spring-projects / spring-projects/spring-security
Reordering built-in security filters
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 9.6k
- Forks
- 6.3k
- Avg merge
- 2d 11h
- Merged PRs (30d)
- 52
Description
I'm trying to use the X509 authentication to determine in the CSRF requestMatcher if it should be enable or not - in particular, disable for servers.
In here though it looks like the X509 filter is added after CSRF: https://github.com/spring-projects/spring-security/blob/master/config/src/main/java/org/springframework/security/config/annotation/web/builders/FilterComparator.java#L76
This means the authentication is null when it gets to the requestMatcher. Is there a way to reorder the built in filters?
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with config/src/main/java/org/springframework/security/config/annotation/web/builders/FilterComparator.java, especially the ordering around CSRF and X509 filters. Trace how the requestMatcher observes authentication and determine whether built-in filter ordering is configurable. Done means the supported behavior for reordering these filters is established and covered by an appropriate test or documented limitation.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- authentication, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100