Skip to content

Commit dadf4c0

Browse files
kse-musicjzheaux
kse-music
authored and
jzheaux
committed
Remove shouldFilterAllDispatcherTypes
Closes gh-12139 Signed-off-by: DingHao <dh.hiekn@gmail.com>
1 parent 5fefdd5 commit dadf4c0

7 files changed

Lines changed: 9 additions & 169 deletions

File tree

‎config/src/main/java/org/springframework/security/config/annotation/web/configurers/AuthorizeHttpRequestsConfigurer.java‎

Lines changed: 0 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -110,7 +110,6 @@ public void configure(H http) {
110110
AuthorizationManager<HttpServletRequest> authorizationManager = this.registry.createAuthorizationManager();
111111
AuthorizationFilter authorizationFilter = new AuthorizationFilter(authorizationManager);
112112
authorizationFilter.setAuthorizationEventPublisher(this.publisher);
113-
authorizationFilter.setShouldFilterAllDispatcherTypes(this.registry.shouldFilterAllDispatcherTypes);
114113
authorizationFilter.setSecurityContextHolderStrategy(getSecurityContextHolderStrategy());
115114
http.addFilter(postProcess(authorizationFilter));
116115
}
@@ -144,8 +143,6 @@ public final class AuthorizationManagerRequestMatcherRegistry
144143

145144
private int mappingCount;
146145

147-
private boolean shouldFilterAllDispatcherTypes = true;
148-
149146
private AuthorizationManagerRequestMatcherRegistry(ApplicationContext context) {
150147
setApplicationContext(context);
151148
}
@@ -191,36 +188,6 @@ public AuthorizationManagerRequestMatcherRegistry withObjectPostProcessor(
191188
return this;
192189
}
193190

194-
/**
195-
* Sets whether all dispatcher types should be filtered.
196-
* @param shouldFilter should filter all dispatcher types. Default is {@code true}
197-
* @return the {@link AuthorizationManagerRequestMatcherRegistry} for further
198-
* customizations
199-
* @since 5.7
200-
* @deprecated Permit access to the {@link jakarta.servlet.DispatcherType}
201-
* instead. <pre>
202-
* &#064;Configuration
203-
* &#064;EnableWebSecurity
204-
* public class SecurityConfig {
205-
*
206-
* &#064;Bean
207-
* public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
208-
* http
209-
* .authorizeHttpRequests((authorize) -&gt; authorize
210-
* .dispatcherTypeMatchers(DispatcherType.ERROR).permitAll()
211-
* // ...
212-
* );
213-
* return http.build();
214-
* }
215-
* }
216-
* </pre>
217-
*/
218-
@Deprecated(since = "6.1", forRemoval = true)
219-
public AuthorizationManagerRequestMatcherRegistry shouldFilterAllDispatcherTypes(boolean shouldFilter) {
220-
this.shouldFilterAllDispatcherTypes = shouldFilter;
221-
return this;
222-
}
223-
224191
}
225192

226193
/**

‎config/src/main/kotlin/org/springframework/security/config/annotation/web/AuthorizeHttpRequestsDsl.kt‎

Lines changed: 1 addition & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2024 the original author or authors.
2+
* Copyright 2002-2025 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -41,27 +41,8 @@ import java.util.function.Supplier
4141
*
4242
* @author Yuriy Savchenko
4343
* @since 5.7
44-
* @property shouldFilterAllDispatcherTypes whether the [AuthorizationFilter] should filter all dispatcher types
4544
*/
4645
class AuthorizeHttpRequestsDsl : AbstractRequestMatcherDsl {
47-
@Deprecated("""
48-
Add authorization rules to DispatcherType directly.
49-
50-
@Configuration
51-
@EnableWebSecurity
52-
public class SecurityConfig {
53-
@Bean
54-
public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
55-
http
56-
.authorizeHttpRequests((authorize) -> authorize
57-
.dispatcherTypeMatchers(DispatcherType.ERROR).permitAll()
58-
// ...
59-
);
60-
return http.build();
61-
}
62-
}
63-
""")
64-
var shouldFilterAllDispatcherTypes: Boolean? = null
6546

6647
private val authorizationRules = mutableListOf<AuthorizationManagerRule>()
6748
private val rolePrefix: String
@@ -291,9 +272,6 @@ class AuthorizeHttpRequestsDsl : AbstractRequestMatcherDsl {
291272
}
292273
}
293274
}
294-
shouldFilterAllDispatcherTypes?.also { shouldFilter ->
295-
requests.shouldFilterAllDispatcherTypes(shouldFilter)
296-
}
297275
}
298276
}
299277

‎config/src/test/java/org/springframework/security/config/http/InterceptUrlConfigTests.java‎

Lines changed: 1 addition & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2022 the original author or authors.
2+
* Copyright 2002-2025 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -337,28 +337,6 @@ public void requestWhenUsingFilterAllDispatcherTypesAndAuthorizationManagerThenA
337337
assertThat(this.spring.getContext().getBean(AuthorizationManager.class)).isNotNull();
338338
}
339339

340-
@Test
341-
public void requestWhenUsingFilterAllDispatcherTypesFalseThenAuthorizesRequestsAccordingly() throws Exception {
342-
this.spring.configLocations(this.xml("FilterAllDispatcherTypesFalse")).autowire();
343-
// @formatter:off
344-
this.mvc.perform(get("/path").with(userCredentials()))
345-
.andExpect(status().isOk());
346-
this.mvc.perform(get("/path").with(adminCredentials()))
347-
.andExpect(status().isForbidden());
348-
this.mvc.perform(get("/error").with((request) -> {
349-
request.setAttribute(WebUtils.ERROR_REQUEST_URI_ATTRIBUTE, "/error");
350-
request.setDispatcherType(DispatcherType.ERROR);
351-
return request;
352-
})).andExpect(status().isOk());
353-
this.mvc.perform(get("/path").with((request) -> {
354-
request.setAttribute(WebUtils.ERROR_REQUEST_URI_ATTRIBUTE, "/path");
355-
request.setDispatcherType(DispatcherType.ERROR);
356-
return request;
357-
})).andExpect(status().isOk());
358-
// @formatter:on
359-
assertThat(this.spring.getContext().getBean(AuthorizationManager.class)).isNotNull();
360-
}
361-
362340
private static RequestPostProcessor adminCredentials() {
363341
return httpBasic("admin", "password");
364342
}

‎config/src/test/kotlin/org/springframework/security/config/annotation/web/AuthorizeHttpRequestsDslTests.kt‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2024 the original author or authors.
2+
* Copyright 2002-2025 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -44,6 +44,7 @@ import org.springframework.security.provisioning.InMemoryUserDetailsManager
4444
import org.springframework.security.test.web.servlet.request.SecurityMockMvcRequestPostProcessors.*
4545
import org.springframework.security.web.SecurityFilterChain
4646
import org.springframework.security.web.access.intercept.RequestAuthorizationContext
47+
import org.springframework.security.web.util.matcher.DispatcherTypeRequestMatcher
4748
import org.springframework.security.web.util.matcher.RegexRequestMatcher
4849
import org.springframework.test.web.servlet.MockMvc
4950
import org.springframework.test.web.servlet.get
@@ -632,7 +633,6 @@ class AuthorizeHttpRequestsDslTests {
632633
open fun securityFilterChain(http: HttpSecurity): SecurityFilterChain {
633634
http {
634635
authorizeHttpRequests {
635-
shouldFilterAllDispatcherTypes = true
636636
authorize(anyRequest, denyAll)
637637
}
638638
}
@@ -671,7 +671,6 @@ class AuthorizeHttpRequestsDslTests {
671671
open fun securityFilterChain(http: HttpSecurity): SecurityFilterChain {
672672
http {
673673
authorizeHttpRequests {
674-
shouldFilterAllDispatcherTypes = true
675674
authorize(anyRequest, permitAll)
676675
}
677676
}
@@ -710,7 +709,8 @@ class AuthorizeHttpRequestsDslTests {
710709
open fun securityFilterChain(http: HttpSecurity): SecurityFilterChain {
711710
http {
712711
authorizeHttpRequests {
713-
shouldFilterAllDispatcherTypes = false
712+
authorize(DispatcherTypeRequestMatcher(DispatcherType.ERROR), permitAll)
713+
authorize(DispatcherTypeRequestMatcher(DispatcherType.ASYNC), permitAll)
714714
authorize(anyRequest, denyAll)
715715
}
716716
}

‎config/src/test/resources/org/springframework/security/config/http/InterceptUrlConfigTests-FilterAllDispatcherTypesFalse.xml‎

Lines changed: 0 additions & 55 deletions
This file was deleted.

‎web/src/main/java/org/springframework/security/web/access/intercept/AuthorizationFilter.java‎

Lines changed: 0 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -163,36 +163,6 @@ public AuthorizationManager<HttpServletRequest> getAuthorizationManager() {
163163
return this.authorizationManager;
164164
}
165165

166-
/**
167-
* Sets whether to filter all dispatcher types.
168-
* @param shouldFilterAllDispatcherTypes should filter all dispatcher types. Default
169-
* is {@code true}
170-
* @since 5.7
171-
* @deprecated Permit access to the {@link jakarta.servlet.DispatcherType} instead.
172-
* <pre>
173-
* &#064;Configuration
174-
* &#064;EnableWebSecurity
175-
* public class SecurityConfig {
176-
*
177-
* &#064;Bean
178-
* public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
179-
* http
180-
* .authorizeHttpRequests((authorize) -&gt; authorize
181-
* .dispatcherTypeMatchers(DispatcherType.ERROR).permitAll()
182-
* // ...
183-
* );
184-
* return http.build();
185-
* }
186-
* }
187-
* </pre>
188-
*/
189-
@Deprecated(since = "6.1", forRemoval = true)
190-
public void setShouldFilterAllDispatcherTypes(boolean shouldFilterAllDispatcherTypes) {
191-
this.observeOncePerRequest = !shouldFilterAllDispatcherTypes;
192-
this.filterErrorDispatch = shouldFilterAllDispatcherTypes;
193-
this.filterAsyncDispatch = shouldFilterAllDispatcherTypes;
194-
}
195-
196166
public boolean isObserveOncePerRequest() {
197167
return this.observeOncePerRequest;
198168
}

‎web/src/test/java/org/springframework/security/web/access/intercept/AuthorizationFilterTests.java‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -210,7 +210,9 @@ public void doFilterWhenErrorThenDoFilter() throws Exception {
210210
public void doFilterWhenErrorAndShouldFilterAllDispatcherTypesFalseThenDoNotFilter() throws Exception {
211211
AuthorizationManager<HttpServletRequest> authorizationManager = mock(AuthorizationManager.class);
212212
AuthorizationFilter authorizationFilter = new AuthorizationFilter(authorizationManager);
213-
authorizationFilter.setShouldFilterAllDispatcherTypes(false);
213+
authorizationFilter.setObserveOncePerRequest(true);
214+
authorizationFilter.setFilterErrorDispatch(false);
215+
authorizationFilter.setFilterAsyncDispatch(false);
214216
MockHttpServletRequest mockRequest = new MockHttpServletRequest(null, "/path");
215217
mockRequest.setDispatcherType(DispatcherType.ERROR);
216218
mockRequest.setAttribute(WebUtils.ERROR_REQUEST_URI_ATTRIBUTE, "/error");

0 commit comments

Comments
 (0)