Release Notes - Spring Projects Issue Tracker

Release Notes - Spring Security - Version 3.2.0.RC1 - HTML format

Configure Release Notes

Sub-task

[SEC-2046] - Cache Control
[SEC-2098] - X-Frame-Options to defend against clickjacking
[SEC-2099] - X-XSS-Protection Header Support
[SEC-2116] - Add Support for the Strict Transport Security header
[SEC-2206] - Use Propdeps plugin
[SEC-2207] - Update Gradle to 1.6
[SEC-2208] - Use Docbook Plugin
[SEC-2209] - Generate pom.xml
[SEC-2210] - Add Tomcat7 Gradle for samples
[SEC-2211] - gradlew build should build everything (including itests)
[SEC-2212] - remove configure() blocks from gradle/*.gradle
[SEC-2213] - Update to Groovy 2.x
[SEC-2214] - Update Spring Dependencies
[SEC-2217] - Sonar Runner
[SEC-2231] - Access-Control-Allow-*
[SEC-2232] - Headers JavaConfig Support
[SEC-2233] - Polish pull request
[SEC-2234] - DelegatingHeaderWriter with RequestMatcher
[SEC-2251] - Create Hello World Java Configuration Guide
[SEC-2252] - Create Form Login Java Configuration Guide
[SEC-2255] - Update to Gradle 1.7

Bug

[SEC-2137] - Session fixation protection cannot be disabled when concurrent session control is enabled
[SEC-2187] - OpenIDAuthenticationFilter should encode URL parameters
[SEC-2191] - AuthenticationManagerBuilder requires a ObjectPostProcessor
[SEC-2198] - http.httpBasic() does not properly default the AuthenticationEntryPoint
[SEC-2203] - Add Java Config Samples
[SEC-2205] - Create UserDetailsServiceDelegator
[SEC-2215] - Injecting AuthenticationManager to SecurityContextHolderAwareRequestFilter
[SEC-2222] - Javadoc error - WebSecurityConfigurerAdapter.registerAuthentication & EnableWebSecurity refer to wrong parameter
[SEC-2223] - FirewallRequest#reset() has incomplete javadoc
[SEC-2230] - Support for Security Headers
[SEC-2242] - Typo in technical overview with "source source"
[SEC-2257] - Remove HttpSecurityBuilder#getAuthenticationManager()

Improvement

[SEC-2042] - AbstractAuthenticationProcessingFilter should support RequestMatcher
[SEC-2097] - Clean up Gradle build
[SEC-2135] - Support Servlet 3.1's HttpServletRequest#changeSessionId() as alternate session fixation protection strategy
[SEC-2156] - Provide a way to cofigure HttpSession tracking mode with Spring Security
[SEC-2192] - Create AbstractSecurityWebApplicationInitializer.DEFAULT_FILTER_NAME
[SEC-2197] - Allow Multiple invocations on HttpSecurity
[SEC-2199] - Handling Multiple AuthenticationEntryPoint defaults
[SEC-2202] - http.authorizeUrls() to http.authorizeRequests()
[SEC-2221] - MediaTypeRequestMatcher - support for match based upon MediaType
[SEC-2245] - Make MethodSecurityExpressionRoot easier to override
[SEC-2249] - AbstractSecurityWebApplicationInitializer should allow registration of Java Config
[SEC-2260] - update cas client library

New Feature

[SEC-1574] - CSRF Protection
[SEC-2238] - JavaConfig for WebAsynchFilter
[SEC-2239] - Remove Duplicate SessionCreationPolicy

Refactoring

[SEC-2216] - SecurityConfigurerAdapter.addObjectPostProcessor return this

Task

[SEC-2194] - Migrate Java Config Samples into Spring Security
[SEC-2244] - Defaults for /login /login?error and /login?success based upon loginUrl

Edit/Copy Release Notes

The text area below allows the project release notes to be edited and copied to another document.

Release Notes - Spring Security - Version 3.2.0.RC1
        
<h2>        Sub-task
</h2>
<ul>
<li>[<a href='https://jira.spring.io/browse/SEC-2046'>SEC-2046</a>] -         Cache Control
</li>
<li>[<a href='https://jira.spring.io/browse/SEC-2098'>SEC-2098</a>] -         X-Frame-Options to defend against clickjacking
</li>
<li>[<a href='https://jira.spring.io/browse/SEC-2099'>SEC-2099</a>] -         X-XSS-Protection Header Support
</li>
<li>[<a href='https://jira.spring.io/browse/SEC-2116'>SEC-2116</a>] -         Add Support for the Strict Transport Security header
</li>
<li>[<a href='https://jira.spring.io/browse/SEC-2206'>SEC-2206</a>] -         Use Propdeps plugin
</li>
<li>[<a href='https://jira.spring.io/browse/SEC-2207'>SEC-2207</a>] -         Update Gradle to 1.6
</li>
<li>[<a href='https://jira.spring.io/browse/SEC-2208'>SEC-2208</a>] -         Use Docbook Plugin
</li>
<li>[<a href='https://jira.spring.io/browse/SEC-2209'>SEC-2209</a>] -         Generate pom.xml
</li>
<li>[<a href='https://jira.spring.io/browse/SEC-2210'>SEC-2210</a>] -         Add Tomcat7 Gradle for samples
</li>
<li>[<a href='https://jira.spring.io/browse/SEC-2211'>SEC-2211</a>] -         gradlew build should build everything (including itests)
</li>
<li>[<a href='https://jira.spring.io/browse/SEC-2212'>SEC-2212</a>] -         remove configure() blocks from gradle/*.gradle
</li>
<li>[<a href='https://jira.spring.io/browse/SEC-2213'>SEC-2213</a>] -         Update to Groovy 2.x
</li>
<li>[<a href='https://jira.spring.io/browse/SEC-2214'>SEC-2214</a>] -         Update Spring Dependencies
</li>
<li>[<a href='https://jira.spring.io/browse/SEC-2217'>SEC-2217</a>] -         Sonar Runner
</li>
<li>[<a href='https://jira.spring.io/browse/SEC-2231'>SEC-2231</a>] -         Access-Control-Allow-*
</li>
<li>[<a href='https://jira.spring.io/browse/SEC-2232'>SEC-2232</a>] -         Headers JavaConfig Support
</li>
<li>[<a href='https://jira.spring.io/browse/SEC-2233'>SEC-2233</a>] -         Polish pull request
</li>
<li>[<a href='https://jira.spring.io/browse/SEC-2234'>SEC-2234</a>] -         DelegatingHeaderWriter with RequestMatcher
</li>
<li>[<a href='https://jira.spring.io/browse/SEC-2251'>SEC-2251</a>] -         Create Hello World Java Configuration Guide
</li>
<li>[<a href='https://jira.spring.io/browse/SEC-2252'>SEC-2252</a>] -         Create Form Login Java Configuration Guide
</li>
<li>[<a href='https://jira.spring.io/browse/SEC-2255'>SEC-2255</a>] -         Update to Gradle 1.7
</li>
</ul>
        
<h2>        Bug
</h2>
<ul>
<li>[<a href='https://jira.spring.io/browse/SEC-2137'>SEC-2137</a>] -         Session fixation protection cannot be disabled when concurrent session control is enabled
</li>
<li>[<a href='https://jira.spring.io/browse/SEC-2187'>SEC-2187</a>] -         OpenIDAuthenticationFilter should encode URL parameters
</li>
<li>[<a href='https://jira.spring.io/browse/SEC-2191'>SEC-2191</a>] -         AuthenticationManagerBuilder requires a ObjectPostProcessor
</li>
<li>[<a href='https://jira.spring.io/browse/SEC-2198'>SEC-2198</a>] -         http.httpBasic() does not properly default the AuthenticationEntryPoint
</li>
<li>[<a href='https://jira.spring.io/browse/SEC-2203'>SEC-2203</a>] -         Add Java Config Samples
</li>
<li>[<a href='https://jira.spring.io/browse/SEC-2205'>SEC-2205</a>] -         Create UserDetailsServiceDelegator
</li>
<li>[<a href='https://jira.spring.io/browse/SEC-2215'>SEC-2215</a>] -         Injecting AuthenticationManager to SecurityContextHolderAwareRequestFilter
</li>
<li>[<a href='https://jira.spring.io/browse/SEC-2222'>SEC-2222</a>] -         Javadoc error - WebSecurityConfigurerAdapter.registerAuthentication &amp; EnableWebSecurity refer to wrong parameter
</li>
<li>[<a href='https://jira.spring.io/browse/SEC-2223'>SEC-2223</a>] -         FirewallRequest#reset() has incomplete javadoc
</li>
<li>[<a href='https://jira.spring.io/browse/SEC-2230'>SEC-2230</a>] -         Support for Security Headers
</li>
<li>[<a href='https://jira.spring.io/browse/SEC-2242'>SEC-2242</a>] -         Typo in technical overview with &quot;source source&quot;
</li>
<li>[<a href='https://jira.spring.io/browse/SEC-2257'>SEC-2257</a>] -         Remove HttpSecurityBuilder#getAuthenticationManager()
</li>
</ul>
            
<h2>        Improvement
</h2>
<ul>
<li>[<a href='https://jira.spring.io/browse/SEC-2042'>SEC-2042</a>] -         AbstractAuthenticationProcessingFilter should support RequestMatcher
</li>
<li>[<a href='https://jira.spring.io/browse/SEC-2097'>SEC-2097</a>] -         Clean up Gradle build
</li>
<li>[<a href='https://jira.spring.io/browse/SEC-2135'>SEC-2135</a>] -         Support Servlet 3.1&#39;s HttpServletRequest#changeSessionId() as alternate session fixation protection strategy
</li>
<li>[<a href='https://jira.spring.io/browse/SEC-2156'>SEC-2156</a>] -         Provide a way to cofigure HttpSession tracking mode with Spring Security
</li>
<li>[<a href='https://jira.spring.io/browse/SEC-2192'>SEC-2192</a>] -         Create AbstractSecurityWebApplicationInitializer.DEFAULT_FILTER_NAME
</li>
<li>[<a href='https://jira.spring.io/browse/SEC-2197'>SEC-2197</a>] -         Allow Multiple invocations on HttpSecurity
</li>
<li>[<a href='https://jira.spring.io/browse/SEC-2199'>SEC-2199</a>] -         Handling Multiple AuthenticationEntryPoint defaults
</li>
<li>[<a href='https://jira.spring.io/browse/SEC-2202'>SEC-2202</a>] -         http.authorizeUrls() to http.authorizeRequests()
</li>
<li>[<a href='https://jira.spring.io/browse/SEC-2221'>SEC-2221</a>] -         MediaTypeRequestMatcher - support for match based upon MediaType
</li>
<li>[<a href='https://jira.spring.io/browse/SEC-2245'>SEC-2245</a>] -         Make MethodSecurityExpressionRoot easier to override
</li>
<li>[<a href='https://jira.spring.io/browse/SEC-2249'>SEC-2249</a>] -         AbstractSecurityWebApplicationInitializer should allow registration of Java Config
</li>
<li>[<a href='https://jira.spring.io/browse/SEC-2260'>SEC-2260</a>] -         update cas client library
</li>
</ul>
    
<h2>        New Feature
</h2>
<ul>
<li>[<a href='https://jira.spring.io/browse/SEC-1574'>SEC-1574</a>] -         CSRF Protection
</li>
<li>[<a href='https://jira.spring.io/browse/SEC-2238'>SEC-2238</a>] -         JavaConfig for WebAsynchFilter
</li>
<li>[<a href='https://jira.spring.io/browse/SEC-2239'>SEC-2239</a>] -         Remove Duplicate SessionCreationPolicy
</li>
</ul>
        
<h2>        Refactoring
</h2>
<ul>
<li>[<a href='https://jira.spring.io/browse/SEC-2216'>SEC-2216</a>] -         SecurityConfigurerAdapter.addObjectPostProcessor return this
</li>
</ul>
            
<h2>        Task
</h2>
<ul>
<li>[<a href='https://jira.spring.io/browse/SEC-2194'>SEC-2194</a>] -         Migrate Java Config Samples into Spring Security
</li>
<li>[<a href='https://jira.spring.io/browse/SEC-2244'>SEC-2244</a>] -         Defaults for /login /login?error and /login?success based upon loginUrl
</li>
</ul>