From 646ee9b266220a9b612cbaf1619533972dbd85b3 Mon Sep 17 00:00:00 2001 From: Josh Cummings Date: Mon, 16 Jul 2018 13:21:24 -0600 Subject: [PATCH] Add Bearer Token filter to Security Filters This introduces BearerTokenAuthenticationFilter to SecurityFilters so that it can be used in the various addFilter methods and with the `custom-filter` xml tag. Fixes: gh-5479 --- .../security/config/annotation/web/HttpSecurityBuilder.java | 1 + .../config/annotation/web/builders/FilterComparator.java | 4 +++- .../server/resource/OAuth2ResourceServerConfigurer.java | 3 +-- .../springframework/security/config/http/SecurityFilters.java | 1 + .../springframework/security/config/spring-security-5.1.rnc | 2 +- .../springframework/security/config/spring-security-5.1.xsd | 1 + 6 files changed, 8 insertions(+), 4 deletions(-) diff --git a/config/src/main/java/org/springframework/security/config/annotation/web/HttpSecurityBuilder.java b/config/src/main/java/org/springframework/security/config/annotation/web/HttpSecurityBuilder.java index 0e4ff7e6f76..bdd1fe911e6 100644 --- a/config/src/main/java/org/springframework/security/config/annotation/web/HttpSecurityBuilder.java +++ b/config/src/main/java/org/springframework/security/config/annotation/web/HttpSecurityBuilder.java @@ -149,6 +149,7 @@ > C removeConfigurer *
  • {@link org.springframework.security.web.authentication.ui.DefaultLogoutPageGeneratingFilter}
    • *
  • {@link ConcurrentSessionFilter}
    • *
  • {@link DigestAuthenticationFilter}
    • + *
  • {@link org.springframework.security.oauth2.server.resource.web.BearerTokenAuthenticationFilter}
    • *
  • {@link BasicAuthenticationFilter}
    • *
  • {@link RequestCacheAwareFilter}
    • *
  • {@link SecurityContextHolderAwareRequestFilter}
    • diff --git a/config/src/main/java/org/springframework/security/config/annotation/web/builders/FilterComparator.java b/config/src/main/java/org/springframework/security/config/annotation/web/builders/FilterComparator.java index ebc1a22715a..7c1fb68c1f0 100644 --- a/config/src/main/java/org/springframework/security/config/annotation/web/builders/FilterComparator.java +++ b/config/src/main/java/org/springframework/security/config/annotation/web/builders/FilterComparator.java @@ -19,7 +19,6 @@ import java.util.Comparator; import java.util.HashMap; import java.util.Map; - import javax.servlet.Filter; import org.springframework.security.web.access.ExceptionTranslationFilter; @@ -108,6 +107,9 @@ final class FilterComparator implements Comparator, Serializable { order += STEP; put(DigestAuthenticationFilter.class, order); order += STEP; + filterToOrder.put( + "org.springframework.security.oauth2.server.resource.web.BearerTokenAuthenticationFilter", order); + order += STEP; put(BasicAuthenticationFilter.class, order); order += STEP; put(RequestCacheAwareFilter.class, order); diff --git a/config/src/main/java/org/springframework/security/config/annotation/web/configurers/oauth2/server/resource/OAuth2ResourceServerConfigurer.java b/config/src/main/java/org/springframework/security/config/annotation/web/configurers/oauth2/server/resource/OAuth2ResourceServerConfigurer.java index faba20fa3e9..de610cfa590 100644 --- a/config/src/main/java/org/springframework/security/config/annotation/web/configurers/oauth2/server/resource/OAuth2ResourceServerConfigurer.java +++ b/config/src/main/java/org/springframework/security/config/annotation/web/configurers/oauth2/server/resource/OAuth2ResourceServerConfigurer.java @@ -33,7 +33,6 @@ import org.springframework.security.oauth2.server.resource.web.BearerTokenResolver; import org.springframework.security.oauth2.server.resource.web.DefaultBearerTokenResolver; import org.springframework.security.oauth2.server.resource.web.access.BearerTokenAccessDeniedHandler; -import org.springframework.security.web.authentication.www.BasicAuthenticationFilter; import org.springframework.security.web.util.matcher.RequestMatcher; import org.springframework.util.Assert; @@ -132,7 +131,7 @@ public void configure(H http) throws Exception { filter.setBearerTokenResolver(bearerTokenResolver); filter = postProcess(filter); - http.addFilterBefore(filter, BasicAuthenticationFilter.class); + http.addFilter(filter); JwtDecoder decoder = this.jwtConfigurer.getJwtDecoder(); diff --git a/config/src/main/java/org/springframework/security/config/http/SecurityFilters.java b/config/src/main/java/org/springframework/security/config/http/SecurityFilters.java index 1b84ecace48..516cf31cfc8 100644 --- a/config/src/main/java/org/springframework/security/config/http/SecurityFilters.java +++ b/config/src/main/java/org/springframework/security/config/http/SecurityFilters.java @@ -42,6 +42,7 @@ enum SecurityFilters { LOGIN_PAGE_FILTER, LOGOUT_PAGE_FILTER, DIGEST_AUTH_FILTER, + BEARER_TOKEN_AUTH_FILTER, BASIC_AUTH_FILTER, REQUEST_CACHE_FILTER, SERVLET_API_SUPPORT_FILTER, diff --git a/config/src/main/resources/org/springframework/security/config/spring-security-5.1.rnc b/config/src/main/resources/org/springframework/security/config/spring-security-5.1.rnc index 6f67240121e..f3b75156ad4 100644 --- a/config/src/main/resources/org/springframework/security/config/spring-security-5.1.rnc +++ b/config/src/main/resources/org/springframework/security/config/spring-security-5.1.rnc @@ -906,4 +906,4 @@ position = ## The explicit position at which the custom-filter should be placed in the chain. Use if you are replacing a standard filter. attribute position {named-security-filter} -named-security-filter = "FIRST" | "CHANNEL_FILTER" | "SECURITY_CONTEXT_FILTER" | "CONCURRENT_SESSION_FILTER" | "WEB_ASYNC_MANAGER_FILTER" | "HEADERS_FILTER" | "CORS_FILTER" | "CSRF_FILTER" | "LOGOUT_FILTER" | "X509_FILTER" | "PRE_AUTH_FILTER" | "CAS_FILTER" | "FORM_LOGIN_FILTER" | "OPENID_FILTER" | "LOGIN_PAGE_FILTER" |"LOGOUT_PAGE_FILTER" | "DIGEST_AUTH_FILTER" | "BASIC_AUTH_FILTER" | "REQUEST_CACHE_FILTER" | "SERVLET_API_SUPPORT_FILTER" | "JAAS_API_SUPPORT_FILTER" | "REMEMBER_ME_FILTER" | "ANONYMOUS_FILTER" | "SESSION_MANAGEMENT_FILTER" | "EXCEPTION_TRANSLATION_FILTER" | "FILTER_SECURITY_INTERCEPTOR" | "SWITCH_USER_FILTER" | "LAST" +named-security-filter = "FIRST" | "CHANNEL_FILTER" | "SECURITY_CONTEXT_FILTER" | "CONCURRENT_SESSION_FILTER" | "WEB_ASYNC_MANAGER_FILTER" | "HEADERS_FILTER" | "CORS_FILTER" | "CSRF_FILTER" | "LOGOUT_FILTER" | "X509_FILTER" | "PRE_AUTH_FILTER" | "CAS_FILTER" | "FORM_LOGIN_FILTER" | "OPENID_FILTER" | "LOGIN_PAGE_FILTER" |"LOGOUT_PAGE_FILTER" | "DIGEST_AUTH_FILTER" | "BEARER_TOKEN_AUTH_FILTER" | "BASIC_AUTH_FILTER" | "REQUEST_CACHE_FILTER" | "SERVLET_API_SUPPORT_FILTER" | "JAAS_API_SUPPORT_FILTER" | "REMEMBER_ME_FILTER" | "ANONYMOUS_FILTER" | "SESSION_MANAGEMENT_FILTER" | "EXCEPTION_TRANSLATION_FILTER" | "FILTER_SECURITY_INTERCEPTOR" | "SWITCH_USER_FILTER" | "LAST" diff --git a/config/src/main/resources/org/springframework/security/config/spring-security-5.1.xsd b/config/src/main/resources/org/springframework/security/config/spring-security-5.1.xsd index acb5e85c84e..6434e496fa2 100644 --- a/config/src/main/resources/org/springframework/security/config/spring-security-5.1.xsd +++ b/config/src/main/resources/org/springframework/security/config/spring-security-5.1.xsd @@ -2721,6 +2721,7 @@ +