[WIP] Move login-ui.xml to java config, part 2 #3292
Conversation
- IS_ANONYMOUSLY_AUTHENTICATED is equivalent to permitAll(), since the `.anonymous()` http-configurer is turned on by default.
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| var originalChain = http | ||
| .securityMatcher( | ||
| "/forgot_password", | ||
| "/forgot_password.do" | ||
| ) | ||
| .authorizeHttpRequests(auth -> auth.anyRequest().permitAll()) | ||
| .csrf(CsrfConfigurer::disable) |
Check failure
Code scanning / CodeQL
Disabled Spring CSRF protection High
| var originalChain = http | ||
| .securityMatcher("/verify_email") | ||
| .authorizeHttpRequests(auth -> auth.anyRequest().permitAll()) | ||
| .csrf(CsrfConfigurer::disable) |
Check failure
Code scanning / CodeQL
Disabled Spring CSRF protection High
| var originalChain = http | ||
| .securityMatcher("/verify_user") | ||
| .authorizeHttpRequests(auth -> auth.anyRequest().permitAll()) | ||
| .csrf(CsrfConfigurer::disable) |
Check failure
Code scanning / CodeQL
Disabled Spring CSRF protection High
| var originalChain = http | ||
| .securityMatcher("/invitations/accept") | ||
| .authorizeHttpRequests(auth -> auth.anyRequest().permitAll()) | ||
| .csrf(CsrfConfigurer::disable) |
Check failure
Code scanning / CodeQL
Disabled Spring CSRF protection High
| var originalChain = http | ||
| .securityMatcher("/saml/idp/SSO/**") | ||
| .authorizeHttpRequests(auth -> auth.anyRequest().fullyAuthenticated()) | ||
| .addFilterBefore(passwordChangeUiRequiredFilter, BasicAuthenticationFilter.class) | ||
| .csrf(CsrfConfigurer::disable) |
Check failure
Code scanning / CodeQL
Disabled Spring CSRF protection High
WIP, do not merge.