@@ -17,13 +17,11 @@
1717

1818
import java.util.function.Consumer;
1919

20-
import org.springframework.http.HttpMethod;
2120
import org.springframework.security.config.annotation.ObjectPostProcessor;
2221
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
2322
import org.springframework.security.oauth2.server.authorization.OAuth2AuthorizationServerMetadata;
2423
import org.springframework.security.oauth2.server.authorization.web.OAuth2AuthorizationServerMetadataEndpointFilter;
2524
import org.springframework.security.web.authentication.preauth.AbstractPreAuthenticatedProcessingFilter;
26-
import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
2725
import org.springframework.security.web.util.matcher.RequestMatcher;
2826

2927
/**
@@ -69,14 +67,13 @@ void addDefaultAuthorizationServerMetadataCustomizer(
6967

7068
@Override
7169
void init(HttpSecurity httpSecurity) {
72-
this.requestMatcher = new AntPathRequestMatcher(
73-
"/.well-known/oauth-authorization-server", HttpMethod.GET.name());
70+
this.requestMatcher = OAuth2AuthorizationServerMetadataEndpointFilter.createDefaultRequestMatcher();
7471
}
7572

7673
@Override
7774
void configure(HttpSecurity httpSecurity) {
78-
OAuth2AuthorizationServerMetadataEndpointFilter authorizationServerMetadataEndpointFilter =
79-
new OAuth2AuthorizationServerMetadataEndpointFilter();
75+
OAuth2AuthorizationServerMetadataEndpointFilter authorizationServerMetadataEndpointFilter = new OAuth2AuthorizationServerMetadataEndpointFilter(
76+
getRequestMatcher());
8077
Consumer<OAuth2AuthorizationServerMetadata.Builder> authorizationServerMetadataCustomizer = getAuthorizationServerMetadataCustomizer();
8178
if (authorizationServerMetadataCustomizer != null) {
8279
authorizationServerMetadataEndpointFilter.setAuthorizationServerMetadataCustomizer(authorizationServerMetadataCustomizer);

‎oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/config/annotation/web/configurers/OAuth2ClientAuthenticationConfigurer.java

+1-1
Original file line numberDiff line numberDiff line change
@@ -186,7 +186,7 @@ void init(HttpSecurity httpSecurity) {
186186
void configure(HttpSecurity httpSecurity) {
187187
AuthenticationManager authenticationManager = httpSecurity.getSharedObject(AuthenticationManager.class);
188188
OAuth2ClientAuthenticationFilter clientAuthenticationFilter = new OAuth2ClientAuthenticationFilter(
189-
authenticationManager, this.requestMatcher);
189+
authenticationManager, getRequestMatcher());
190190
List<AuthenticationConverter> authenticationConverters = createDefaultAuthenticationConverters();
191191
if (!this.authenticationConverters.isEmpty()) {
192192
authenticationConverters.addAll(0, this.authenticationConverters);

‎oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/config/annotation/web/configurers/OAuth2DeviceAuthorizationEndpointConfigurer.java

+6-10
Original file line numberDiff line numberDiff line change
@@ -19,9 +19,6 @@
1919
import java.util.List;
2020
import java.util.function.Consumer;
2121

22-
import jakarta.servlet.http.HttpServletRequest;
23-
24-
import org.springframework.http.HttpMethod;
2522
import org.springframework.security.authentication.AuthenticationManager;
2623
import org.springframework.security.authentication.AuthenticationProvider;
2724
import org.springframework.security.config.annotation.ObjectPostProcessor;
@@ -40,11 +37,12 @@
4037
import org.springframework.security.web.authentication.AuthenticationConverter;
4138
import org.springframework.security.web.authentication.AuthenticationFailureHandler;
4239
import org.springframework.security.web.authentication.AuthenticationSuccessHandler;
43-
import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
4440
import org.springframework.security.web.util.matcher.RequestMatcher;
4541
import org.springframework.util.Assert;
4642
import org.springframework.util.StringUtils;
4743

44+
import jakarta.servlet.http.HttpServletRequest;
45+
4846
/**
4947
* Configurer for the OAuth 2.0 Device Authorization Endpoint.
5048
*
@@ -165,8 +163,8 @@ public OAuth2DeviceAuthorizationEndpointConfigurer verificationUri(String verifi
165163
public void init(HttpSecurity builder) {
166164
AuthorizationServerSettings authorizationServerSettings =
167165
OAuth2ConfigurerUtils.getAuthorizationServerSettings(builder);
168-
this.requestMatcher = new AntPathRequestMatcher(
169-
authorizationServerSettings.getDeviceAuthorizationEndpoint(), HttpMethod.POST.name());
166+
this.requestMatcher = OAuth2DeviceAuthorizationEndpointFilter
167+
.createDefaultRequestMatcher(authorizationServerSettings.getDeviceAuthorizationEndpoint());
170168

171169
List<AuthenticationProvider> authenticationProviders = createDefaultAuthenticationProviders(builder);
172170
if (!this.authenticationProviders.isEmpty()) {
@@ -180,11 +178,9 @@ public void init(HttpSecurity builder) {
180178
@Override
181179
public void configure(HttpSecurity builder) {
182180
AuthenticationManager authenticationManager = builder.getSharedObject(AuthenticationManager.class);
183-
AuthorizationServerSettings authorizationServerSettings = OAuth2ConfigurerUtils.getAuthorizationServerSettings(builder);
184181

185-
OAuth2DeviceAuthorizationEndpointFilter deviceAuthorizationEndpointFilter =
186-
new OAuth2DeviceAuthorizationEndpointFilter(
187-
authenticationManager, authorizationServerSettings.getDeviceAuthorizationEndpoint());
182+
OAuth2DeviceAuthorizationEndpointFilter deviceAuthorizationEndpointFilter = new OAuth2DeviceAuthorizationEndpointFilter(
183+
authenticationManager, getRequestMatcher());
188184

189185
List<AuthenticationConverter> authenticationConverters = createDefaultAuthenticationConverters();
190186
if (!this.deviceAuthorizationRequestConverters.isEmpty()) {

‎oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/config/annotation/web/configurers/OAuth2DeviceVerificationEndpointConfigurer.java

+6-18
Original file line numberDiff line numberDiff line change
@@ -19,9 +19,6 @@
1919
import java.util.List;
2020
import java.util.function.Consumer;
2121

22-
import jakarta.servlet.http.HttpServletRequest;
23-
24-
import org.springframework.http.HttpMethod;
2522
import org.springframework.security.authentication.AuthenticationManager;
2623
import org.springframework.security.authentication.AuthenticationProvider;
2724
import org.springframework.security.config.annotation.ObjectPostProcessor;
@@ -44,12 +41,12 @@
4441
import org.springframework.security.web.authentication.AuthenticationFailureHandler;
4542
import org.springframework.security.web.authentication.AuthenticationSuccessHandler;
4643
import org.springframework.security.web.authentication.preauth.AbstractPreAuthenticatedProcessingFilter;
47-
import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
48-
import org.springframework.security.web.util.matcher.OrRequestMatcher;
4944
import org.springframework.security.web.util.matcher.RequestMatcher;
5045
import org.springframework.util.Assert;
5146
import org.springframework.util.StringUtils;
5247

48+
import jakarta.servlet.http.HttpServletRequest;
49+
5350
/**
5451
* Configurer for the OAuth 2.0 Device Verification Endpoint.
5552
*
@@ -195,13 +192,8 @@ public OAuth2DeviceVerificationEndpointConfigurer consentPage(String consentPage
195192
public void init(HttpSecurity builder) {
196193
AuthorizationServerSettings authorizationServerSettings =
197194
OAuth2ConfigurerUtils.getAuthorizationServerSettings(builder);
198-
this.requestMatcher = new OrRequestMatcher(
199-
new AntPathRequestMatcher(
200-
authorizationServerSettings.getDeviceVerificationEndpoint(),
201-
HttpMethod.GET.name()),
202-
new AntPathRequestMatcher(
203-
authorizationServerSettings.getDeviceVerificationEndpoint(),
204-
HttpMethod.POST.name()));
195+
this.requestMatcher = OAuth2DeviceVerificationEndpointFilter
196+
.createDefaultRequestMatcher(authorizationServerSettings.getDeviceVerificationEndpoint());
205197

206198
List<AuthenticationProvider> authenticationProviders = createDefaultAuthenticationProviders(builder);
207199
if (!this.authenticationProviders.isEmpty()) {
@@ -215,13 +207,9 @@ public void init(HttpSecurity builder) {
215207
@Override
216208
public void configure(HttpSecurity builder) {
217209
AuthenticationManager authenticationManager = builder.getSharedObject(AuthenticationManager.class);
218-
AuthorizationServerSettings authorizationServerSettings =
219-
OAuth2ConfigurerUtils.getAuthorizationServerSettings(builder);
220210

221-
OAuth2DeviceVerificationEndpointFilter deviceVerificationEndpointFilter =
222-
new OAuth2DeviceVerificationEndpointFilter(
223-
authenticationManager,
224-
authorizationServerSettings.getDeviceVerificationEndpoint());
211+
OAuth2DeviceVerificationEndpointFilter deviceVerificationEndpointFilter = new OAuth2DeviceVerificationEndpointFilter(
212+
authenticationManager, getRequestMatcher());
225213
List<AuthenticationConverter> authenticationConverters = createDefaultAuthenticationConverters();
226214
if (!this.deviceVerificationRequestConverters.isEmpty()) {
227215
authenticationConverters.addAll(0, this.deviceVerificationRequestConverters);

‎oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/config/annotation/web/configurers/OAuth2TokenEndpointConfigurer.java

+5-11
Original file line numberDiff line numberDiff line change
@@ -19,9 +19,6 @@
1919
import java.util.List;
2020
import java.util.function.Consumer;
2121

22-
import jakarta.servlet.http.HttpServletRequest;
23-
24-
import org.springframework.http.HttpMethod;
2522
import org.springframework.security.authentication.AuthenticationManager;
2623
import org.springframework.security.authentication.AuthenticationProvider;
2724
import org.springframework.security.config.annotation.ObjectPostProcessor;
@@ -50,10 +47,11 @@
5047
import org.springframework.security.web.authentication.AuthenticationConverter;
5148
import org.springframework.security.web.authentication.AuthenticationFailureHandler;
5249
import org.springframework.security.web.authentication.AuthenticationSuccessHandler;
53-
import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
5450
import org.springframework.security.web.util.matcher.RequestMatcher;
5551
import org.springframework.util.Assert;
5652

53+
import jakarta.servlet.http.HttpServletRequest;
54+
5755
/**
5856
* Configurer for the OAuth 2.0 Token Endpoint.
5957
*
@@ -162,8 +160,7 @@ public OAuth2TokenEndpointConfigurer errorResponseHandler(AuthenticationFailureH
162160
@Override
163161
void init(HttpSecurity httpSecurity) {
164162
AuthorizationServerSettings authorizationServerSettings = OAuth2ConfigurerUtils.getAuthorizationServerSettings(httpSecurity);
165-
this.requestMatcher = new AntPathRequestMatcher(
166-
authorizationServerSettings.getTokenEndpoint(), HttpMethod.POST.name());
163+
this.requestMatcher = OAuth2TokenEndpointFilter.createDefaultRequestMatcher(authorizationServerSettings.getTokenEndpoint());
167164

168165
List<AuthenticationProvider> authenticationProviders = createDefaultAuthenticationProviders(httpSecurity);
169166
if (!this.authenticationProviders.isEmpty()) {
@@ -177,12 +174,9 @@ void init(HttpSecurity httpSecurity) {
177174
@Override
178175
void configure(HttpSecurity httpSecurity) {
179176
AuthenticationManager authenticationManager = httpSecurity.getSharedObject(AuthenticationManager.class);
180-
AuthorizationServerSettings authorizationServerSettings = OAuth2ConfigurerUtils.getAuthorizationServerSettings(httpSecurity);
181177

182-
OAuth2TokenEndpointFilter tokenEndpointFilter =
183-
new OAuth2TokenEndpointFilter(
184-
authenticationManager,
185-
authorizationServerSettings.getTokenEndpoint());
178+
OAuth2TokenEndpointFilter tokenEndpointFilter = new OAuth2TokenEndpointFilter(authenticationManager,
179+
getRequestMatcher());
186180
List<AuthenticationConverter> authenticationConverters = createDefaultAuthenticationConverters();
187181
if (!this.accessTokenRequestConverters.isEmpty()) {
188182
authenticationConverters.addAll(0, this.accessTokenRequestConverters);

‎oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/config/annotation/web/configurers/OAuth2TokenIntrospectionEndpointConfigurer.java

+6-10
Original file line numberDiff line numberDiff line change
@@ -19,9 +19,6 @@
1919
import java.util.List;
2020
import java.util.function.Consumer;
2121

22-
import jakarta.servlet.http.HttpServletRequest;
23-
24-
import org.springframework.http.HttpMethod;
2522
import org.springframework.security.authentication.AuthenticationManager;
2623
import org.springframework.security.authentication.AuthenticationProvider;
2724
import org.springframework.security.config.Customizer;
@@ -39,10 +36,11 @@
3936
import org.springframework.security.web.authentication.AuthenticationConverter;
4037
import org.springframework.security.web.authentication.AuthenticationFailureHandler;
4138
import org.springframework.security.web.authentication.AuthenticationSuccessHandler;
42-
import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
4339
import org.springframework.security.web.util.matcher.RequestMatcher;
4440
import org.springframework.util.Assert;
4541

42+
import jakarta.servlet.http.HttpServletRequest;
43+
4644
/**
4745
* Configurer for the OAuth 2.0 Token Introspection Endpoint.
4846
*
@@ -151,8 +149,8 @@ public OAuth2TokenIntrospectionEndpointConfigurer errorResponseHandler(Authentic
151149
@Override
152150
void init(HttpSecurity httpSecurity) {
153151
AuthorizationServerSettings authorizationServerSettings = OAuth2ConfigurerUtils.getAuthorizationServerSettings(httpSecurity);
154-
this.requestMatcher = new AntPathRequestMatcher(
155-
authorizationServerSettings.getTokenIntrospectionEndpoint(), HttpMethod.POST.name());
152+
this.requestMatcher = OAuth2TokenIntrospectionEndpointFilter
153+
.createDefaultRequestMatcher(authorizationServerSettings.getTokenIntrospectionEndpoint());
156154

157155
List<AuthenticationProvider> authenticationProviders = createDefaultAuthenticationProviders(httpSecurity);
158156
if (!this.authenticationProviders.isEmpty()) {
@@ -166,11 +164,9 @@ void init(HttpSecurity httpSecurity) {
166164
@Override
167165
void configure(HttpSecurity httpSecurity) {
168166
AuthenticationManager authenticationManager = httpSecurity.getSharedObject(AuthenticationManager.class);
169-
AuthorizationServerSettings authorizationServerSettings = OAuth2ConfigurerUtils.getAuthorizationServerSettings(httpSecurity);
170167

171-
OAuth2TokenIntrospectionEndpointFilter introspectionEndpointFilter =
172-
new OAuth2TokenIntrospectionEndpointFilter(
173-
authenticationManager, authorizationServerSettings.getTokenIntrospectionEndpoint());
168+
OAuth2TokenIntrospectionEndpointFilter introspectionEndpointFilter = new OAuth2TokenIntrospectionEndpointFilter(
169+
authenticationManager, getRequestMatcher());
174170
List<AuthenticationConverter> authenticationConverters = createDefaultAuthenticationConverters();
175171
if (!this.introspectionRequestConverters.isEmpty()) {
176172
authenticationConverters.addAll(0, this.introspectionRequestConverters);

‎oauth2-authorization-server/src/main/java/org/springframework/security/oauth2/server/authorization/config/annotation/web/configurers/OAuth2TokenRevocationEndpointConfigurer.java

+6-10
Original file line numberDiff line numberDiff line change
@@ -19,9 +19,6 @@
1919
import java.util.List;
2020
import java.util.function.Consumer;
2121

22-
import jakarta.servlet.http.HttpServletRequest;
23-
24-
import org.springframework.http.HttpMethod;
2522
import org.springframework.security.authentication.AuthenticationManager;
2623
import org.springframework.security.authentication.AuthenticationProvider;
2724
import org.springframework.security.config.annotation.ObjectPostProcessor;
@@ -38,10 +35,11 @@
3835
import org.springframework.security.web.authentication.AuthenticationConverter;
3936
import org.springframework.security.web.authentication.AuthenticationFailureHandler;
4037
import org.springframework.security.web.authentication.AuthenticationSuccessHandler;
41-
import org.springframework.security.web.util.matcher.AntPathRequestMatcher;
4238
import org.springframework.security.web.util.matcher.RequestMatcher;
4339
import org.springframework.util.Assert;
4440

41+
import jakarta.servlet.http.HttpServletRequest;
42+
4543
/**
4644
* Configurer for the OAuth 2.0 Token Revocation Endpoint.
4745
*
@@ -150,8 +148,8 @@ public OAuth2TokenRevocationEndpointConfigurer errorResponseHandler(Authenticati
150148
@Override
151149
void init(HttpSecurity httpSecurity) {
152150
AuthorizationServerSettings authorizationServerSettings = OAuth2ConfigurerUtils.getAuthorizationServerSettings(httpSecurity);
153-
this.requestMatcher = new AntPathRequestMatcher(
154-
authorizationServerSettings.getTokenRevocationEndpoint(), HttpMethod.POST.name());
151+
this.requestMatcher = OAuth2TokenRevocationEndpointFilter
152+
.createDefaultRequestMatcher(authorizationServerSettings.getTokenRevocationEndpoint());
155153

156154
List<AuthenticationProvider> authenticationProviders = createDefaultAuthenticationProviders(httpSecurity);
157155
if (!this.authenticationProviders.isEmpty()) {
@@ -165,11 +163,9 @@ void init(HttpSecurity httpSecurity) {
165163
@Override
166164
void configure(HttpSecurity httpSecurity) {
167165
AuthenticationManager authenticationManager = httpSecurity.getSharedObject(AuthenticationManager.class);
168-
AuthorizationServerSettings authorizationServerSettings = OAuth2ConfigurerUtils.getAuthorizationServerSettings(httpSecurity);
169166

170-
OAuth2TokenRevocationEndpointFilter revocationEndpointFilter =
171-
new OAuth2TokenRevocationEndpointFilter(
172-
authenticationManager, authorizationServerSettings.getTokenRevocationEndpoint());
167+
OAuth2TokenRevocationEndpointFilter revocationEndpointFilter = new OAuth2TokenRevocationEndpointFilter(
168+
authenticationManager, getRequestMatcher());
173169
List<AuthenticationConverter> authenticationConverters = createDefaultAuthenticationConverters();
174170
if (!this.revocationRequestConverters.isEmpty()) {
175171
authenticationConverters.addAll(0, this.revocationRequestConverters);

0 commit comments

Comments
 (0)