FilterSecurityInterceptor applies to every request by default #11466
Assignees
Labels
in: web
An issue in web modules (web, webmvc)
type: breaks-passivity
A change that breaks passivity with the previous release
type: enhancement
A general enhancement
Milestone
Comments
marcusdacoregio
added
in: web
3 tasks
marcusdacoregio
changed the title
marcusdacoregio
added
the
type: breaks-passivity
wilkinsona
added a commit
to spring-projects/spring-boot
that referenced
this issue
Jul 13, 2022
Spring Security now filters every dispatch by default and not only once-per-request. Security configuration has been updated in a number of places to restore the old behavior as needed for the tests to pass. gh-31703 has been opened to review this and to investigate if we can now remove the error page security filter and rely on the filtering of every dispatch instead. In addition to switching to once-per-request filtering where needed, this commit also restructures the configuration of the error page security filter. The restructuring was necessary to ensure that the privilege evaluator bean has been defined before the conditions on the error page security filter are evaluated. Without the change, the filter was no longer being configured as the privilege evaluator hadn't been defined before the on bean condition was evaluated. We may want to back port this change as the ordering doesn't appear to have been defined before and we were just getting lucky. See gh-31622 See spring-projects/spring-security#11466
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
The new
AuthorizationFilterthat supersedes theFilterSecurityInterceptorapplies to every dispatcher type. We should align the behavior between the filters. This will also allow the Spring Boot to remove theErrorPageSecurityFilter#10919.The text was updated successfully, but these errors were encountered: