signature:
public class CurrentSecurityContextArgumentResolver { /** * resolve the argument to inject into the controller parameter .
 * @ param parameter the method parameter .
 * @ param mavContainer the model and view container .
 * @ param webRequest the web request .
 * @ param binderFactory the web data binder factory .
 * @ see org . springframework . web . method . support . HandlerMethodArgumentResolver #
 * resolveArgument ( org . springframework . core . MethodParameter ,
 * org . springframework . web . method . support . ModelAndViewContainer ,
 * org . springframework . web . context . request . NativeWebRequest ,
 * org . springframework . web . bind . support . WebDataBinderFactory ) */
public Object resolveArgument ( MethodParameter parameter , ModelAndViewContainer mavContainer , NativeWebRequest webRequest , WebDataBinderFactory binderFactory ) throws Exception { } }

implementation: SecurityContext securityContext = SecurityContextHolder . getContext ( ) ; if ( securityContext == null ) { return null ; } Object securityContextResult = securityContext ; CurrentSecurityContext securityContextAnnotation = findMethodAnnotation ( CurrentSecurityContext . class , parameter ) ; String expressionToParse = securityContextAnnotation . expression ( ) ; if ( StringUtils . hasLength ( expressionToParse ) ) { StandardEvaluationContext context = new StandardEvaluationContext ( ) ; context . setRootObject ( securityContext ) ; context . setVariable ( "this" , securityContext ) ; Expression expression = this . parser . parseExpression ( expressionToParse ) ; securityContextResult = expression . getValue ( context ) ; } if ( securityContextResult != null && ! parameter . getParameterType ( ) . isAssignableFrom ( securityContextResult . getClass ( ) ) ) { if ( securityContextAnnotation . errorOnInvalidType ( ) ) { throw new ClassCastException ( securityContextResult + " is not assignable to " + parameter . getParameterType ( ) ) ; } else { return null ; } } return securityContextResult ;


signature:
public class CurrentSecurityContextArgumentResolver { /** * Obtains the specified { @ link Annotation } on the specified { @ link MethodParameter } .
 * @ param annotationClass the class of the { @ link Annotation } to find on the
 * { @ link MethodParameter }
 * @ param parameter the { @ link MethodParameter } to search for an { @ link Annotation }
 * @ return the { @ link Annotation } that was found or null . */
private < T extends Annotation > T findMethodAnnotation ( Class < T > annotationClass , MethodParameter parameter ) { } }

implementation: T annotation = parameter . getParameterAnnotation ( annotationClass ) ; if ( annotation != null ) { return annotation ; } Annotation [ ] annotationsToSearch = parameter . getParameterAnnotations ( ) ; for ( Annotation toSearch : annotationsToSearch ) { annotation = AnnotationUtils . findAnnotation ( toSearch . annotationType ( ) , annotationClass ) ; if ( annotation != null ) { return annotation ; } } return null ;


signature:
public class AuthenticationPrincipalArgumentResolver { /** * ( non - Javadoc )
 * @ see org . springframework . web . method . support . HandlerMethodArgumentResolver #
 * resolveArgument ( org . springframework . core . MethodParameter ,
 * org . springframework . web . method . support . ModelAndViewContainer ,
 * org . springframework . web . context . request . NativeWebRequest ,
 * org . springframework . web . bind . support . WebDataBinderFactory ) */
public Object resolveArgument ( MethodParameter parameter , ModelAndViewContainer mavContainer , NativeWebRequest webRequest , WebDataBinderFactory binderFactory ) throws Exception { } }

implementation: Authentication authentication = SecurityContextHolder . getContext ( ) . getAuthentication ( ) ; if ( authentication == null ) { return null ; } Object principal = authentication . getPrincipal ( ) ; AuthenticationPrincipal authPrincipal = findMethodAnnotation ( AuthenticationPrincipal . class , parameter ) ; String expressionToParse = authPrincipal . expression ( ) ; if ( StringUtils . hasLength ( expressionToParse ) ) { StandardEvaluationContext context = new StandardEvaluationContext ( ) ; context . setRootObject ( principal ) ; context . setVariable ( "this" , principal ) ; context . setBeanResolver ( beanResolver ) ; Expression expression = this . parser . parseExpression ( expressionToParse ) ; principal = expression . getValue ( context ) ; } if ( principal != null && ! parameter . getParameterType ( ) . isAssignableFrom ( principal . getClass ( ) ) ) { if ( authPrincipal . errorOnInvalidType ( ) ) { throw new ClassCastException ( principal + " is not assignable to " + parameter . getParameterType ( ) ) ; } else { return null ; } } return principal ;


signature:
public class JwtValidators { /** * Create a { @ link Jwt } Validator that contains all standard validators when an issuer is known .
 * User ' s wanting to leverage the defaults plus additional validation can add the result of this
 * method to { @ code DelegatingOAuth2TokenValidator } along with the additional validators .
 * @ param issuer the issuer
 * @ return - a delegating validator containing all standard validators as well as any supplied */
public static OAuth2TokenValidator < Jwt > createDefaultWithIssuer ( String issuer ) { } }

implementation: List < OAuth2TokenValidator < Jwt > > validators = new ArrayList < > ( ) ; validators . add ( new JwtTimestampValidator ( ) ) ; validators . add ( new JwtIssuerValidator ( issuer ) ) ; return new DelegatingOAuth2TokenValidator < > ( validators ) ;


signature:
public class RsaKeyConversionServicePostProcessor { /** * { @ inheritDoc } */
@ Override public void postProcessBeanFactory ( ConfigurableListableBeanFactory beanFactory ) throws BeansException { } }

implementation: if ( hasUserDefinedConversionService ( beanFactory ) ) { return ; } Converter < String , RSAPrivateKey > pkcs8 = pkcs8 ( ) ; Converter < String , RSAPublicKey > x509 = x509 ( ) ; ConversionService service = beanFactory . getConversionService ( ) ; if ( service instanceof ConverterRegistry ) { ConverterRegistry registry = ( ConverterRegistry ) service ; registry . addConverter ( String . class , RSAPrivateKey . class , pkcs8 ) ; registry . addConverter ( String . class , RSAPublicKey . class , x509 ) ; } else { beanFactory . addPropertyEditorRegistrar ( registry -> { registry . registerCustomEditor ( RSAPublicKey . class , new ConverterPropertyEditorAdapter < > ( x509 ) ) ; registry . registerCustomEditor ( RSAPrivateKey . class , new ConverterPropertyEditorAdapter < > ( pkcs8 ) ) ; } ) ; }


signature:
public class AbstractRememberMeServices { /** * Template implementation which locates the Spring Security cookie , decodes it into a
 * delimited array of tokens and submits it to subclasses for processing via the
 * < tt > processAutoLoginCookie < / tt > method .
 * The returned username is then used to load the UserDetails object for the user ,
 * which in turn is used to create a valid authentication token . */
@ Override public final Authentication autoLogin ( HttpServletRequest request , HttpServletResponse response ) { } }

implementation: String rememberMeCookie = extractRememberMeCookie ( request ) ; if ( rememberMeCookie == null ) { return null ; } logger . debug ( "Remember-me cookie detected" ) ; if ( rememberMeCookie . length ( ) == 0 ) { logger . debug ( "Cookie was empty" ) ; cancelCookie ( request , response ) ; return null ; } UserDetails user = null ; try { String [ ] cookieTokens = decodeCookie ( rememberMeCookie ) ; user = processAutoLoginCookie ( cookieTokens , request , response ) ; userDetailsChecker . check ( user ) ; logger . debug ( "Remember-me cookie accepted" ) ; return createSuccessfulAuthentication ( request , user ) ; } catch ( CookieTheftException cte ) { cancelCookie ( request , response ) ; throw cte ; } catch ( UsernameNotFoundException noUser ) { logger . debug ( "Remember-me login was valid but corresponding user not found." , noUser ) ; } catch ( InvalidCookieException invalidCookie ) { logger . debug ( "Invalid remember-me cookie: " + invalidCookie . getMessage ( ) ) ; } catch ( AccountStatusException statusInvalid ) { logger . debug ( "Invalid UserDetails: " + statusInvalid . getMessage ( ) ) ; } catch ( RememberMeAuthenticationException e ) { logger . debug ( e . getMessage ( ) ) ; } cancelCookie ( request , response ) ; return null ;


signature:
public class AbstractRememberMeServices { /** * Locates the Spring Security remember me cookie in the request and returns its
 * value . The cookie is searched for by name and also by matching the context path to
 * the cookie path .
 * @ param request the submitted request which is to be authenticated
 * @ return the cookie value ( if present ) , null otherwise . */
protected String extractRememberMeCookie ( HttpServletRequest request ) { } }

implementation: Cookie [ ] cookies = request . getCookies ( ) ; if ( ( cookies == null ) || ( cookies . length == 0 ) ) { return null ; } for ( Cookie cookie : cookies ) { if ( cookieName . equals ( cookie . getName ( ) ) ) { return cookie . getValue ( ) ; } } return null ;


signature:
public class AbstractRememberMeServices { /** * Creates the final < tt > Authentication < / tt > object returned from the
 * < tt > autoLogin < / tt > method .
 * By default it will create a < tt > RememberMeAuthenticationToken < / tt > instance .
 * @ param request the original request . The configured
 * < tt > AuthenticationDetailsSource < / tt > will use this to build the details property of
 * the returned object .
 * @ param user the < tt > UserDetails < / tt > loaded from the < tt > UserDetailsService < / tt > .
 * This will be stored as the principal .
 * @ return the < tt > Authentication < / tt > for the remember - me authenticated user */
protected Authentication createSuccessfulAuthentication ( HttpServletRequest request , UserDetails user ) { } }

implementation: RememberMeAuthenticationToken auth = new RememberMeAuthenticationToken ( key , user , authoritiesMapper . mapAuthorities ( user . getAuthorities ( ) ) ) ; auth . setDetails ( authenticationDetailsSource . buildDetails ( request ) ) ; return auth ;


signature:
public class AbstractRememberMeServices { /** * Decodes the cookie and splits it into a set of token strings using the " : "
 * delimiter .
 * @ param cookieValue the value obtained from the submitted cookie
 * @ return the array of tokens .
 * @ throws InvalidCookieException if the cookie was not base64 encoded . */
protected String [ ] decodeCookie ( String cookieValue ) throws InvalidCookieException { } }

implementation: for ( int j = 0 ; j < cookieValue . length ( ) % 4 ; j ++ ) { cookieValue = cookieValue + "=" ; } try { Base64 . getDecoder ( ) . decode ( cookieValue . getBytes ( ) ) ; } catch ( IllegalArgumentException e ) { throw new InvalidCookieException ( "Cookie token was not Base64 encoded; value was '" + cookieValue + "'" ) ; } String cookieAsPlainText = new String ( Base64 . getDecoder ( ) . decode ( cookieValue . getBytes ( ) ) ) ; String [ ] tokens = StringUtils . delimitedListToStringArray ( cookieAsPlainText , DELIMITER ) ; for ( int i = 0 ; i < tokens . length ; i ++ ) { try { tokens [ i ] = URLDecoder . decode ( tokens [ i ] , StandardCharsets . UTF_8 . toString ( ) ) ; } catch ( UnsupportedEncodingException e ) { logger . error ( e . getMessage ( ) , e ) ; } } return tokens ;


signature:
public class AbstractRememberMeServices { /** * Inverse operation of decodeCookie .
 * @ param cookieTokens the tokens to be encoded .
 * @ return base64 encoding of the tokens concatenated with the " : " delimiter . */
protected String encodeCookie ( String [ ] cookieTokens ) { } }

implementation: StringBuilder sb = new StringBuilder ( ) ; for ( int i = 0 ; i < cookieTokens . length ; i ++ ) { try { sb . append ( URLEncoder . encode ( cookieTokens [ i ] , StandardCharsets . UTF_8 . toString ( ) ) ) ; } catch ( UnsupportedEncodingException e ) { logger . error ( e . getMessage ( ) , e ) ; } if ( i < cookieTokens . length - 1 ) { sb . append ( DELIMITER ) ; } } String value = sb . toString ( ) ; sb = new StringBuilder ( new String ( Base64 . getEncoder ( ) . encode ( value . getBytes ( ) ) ) ) ; while ( sb . charAt ( sb . length ( ) - 1 ) == '=' ) { sb . deleteCharAt ( sb . length ( ) - 1 ) ; } return sb . toString ( ) ;


signature:
public class AbstractRememberMeServices { /** * { @ inheritDoc }
 * Examines the incoming request and checks for the presence of the configured
 * " remember me " parameter . If it ' s present , or if < tt > alwaysRemember < / tt > is set to
 * true , calls < tt > onLoginSucces < / tt > . */
@ Override public final void loginSuccess ( HttpServletRequest request , HttpServletResponse response , Authentication successfulAuthentication ) { } }

implementation: if ( ! rememberMeRequested ( request , parameter ) ) { logger . debug ( "Remember-me login not requested." ) ; return ; } onLoginSuccess ( request , response , successfulAuthentication ) ;


signature:
public class AbstractRememberMeServices { /** * Allows customization of whether a remember - me login has been requested . The default
 * is to return true if < tt > alwaysRemember < / tt > is set or the configured parameter
 * name has been included in the request and is set to the value " true " .
 * @ param request the request submitted from an interactive login , which may include
 * additional information indicating that a persistent login is desired .
 * @ param parameter the configured remember - me parameter name .
 * @ return true if the request includes information indicating that a persistent login
 * has been requested . */
protected boolean rememberMeRequested ( HttpServletRequest request , String parameter ) { } }

implementation: if ( alwaysRemember ) { return true ; } String paramValue = request . getParameter ( parameter ) ; if ( paramValue != null ) { if ( paramValue . equalsIgnoreCase ( "true" ) || paramValue . equalsIgnoreCase ( "on" ) || paramValue . equalsIgnoreCase ( "yes" ) || paramValue . equals ( "1" ) ) { return true ; } } if ( logger . isDebugEnabled ( ) ) { logger . debug ( "Did not send remember-me cookie (principal did not set parameter '" + parameter + "')" ) ; } return false ;


signature:
public class AbstractRememberMeServices { /** * Sets a " cancel cookie " ( with maxAge = 0 ) on the response to disable persistent
 * logins . */
protected void cancelCookie ( HttpServletRequest request , HttpServletResponse response ) { } }

implementation: logger . debug ( "Cancelling cookie" ) ; Cookie cookie = new Cookie ( cookieName , null ) ; cookie . setMaxAge ( 0 ) ; cookie . setPath ( getCookiePath ( request ) ) ; if ( cookieDomain != null ) { cookie . setDomain ( cookieDomain ) ; } response . addCookie ( cookie ) ;


signature:
public class AbstractRememberMeServices { /** * Sets the cookie on the response .
 * By default a secure cookie will be used if the connection is secure . You can set
 * the { @ code useSecureCookie } property to { @ code false } to override this . If you set
 * it to { @ code true } , the cookie will always be flagged as secure . By default the cookie
 * will be marked as HttpOnly .
 * @ param tokens the tokens which will be encoded to make the cookie value .
 * @ param maxAge the value passed to { @ link Cookie # setMaxAge ( int ) }
 * @ param request the request
 * @ param response the response to add the cookie to . */
protected void setCookie ( String [ ] tokens , int maxAge , HttpServletRequest request , HttpServletResponse response ) { } }

implementation: String cookieValue = encodeCookie ( tokens ) ; Cookie cookie = new Cookie ( cookieName , cookieValue ) ; cookie . setMaxAge ( maxAge ) ; cookie . setPath ( getCookiePath ( request ) ) ; if ( cookieDomain != null ) { cookie . setDomain ( cookieDomain ) ; } if ( maxAge < 1 ) { cookie . setVersion ( 1 ) ; } if ( useSecureCookie == null ) { cookie . setSecure ( request . isSecure ( ) ) ; } else { cookie . setSecure ( useSecureCookie ) ; } cookie . setHttpOnly ( true ) ; response . addCookie ( cookie ) ;


signature:
public class AbstractRememberMeServices { /** * Implementation of { @ code LogoutHandler } . Default behaviour is to call
 * { @ code cancelCookie ( ) } . */
@ Override public void logout ( HttpServletRequest request , HttpServletResponse response , Authentication authentication ) { } }

implementation: if ( logger . isDebugEnabled ( ) ) { logger . debug ( "Logout of user " + ( authentication == null ? "Unknown" : authentication . getName ( ) ) ) ; } cancelCookie ( request , response ) ;


signature:
public class RsaKeyConverters { /** * Construct a { @ link Converter } for converting a PEM - encoded PKCS # 8 RSA Private Key
 * into a { @ link RSAPrivateKey } .
 * Note that keys are often formatted in PKCS # 1 and this can easily be identified by the header .
 * If the key file begins with " - - - - - BEGIN RSA PRIVATE KEY - - - - - " , then it is PKCS # 1 . If it is
 * PKCS # 8 formatted , then it begins with " - - - - - BEGIN PRIVATE KEY - - - - - " .
 * This converter does not close the { @ link InputStream } in order to avoid making non - portable
 * assumptions about the streams ' origin and further use .
 * @ return A { @ link Converter } that can read a PEM - encoded PKCS # 8 RSA Private Key and return a
 * { @ link RSAPrivateKey } . */
public static Converter < InputStream , RSAPrivateKey > pkcs8 ( ) { } }

implementation: KeyFactory keyFactory = rsaFactory ( ) ; return source -> { List < String > lines = readAllLines ( source ) ; Assert . isTrue ( ! lines . isEmpty ( ) && lines . get ( 0 ) . startsWith ( PKCS8_PEM_HEADER ) , "Key is not in PEM-encoded PKCS#8 format, " + "please check that the header begins with -----" + PKCS8_PEM_HEADER + "-----" ) ; String base64Encoded = lines . stream ( ) . filter ( RsaKeyConverters :: isNotPkcs8Wrapper ) . collect ( Collectors . joining ( ) ) ; byte [ ] pkcs8 = Base64 . getDecoder ( ) . decode ( base64Encoded ) ; try { return ( RSAPrivateKey ) keyFactory . generatePrivate ( new PKCS8EncodedKeySpec ( pkcs8 ) ) ; } catch ( Exception e ) { throw new IllegalArgumentException ( e ) ; } } ;


signature:
public class RsaKeyConverters { /** * Construct a { @ link Converter } for converting a PEM - encoded X . 509 RSA Public Key
 * into a { @ link RSAPublicKey } .
 * This converter does not close the { @ link InputStream } in order to avoid making non - portable
 * assumptions about the streams ' origin and further use .
 * @ return A { @ link Converter } that can read a PEM - encoded X . 509 RSA Public Key and return a
 * { @ link RSAPublicKey } . */
public static Converter < InputStream , RSAPublicKey > x509 ( ) { } }

implementation: KeyFactory keyFactory = rsaFactory ( ) ; return source -> { List < String > lines = readAllLines ( source ) ; Assert . isTrue ( ! lines . isEmpty ( ) && lines . get ( 0 ) . startsWith ( X509_PEM_HEADER ) , "Key is not in PEM-encoded X.509 format, " + "please check that the header begins with -----" + X509_PEM_HEADER + "-----" ) ; String base64Encoded = lines . stream ( ) . filter ( RsaKeyConverters :: isNotX509Wrapper ) . collect ( Collectors . joining ( ) ) ; byte [ ] x509 = Base64 . getDecoder ( ) . decode ( base64Encoded ) ; try { return ( RSAPublicKey ) keyFactory . generatePublic ( new X509EncodedKeySpec ( x509 ) ) ; } catch ( Exception e ) { throw new IllegalArgumentException ( e ) ; } } ;


signature:
public class StaticServerHttpHeadersWriter { /** * / * ( non - Javadoc )
 * @ see org . springframework . security . web . server . HttpHeadersWriter # writeHttpHeaders ( org . springframework . web . server . ServerWebExchange ) */
@ Override public Mono < Void > writeHttpHeaders ( ServerWebExchange exchange ) { } }

implementation: HttpHeaders headers = exchange . getResponse ( ) . getHeaders ( ) ; boolean containsOneHeaderToAdd = Collections . disjoint ( headers . keySet ( ) , this . headersToAdd . keySet ( ) ) ; if ( containsOneHeaderToAdd ) { this . headersToAdd . forEach ( ( name , values ) -> { headers . put ( name , values ) ; } ) ; } return Mono . empty ( ) ;


signature:
public class JdbcDaoImpl { /** * Executes the SQL < tt > usersByUsernameQuery < / tt > and returns a list of UserDetails
 * objects . There should normally only be one matching user . */
protected List < UserDetails > loadUsersByUsername ( String username ) { } }

implementation: return getJdbcTemplate ( ) . query ( this . usersByUsernameQuery , new String [ ] { username } , new RowMapper < UserDetails > ( ) { @ Override public UserDetails mapRow ( ResultSet rs , int rowNum ) throws SQLException { String username = rs . getString ( 1 ) ; String password = rs . getString ( 2 ) ; boolean enabled = rs . getBoolean ( 3 ) ; return new User ( username , password , enabled , true , true , true , AuthorityUtils . NO_AUTHORITIES ) ; } } ) ;


signature:
public class JdbcDaoImpl { /** * Loads authorities by executing the SQL from < tt > authoritiesByUsernameQuery < / tt > .
 * @ return a list of GrantedAuthority objects for the user */
protected List < GrantedAuthority > loadUserAuthorities ( String username ) { } }

implementation: return getJdbcTemplate ( ) . query ( this . authoritiesByUsernameQuery , new String [ ] { username } , new RowMapper < GrantedAuthority > ( ) { @ Override public GrantedAuthority mapRow ( ResultSet rs , int rowNum ) throws SQLException { String roleName = JdbcDaoImpl . this . rolePrefix + rs . getString ( 2 ) ; return new SimpleGrantedAuthority ( roleName ) ; } } ) ;


signature:
public class JdbcDaoImpl { /** * Loads authorities by executing the SQL from
 * < tt > groupAuthoritiesByUsernameQuery < / tt > .
 * @ return a list of GrantedAuthority objects for the user */
protected List < GrantedAuthority > loadGroupAuthorities ( String username ) { } }

implementation: return getJdbcTemplate ( ) . query ( this . groupAuthoritiesByUsernameQuery , new String [ ] { username } , new RowMapper < GrantedAuthority > ( ) { @ Override public GrantedAuthority mapRow ( ResultSet rs , int rowNum ) throws SQLException { String roleName = getRolePrefix ( ) + rs . getString ( 3 ) ; return new SimpleGrantedAuthority ( roleName ) ; } } ) ;


signature:
public class JdbcDaoImpl { /** * Can be overridden to customize the creation of the final UserDetailsObject which is
 * returned by the < tt > loadUserByUsername < / tt > method .
 * @ param username the name originally passed to loadUserByUsername
 * @ param userFromUserQuery the object returned from the execution of the
 * @ param combinedAuthorities the combined array of authorities from all the authority
 * loading queries .
 * @ return the final UserDetails which should be used in the system . */
protected UserDetails createUserDetails ( String username , UserDetails userFromUserQuery , List < GrantedAuthority > combinedAuthorities ) { } }

implementation: String returnUsername = userFromUserQuery . getUsername ( ) ; if ( ! this . usernameBasedPrimaryKey ) { returnUsername = username ; } return new User ( returnUsername , userFromUserQuery . getPassword ( ) , userFromUserQuery . isEnabled ( ) , userFromUserQuery . isAccountNonExpired ( ) , userFromUserQuery . isCredentialsNonExpired ( ) , userFromUserQuery . isAccountNonLocked ( ) , combinedAuthorities ) ;


signature:
public class CsrfAuthenticationStrategy { /** * ( non - Javadoc )
 * @ see org . springframework . security . web . authentication . session .
 * SessionAuthenticationStrategy
 * # onAuthentication ( org . springframework . security . core . Authentication ,
 * javax . servlet . http . HttpServletRequest , javax . servlet . http . HttpServletResponse ) */
@ Override public void onAuthentication ( Authentication authentication , HttpServletRequest request , HttpServletResponse response ) throws SessionAuthenticationException { } }

implementation: boolean containsToken = this . csrfTokenRepository . loadToken ( request ) != null ; if ( containsToken ) { this . csrfTokenRepository . saveToken ( null , request , response ) ; CsrfToken newToken = this . csrfTokenRepository . generateToken ( request ) ; this . csrfTokenRepository . saveToken ( newToken , request , response ) ; request . setAttribute ( CsrfToken . class . getName ( ) , newToken ) ; request . setAttribute ( newToken . getParameterName ( ) , newToken ) ; }


signature:
public class AffirmativeBased { /** * This concrete implementation simply polls all configured
 * { @ link AccessDecisionVoter } s and grants access if any
 * < code > AccessDecisionVoter < / code > voted affirmatively . Denies access only if there
 * was a deny vote AND no affirmative votes .
 * If every < code > AccessDecisionVoter < / code > abstained from voting , the decision will
 * be based on the { @ link # isAllowIfAllAbstainDecisions ( ) } property ( defaults to
 * false ) .
 * @ param authentication the caller invoking the method
 * @ param object the secured object
 * @ param configAttributes the configuration attributes associated with the method
 * being invoked
 * @ throws AccessDeniedException if access is denied */
public void decide ( Authentication authentication , Object object , Collection < ConfigAttribute > configAttributes ) throws AccessDeniedException { } }

implementation:
int deny = 0 ; for ( AccessDecisionVoter voter : getDecisionVoters ( ) ) { int result = voter . vote ( authentication , object , configAttributes ) ; if ( logger . isDebugEnabled ( ) ) { logger . debug ( "Voter: " + voter + ", returned: " + result ) ; } switch ( result ) { case AccessDecisionVoter . ACCESS_GRANTED : return ; case AccessDecisionVoter . ACCESS_DENIED : deny ++ ; break ; default : break ; } } if ( deny > 0 ) { throw new AccessDeniedException ( messages . getMessage ( "AbstractAccessDecisionManager.accessDenied" , "Access is denied" ) ) ; } // To get this far , every AccessDecisionVoter abstained
checkAllowIfAllAbstainDecisions ( ) ;


signature: public class AccessDeniedHandlerImpl { public void handle ( HttpServletRequest request , HttpServletResponse response , AccessDeniedException accessDeniedException ) throws IOException , ServletException { } }

implementation:
if ( ! response . isCommitted ( ) ) { if ( errorPage != null ) { // Put exception into request scope ( perhaps of use to a view )
request . setAttribute ( WebAttributes . ACCESS_DENIED_403 , accessDeniedException ) ; // Set the 403 status code .
response . setStatus ( HttpStatus . FORBIDDEN . value ( ) ) ; // forward to error page .
RequestDispatcher dispatcher = request . getRequestDispatcher ( errorPage ) ; dispatcher . forward ( request , response ) ; } else { response . sendError ( HttpStatus . FORBIDDEN . value ( ) , HttpStatus . FORBIDDEN . getReasonPhrase ( ) ) ; } }


signature:
public class AccessDeniedHandlerImpl { /** * The error page to use . Must begin with a " / " and is interpreted relative to the
 * current context root .
 * @ param errorPage the dispatcher path to display
 * @ throws IllegalArgumentException if the argument doesn ' t comply with the above
 * limitations */
public void setErrorPage ( String errorPage ) { } }

implementation: if ( ( errorPage != null ) && ! errorPage . startsWith ( "/" ) ) { throw new IllegalArgumentException ( "errorPage must begin with '/'" ) ; } this . errorPage = errorPage ;


signature:
public class CurrentSecurityContextArgumentResolver { /** * resolve the argument to inject into the controller parameter .
 * @ param parameter the method parameter .
 * @ param bindingContext the binding context .
 * @ param exchange the server web exchange .
 * @ return the reactive mono object result . */
@ Override public Mono < Object > resolveArgument ( MethodParameter parameter , BindingContext bindingContext , ServerWebExchange exchange ) { } }

implementation: ReactiveAdapter adapter = getAdapterRegistry ( ) . getAdapter ( parameter . getParameterType ( ) ) ; Mono < SecurityContext > reactiveSecurityContext = ReactiveSecurityContextHolder . getContext ( ) ; if ( reactiveSecurityContext == null ) { return null ; } return reactiveSecurityContext . flatMap ( a -> { Object p = resolveSecurityContext ( parameter , a ) ; Mono < Object > o = Mono . justOrEmpty ( p ) ; return adapter == null ? o : Mono . just ( adapter . fromPublisher ( o ) ) ; } ) ;


signature:
public class CurrentSecurityContextArgumentResolver { /** * resolve the expression from { @ link CurrentSecurityContext } annotation to get the value .
 * @ param parameter the method parameter .
 * @ param securityContext the security context .
 * @ return the resolved object from expression . */
private Object resolveSecurityContext ( MethodParameter parameter , SecurityContext securityContext ) { } }

implementation: CurrentSecurityContext securityContextAnnotation = findMethodAnnotation ( CurrentSecurityContext . class , parameter ) ; Object securityContextResult = securityContext ; String expressionToParse = securityContextAnnotation . expression ( ) ; if ( StringUtils . hasLength ( expressionToParse ) ) { StandardEvaluationContext context = new StandardEvaluationContext ( ) ; context . setRootObject ( securityContext ) ; context . setVariable ( "this" , securityContext ) ; context . setBeanResolver ( beanResolver ) ; Expression expression = this . parser . parseExpression ( expressionToParse ) ; securityContextResult = expression . getValue ( context ) ; } if ( isInvalidType ( parameter , securityContextResult ) ) { if ( securityContextAnnotation . errorOnInvalidType ( ) ) { throw new ClassCastException ( securityContextResult + " is not assignable to " + parameter . getParameterType ( ) ) ; } else { return null ; } } return securityContextResult ;


signature:
public class DefaultServiceAuthenticationDetails { /** * If present , removes the artifactParameterName and the corresponding value from the
 * query String .
 * @ param request
 * @ return the query String minus the artifactParameterName and the corresponding
 * value . */
private String getQueryString ( final HttpServletRequest request , final Pattern artifactPattern ) { } }

implementation:
final String query = request . getQueryString ( ) ; if ( query == null ) { return null ; } final String result = artifactPattern . matcher ( query ) . replaceFirst ( "" ) ; if ( result . length ( ) == 0 ) { return null ; } // strip off the trailing & only if the artifact was the first query param
return result . startsWith ( "&" ) ? result . substring ( 1 ) : result ;


signature:
public class DefaultServiceAuthenticationDetails { /** * Creates a { @ link Pattern } that can be passed into the constructor . This allows the
 * { @ link Pattern } to be reused for every instance of
 * { @ link DefaultServiceAuthenticationDetails } .
 * @ param artifactParameterName
 * @ return */
static Pattern createArtifactPattern ( String artifactParameterName ) { } }

implementation: Assert . hasLength ( artifactParameterName , "artifactParameterName is expected to have a length" ) ; return Pattern . compile ( "&?" + Pattern . quote ( artifactParameterName ) + "=[^&]*" ) ;


signature:
public class DefaultServiceAuthenticationDetails { /** * Gets the port from the casServiceURL ensuring to return the proper value if the
 * default port is being used .
 * @ param casServiceUrl the casServerUrl to be used ( i . e .
 * " https : / / example . com / context / login / cas " )
 * @ return the port that is configured for the casServerUrl */
private static int getServicePort ( URL casServiceUrl ) { } }

implementation: int port = casServiceUrl . getPort ( ) ; if ( port == - 1 ) { port = casServiceUrl . getDefaultPort ( ) ; } return port ;


signature:
public class SpringSecurityAuthenticationSource { /** * Get the principals of the logged in user , in this case the distinguished name .
 * @ return the distinguished name of the logged in user . */
public String getPrincipal ( ) { } }

implementation: Authentication authentication = SecurityContextHolder . getContext ( ) . getAuthentication ( ) ; if ( authentication == null ) { log . warn ( "No Authentication object set in SecurityContext - returning empty String as Principal" ) ; return "" ; } Object principal = authentication . getPrincipal ( ) ; if ( principal instanceof LdapUserDetails ) { LdapUserDetails details = ( LdapUserDetails ) principal ; return details . getDn ( ) ; } else if ( authentication instanceof AnonymousAuthenticationToken ) { if ( log . isDebugEnabled ( ) ) { log . debug ( "Anonymous Authentication, returning empty String as Principal" ) ; } return "" ; } else { throw new IllegalArgumentException ( "The principal property of the authentication object" + "needs to be an LdapUserDetails." ) ; }


signature:
public class CsrfTokenArgumentResolver { /** * ( non - Javadoc )
 * @ see
 * org . springframework . web . method . support . HandlerMethodArgumentResolver # resolveArgument
 * ( org . springframework . core . MethodParameter ,
 * org . springframework . web . method . support . ModelAndViewContainer ,
 * org . springframework . web . context . request . NativeWebRequest ,
 * org . springframework . web . bind . support . WebDataBinderFactory ) */
public Object resolveArgument ( MethodParameter parameter , ModelAndViewContainer mavContainer , NativeWebRequest webRequest , WebDataBinderFactory binderFactory ) throws Exception { } }

implementation: CsrfToken token = ( CsrfToken ) webRequest . getAttribute ( CsrfToken . class . getName ( ) , NativeWebRequest . SCOPE_REQUEST ) ; return token ;


signature: public class LoggerListener { public void onApplicationEvent ( AbstractAuthenticationEvent event ) { } }

implementation: if ( ! logInteractiveAuthenticationSuccessEvents && event instanceof InteractiveAuthenticationSuccessEvent ) { return ; } if ( logger . isWarnEnabled ( ) ) { final StringBuilder builder = new StringBuilder ( ) ; builder . append ( "Authentication event " ) ; builder . append ( ClassUtils . getShortName ( event . getClass ( ) ) ) ; builder . append ( ": " ) ; builder . append ( event . getAuthentication ( ) . getName ( ) ) ; builder . append ( "; details: " ) ; builder . append ( event . getAuthentication ( ) . getDetails ( ) ) ; if ( event instanceof AbstractAuthenticationFailureEvent ) { builder . append ( "; exception: " ) ; builder . append ( ( ( AbstractAuthenticationFailureEvent ) event ) . getException ( ) . getMessage ( ) ) ; } logger . warn ( builder . toString ( ) ) ; }


signature:
public class GlobalMethodSecurityConfiguration { /** * Creates the default MethodInterceptor which is a MethodSecurityInterceptor using
 * the following methods to construct it .
 * < ul >
 * < li > { @ link # accessDecisionManager ( ) } < / li >
 * < li > { @ link # afterInvocationManager ( ) } < / li >
 * < li > { @ link # authenticationManager ( ) } < / li >
 * < li > { @ link # methodSecurityMetadataSource ( ) } < / li >
 * < li > { @ link # runAsManager ( ) } < / li >
 * < / ul >
 * Subclasses can override this method to provide a different
 * { @ link MethodInterceptor } .
 * @ return the { @ link MethodInterceptor } .
 * @ throws Exception */
@ Bean public MethodInterceptor methodSecurityInterceptor ( ) throws Exception { } }

implementation: this . methodSecurityInterceptor = isAspectJ ( ) ? new AspectJMethodSecurityInterceptor ( ) : new MethodSecurityInterceptor ( ) ; methodSecurityInterceptor . setAccessDecisionManager ( accessDecisionManager ( ) ) ; methodSecurityInterceptor . setAfterInvocationManager ( afterInvocationManager ( ) ) ; methodSecurityInterceptor . setSecurityMetadataSource ( methodSecurityMetadataSource ( ) ) ; RunAsManager runAsManager = runAsManager ( ) ; if ( runAsManager != null ) { methodSecurityInterceptor . setRunAsManager ( runAsManager ) ; } return this . methodSecurityInterceptor ;


signature:
public class GlobalMethodSecurityConfiguration { /** * ( non - Javadoc )
 * @ see org . springframework . beans . factory . SmartInitializingSingleton #
 * afterSingletonsInstantiated ( ) */
@ Override public void afterSingletonsInstantiated ( ) { } }

implementation: try { initializeMethodSecurityInterceptor ( ) ; } catch ( Exception e ) { throw new RuntimeException ( e ) ; } PermissionEvaluator permissionEvaluator = getSingleBeanOrNull ( PermissionEvaluator . class ) ; if ( permissionEvaluator != null ) { this . defaultMethodExpressionHandler . setPermissionEvaluator ( permissionEvaluator ) ; } RoleHierarchy roleHierarchy = getSingleBeanOrNull ( RoleHierarchy . class ) ; if ( roleHierarchy != null ) { this . defaultMethodExpressionHandler . setRoleHierarchy ( roleHierarchy ) ; } AuthenticationTrustResolver trustResolver = getSingleBeanOrNull ( AuthenticationTrustResolver . class ) ; if ( trustResolver != null ) { this . defaultMethodExpressionHandler . setTrustResolver ( trustResolver ) ; } GrantedAuthorityDefaults grantedAuthorityDefaults = getSingleBeanOrNull ( GrantedAuthorityDefaults . class ) ; if ( grantedAuthorityDefaults != null ) { this . defaultMethodExpressionHandler . setDefaultRolePrefix ( grantedAuthorityDefaults . getRolePrefix ( ) ) ; }


signature:
public class GlobalMethodSecurityConfiguration { /** * Provide a custom { @ link AfterInvocationManager } for the default implementation of
 * { @ link # methodSecurityInterceptor ( ) } . The default is null if pre post is not
 * enabled . Otherwise , it returns a { @ link AfterInvocationProviderManager } .
 * Subclasses should override this method to provide a custom
 * { @ link AfterInvocationManager }
 * @ return the { @ link AfterInvocationManager } to use */
protected AfterInvocationManager afterInvocationManager ( ) { } }

implementation: if ( prePostEnabled ( ) ) { AfterInvocationProviderManager invocationProviderManager = new AfterInvocationProviderManager ( ) ; ExpressionBasedPostInvocationAdvice postAdvice = new ExpressionBasedPostInvocationAdvice ( getExpressionHandler ( ) ) ; PostInvocationAdviceProvider postInvocationAdviceProvider = new PostInvocationAdviceProvider ( postAdvice ) ; List < AfterInvocationProvider > afterInvocationProviders = new ArrayList < > ( ) ; afterInvocationProviders . add ( postInvocationAdviceProvider ) ; invocationProviderManager . setProviders ( afterInvocationProviders ) ; return invocationProviderManager ; } return null ;


signature:
public class GlobalMethodSecurityConfiguration { /** * Allows subclasses to provide a custom { @ link AccessDecisionManager } . The default is
 * a { @ link AffirmativeBased } with the following voters :
 * < ul >
 * < li > { @ link PreInvocationAuthorizationAdviceVoter } < / li >
 * < li > { @ link RoleVoter } < / li >
 * < li > { @ link AuthenticatedVoter } < / li >
 * < / ul >
 * @ return the { @ link AccessDecisionManager } to use */
protected AccessDecisionManager accessDecisionManager ( ) { } }

implementation: List < AccessDecisionVoter < ? extends Object > > decisionVoters = new ArrayList < AccessDecisionVoter < ? extends Object > > ( ) ; ExpressionBasedPreInvocationAdvice expressionAdvice = new ExpressionBasedPreInvocationAdvice ( ) ; expressionAdvice . setExpressionHandler ( getExpressionHandler ( ) ) ; if ( prePostEnabled ( ) ) { decisionVoters . add ( new PreInvocationAuthorizationAdviceVoter ( expressionAdvice ) ) ; } if ( jsr250Enabled ( ) ) { decisionVoters . add ( new Jsr250Voter ( ) ) ; } RoleVoter roleVoter = new RoleVoter ( ) ; GrantedAuthorityDefaults grantedAuthorityDefaults = getSingleBeanOrNull ( GrantedAuthorityDefaults . class ) ; if ( grantedAuthorityDefaults != null ) { roleVoter . setRolePrefix ( grantedAuthorityDefaults . getRolePrefix ( ) ) ; } decisionVoters . add ( roleVoter ) ; decisionVoters . add ( new AuthenticatedVoter ( ) ) ; return new AffirmativeBased ( decisionVoters ) ;


signature:
public class GlobalMethodSecurityConfiguration { /** * Allows providing a custom { @ link AuthenticationManager } . The default is to use any
 * authentication mechanisms registered by
 * { @ link # configure ( AuthenticationManagerBuilder ) } . If
 * { @ link # configure ( AuthenticationManagerBuilder ) } was not overridden , then an
 * { @ link AuthenticationManager } is attempted to be autowired by type .
 * @ return the { @ link AuthenticationManager } to use */
protected AuthenticationManager authenticationManager ( ) throws Exception { } }

implementation: if ( authenticationManager == null ) { DefaultAuthenticationEventPublisher eventPublisher = objectPostProcessor . postProcess ( new DefaultAuthenticationEventPublisher ( ) ) ; auth = new AuthenticationManagerBuilder ( objectPostProcessor ) ; auth . authenticationEventPublisher ( eventPublisher ) ; configure ( auth ) ; if ( disableAuthenticationRegistry ) { authenticationManager = getAuthenticationConfiguration ( ) . getAuthenticationManager ( ) ; } else { authenticationManager = auth . build ( ) ; } } return authenticationManager ;


signature:
public class GlobalMethodSecurityConfiguration { /** * Provides the default { @ link MethodSecurityMetadataSource } that will be used . It
 * creates a { @ link DelegatingMethodSecurityMetadataSource } based upon
 * { @ link # customMethodSecurityMetadataSource ( ) } and the attributes on
 * { @ link EnableGlobalMethodSecurity } .
 * @ return the { @ link MethodSecurityMetadataSource } */
@ Bean public MethodSecurityMetadataSource methodSecurityMetadataSource ( ) { } }

implementation: List < MethodSecurityMetadataSource > sources = new ArrayList < > ( ) ; ExpressionBasedAnnotationAttributeFactory attributeFactory = new ExpressionBasedAnnotationAttributeFactory ( getExpressionHandler ( ) ) ; MethodSecurityMetadataSource customMethodSecurityMetadataSource = customMethodSecurityMetadataSource ( ) ; if ( customMethodSecurityMetadataSource != null ) { sources . add ( customMethodSecurityMetadataSource ) ; } boolean hasCustom = customMethodSecurityMetadataSource != null ; boolean isPrePostEnabled = prePostEnabled ( ) ; boolean isSecuredEnabled = securedEnabled ( ) ; boolean isJsr250Enabled = jsr250Enabled ( ) ; if ( ! isPrePostEnabled && ! isSecuredEnabled && ! isJsr250Enabled && ! hasCustom ) { throw new IllegalStateException ( "In the composition of all global method configuration, " + "no annotation support was actually activated" ) ; } if ( isPrePostEnabled ) { sources . add ( new PrePostAnnotationSecurityMetadataSource ( attributeFactory ) ) ; } if ( isSecuredEnabled ) { sources . add ( new SecuredAnnotationSecurityMetadataSource ( ) ) ; } if ( isJsr250Enabled ) { GrantedAuthorityDefaults grantedAuthorityDefaults = getSingleBeanOrNull ( GrantedAuthorityDefaults . class ) ; Jsr250MethodSecurityMetadataSource jsr250MethodSecurityMetadataSource = this . context . getBean ( Jsr250MethodSecurityMetadataSource . class ) ; if ( grantedAuthorityDefaults != null ) { jsr250MethodSecurityMetadataSource . setDefaultRolePrefix ( grantedAuthorityDefaults . getRolePrefix ( ) ) ; } sources . add ( jsr250MethodSecurityMetadataSource ) ; } return new DelegatingMethodSecurityMetadataSource ( sources ) ;


signature:
public class GlobalMethodSecurityConfiguration { /** * Creates the { @ link PreInvocationAuthorizationAdvice } to be used . The default is
 * { @ link ExpressionBasedPreInvocationAdvice } .
 * @ return the { @ link PreInvocationAuthorizationAdvice } */
@ Bean public PreInvocationAuthorizationAdvice preInvocationAuthorizationAdvice ( ) { } }

implementation: ExpressionBasedPreInvocationAdvice preInvocationAdvice = new ExpressionBasedPreInvocationAdvice ( ) ; preInvocationAdvice . setExpressionHandler ( getExpressionHandler ( ) ) ; return preInvocationAdvice ;


signature:
public class GlobalMethodSecurityConfiguration { /** * Obtains the attributes from { @ link EnableGlobalMethodSecurity } if this class was
 * imported using the { @ link EnableGlobalMethodSecurity } annotation . */
public final void setImportMetadata ( AnnotationMetadata importMetadata ) { } }

implementation: Map < String , Object > annotationAttributes = importMetadata . getAnnotationAttributes ( EnableGlobalMethodSecurity . class . getName ( ) ) ; enableMethodSecurity = AnnotationAttributes . fromMap ( annotationAttributes ) ;


signature: public class InMemoryConfiguration { @ Override public AppConfigurationEntry [ ] getAppConfigurationEntry ( String name ) { } }

implementation: AppConfigurationEntry [ ] mappedResult = this . mappedConfigurations . get ( name ) ; return mappedResult == null ? this . defaultConfiguration : mappedResult ;


signature:
public class DefaultBearerTokenResolver { /** * { @ inheritDoc } */
@ Override public String resolve ( HttpServletRequest request ) { } }

implementation: String authorizationHeaderToken = resolveFromAuthorizationHeader ( request ) ; String parameterToken = resolveFromRequestParameters ( request ) ; if ( authorizationHeaderToken != null ) { if ( parameterToken != null ) { BearerTokenError error = new BearerTokenError ( BearerTokenErrorCodes . INVALID_REQUEST , HttpStatus . BAD_REQUEST , "Found multiple bearer tokens in the request" , "https://tools.ietf.org/html/rfc6750#section-3.1" ) ; throw new OAuth2AuthenticationException ( error ) ; } return authorizationHeaderToken ; } else if ( parameterToken != null && isParameterTokenSupportedForRequest ( request ) ) { return parameterToken ; } return null ;


signature:
public class MappedJwtClaimSetConverter { /** * Construct a { @ link MappedJwtClaimSetConverter } , overriding individual claim
 * converters with the provided { @ link Map } of { @ link Converter } s .
 * For example , the following would give an instance that is configured with only the default
 * claim converters :
 * < pre >
 * MappedJwtClaimSetConverter . withDefaults ( Collections . emptyMap ( ) ) ;
 * < / pre >
 * Or , the following would supply a custom converter for the subject , leaving the other defaults
 * in place :
 * < pre >
 * MappedJwtClaimsSetConverter . withDefaults (
 * Collections . singletonMap ( JwtClaimNames . SUB , new UserDetailsServiceJwtSubjectConverter ( ) ) ) ;
 * < / pre >
 * To completely replace the underlying { @ link Map } of converters , { @ see MappedJwtClaimSetConverter ( Map ) } .
 * @ param claimConverters
 * @ return An instance of { @ link MappedJwtClaimSetConverter } that contains the converters provided ,
 * plus any defaults that were not overridden . */
public static MappedJwtClaimSetConverter withDefaults ( Map < String , Converter < Object , ? > > claimConverters ) { } }

implementation: Assert . notNull ( claimConverters , "claimConverters cannot be null" ) ; Map < String , Converter < Object , ? > > claimNameToConverter = new HashMap < > ( ) ; claimNameToConverter . put ( JwtClaimNames . AUD , AUDIENCE_CONVERTER ) ; claimNameToConverter . put ( JwtClaimNames . EXP , TEMPORAL_CONVERTER ) ; claimNameToConverter . put ( JwtClaimNames . IAT , TEMPORAL_CONVERTER ) ; claimNameToConverter . put ( JwtClaimNames . ISS , ISSUER_CONVERTER ) ; claimNameToConverter . put ( JwtClaimNames . JTI , STRING_CONVERTER ) ; claimNameToConverter . put ( JwtClaimNames . NBF , TEMPORAL_CONVERTER ) ; claimNameToConverter . put ( JwtClaimNames . SUB , STRING_CONVERTER ) ; claimNameToConverter . putAll ( claimConverters ) ; return new MappedJwtClaimSetConverter ( claimNameToConverter ) ;


signature:
public class MappedJwtClaimSetConverter { /** * { @ inheritDoc } */
@ Override public Map < String , Object > convert ( Map < String , Object > claims ) { } }

implementation: Assert . notNull ( claims , "claims cannot be null" ) ; Map < String , Object > mappedClaims = new HashMap < > ( claims ) ; for ( Map . Entry < String , Converter < Object , ? > > entry : this . claimConverters . entrySet ( ) ) { String claimName = entry . getKey ( ) ; Converter < Object , ? > converter = entry . getValue ( ) ; if ( converter != null ) { Object claim = claims . get ( claimName ) ; Object mappedClaim = converter . convert ( claim ) ; mappedClaims . compute ( claimName , ( key , value ) -> mappedClaim ) ; } } Instant issuedAt = ( Instant ) mappedClaims . get ( JwtClaimNames . IAT ) ; Instant expiresAt = ( Instant ) mappedClaims . get ( JwtClaimNames . EXP ) ; if ( issuedAt == null && expiresAt != null ) { mappedClaims . put ( JwtClaimNames . IAT , expiresAt . minusSeconds ( 1 ) ) ; } return mappedClaims ;


signature:
public class FilterSecurityInterceptor { /** * Method that is actually called by the filter chain . Simply delegates to the
 * { @ link # invoke ( FilterInvocation ) } method .
 * @ param request the servlet request
 * @ param response the servlet response
 * @ param chain the filter chain
 * @ throws IOException if the filter chain fails
 * @ throws ServletException if the filter chain fails */
public void doFilter ( ServletRequest request , ServletResponse response , FilterChain chain ) throws IOException , ServletException { } }

implementation: FilterInvocation fi = new FilterInvocation ( request , response , chain ) ; invoke ( fi ) ;


signature:
public class ExceptionMappingAuthenticationFailureHandler { /** * Sets the map of exception types ( by name ) to URLs .
 * @ param failureUrlMap the map keyed by the fully - qualified name of the exception
 * class , with the corresponding failure URL as the value .
 * @ throws IllegalArgumentException if the entries are not Strings or the URL is not
 * valid . */
public void setExceptionMappings ( Map < ? , ? > failureUrlMap ) { } }

implementation: this . failureUrlMap . clear ( ) ; for ( Map . Entry < ? , ? > entry : failureUrlMap . entrySet ( ) ) { Object exception = entry . getKey ( ) ; Object url = entry . getValue ( ) ; Assert . isInstanceOf ( String . class , exception , "Exception key must be a String (the exception classname)." ) ; Assert . isInstanceOf ( String . class , url , "URL must be a String" ) ; Assert . isTrue ( UrlUtils . isValidRedirectUrl ( ( String ) url ) , ( ) -> "Not a valid redirect URL: " + url ) ; this . failureUrlMap . put ( ( String ) exception , ( String ) url ) ; }


signature:
public class ServerHttpSecurity { /** * Adds a { @ link WebFilter } after specific position .
 * @ param webFilter the { @ link WebFilter } to add
 * @ param order the place after which to insert the { @ link WebFilter }
 * @ return the { @ link ServerHttpSecurity } to continue configuring
 * @ since 5.2.0
 * @ author Ankur Pathak */
public ServerHttpSecurity addFilterAfter ( WebFilter webFilter , SecurityWebFiltersOrder order ) { } }

implementation: this . webFilters . add ( new OrderedWebFilter ( webFilter , order . getOrder ( ) + 1 ) ) ; return this ;


signature:
public class ServerHttpSecurity { /** * Builds the { @ link SecurityWebFilterChain }
 * @ return the { @ link SecurityWebFilterChain */
public SecurityWebFilterChain build ( ) { } }

implementation: if ( this . built != null ) { throw new IllegalStateException ( "This has already been built with the following stacktrace. " + buildToString ( ) ) ; } this . built = new RuntimeException ( "First Build Invocation" ) . fillInStackTrace ( ) ; if ( this . headers != null ) { this . headers . configure ( this ) ; } WebFilter securityContextRepositoryWebFilter = securityContextRepositoryWebFilter ( ) ; if ( securityContextRepositoryWebFilter != null ) { this . webFilters . add ( securityContextRepositoryWebFilter ) ; } if ( this . httpsRedirectSpec != null ) { this . httpsRedirectSpec . configure ( this ) ; } if ( this . x509 != null ) { this . x509 . configure ( this ) ; } if ( this . csrf != null ) { this . csrf . configure ( this ) ; } if ( this . cors != null ) { this . cors . configure ( this ) ; } if ( this . httpBasic != null ) { this . httpBasic . authenticationManager ( this . authenticationManager ) ; this . httpBasic . configure ( this ) ; } if ( this . formLogin != null ) { this . formLogin . authenticationManager ( this . authenticationManager ) ; if ( this . securityContextRepository != null ) { this . formLogin . securityContextRepository ( this . securityContextRepository ) ; } this . formLogin . configure ( this ) ; } if ( this . oauth2Login != null ) { this . oauth2Login . configure ( this ) ; } if ( this . resourceServer != null ) { this . resourceServer . configure ( this ) ; } if ( this . client != null ) { this . client . configure ( this ) ; } if ( this . anonymous != null ) { this . anonymous . configure ( this ) ; } this . loginPage . configure ( this ) ; if ( this . logout != null ) { this . logout . configure ( this ) ; } this . requestCache . configure ( this ) ; this . addFilterAt ( new SecurityContextServerWebExchangeWebFilter ( ) , SecurityWebFiltersOrder . SECURITY_CONTEXT_SERVER_WEB_EXCHANGE ) ; if ( this . authorizeExchange != null ) { ServerAuthenticationEntryPoint authenticationEntryPoint = getAuthenticationEntryPoint ( ) ; ExceptionTranslationWebFilter exceptionTranslationWebFilter = new ExceptionTranslationWebFilter ( ) ; if ( authenticationEntryPoint != null ) { exceptionTranslationWebFilter . setAuthenticationEntryPoint ( authenticationEntryPoint ) ; } ServerAccessDeniedHandler accessDeniedHandler = getAccessDeniedHandler ( ) ; if ( accessDeniedHandler != null ) { exceptionTranslationWebFilter . setAccessDeniedHandler ( accessDeniedHandler ) ; } this . addFilterAt ( exceptionTranslationWebFilter , SecurityWebFiltersOrder . EXCEPTION_TRANSLATION ) ; this . authorizeExchange . configure ( this ) ; } AnnotationAwareOrderComparator . sort ( this . webFilters ) ; List < WebFilter > sortedWebFilters = new ArrayList < > ( ) ; this . webFilters . forEach ( f -> { if ( f instanceof OrderedWebFilter ) { f = ( ( OrderedWebFilter ) f ) . webFilter ; } sortedWebFilters . add ( f ) ; } ) ; sortedWebFilters . add ( 0 , new ServerWebExchangeReactorContextWebFilter ( ) ) ; return new MatcherSecurityWebFilterChain ( getSecurityMatcher ( ) , sortedWebFilters ) ;


signature:
public class SecurityContextLogoutHandler { /** * Requires the request to be passed in .
 * @ param request from which to obtain a HTTP session ( cannot be null )
 * @ param response not used ( can be < code > null < / code > )
 * @ param authentication not used ( can be < code > null < / code > ) */
public void logout ( HttpServletRequest request , HttpServletResponse response , Authentication authentication ) { } }

implementation: Assert . notNull ( request , "HttpServletRequest required" ) ; if ( invalidateHttpSession ) { HttpSession session = request . getSession ( false ) ; if ( session != null ) { logger . debug ( "Invalidating session: " + session . getId ( ) ) ; session . invalidate ( ) ; } } if ( clearAuthentication ) { SecurityContext context = SecurityContextHolder . getContext ( ) ; context . setAuthentication ( null ) ; } SecurityContextHolder . clearContext ( ) ;


signature:
public class HttpStatusReturningServerLogoutSuccessHandler { /** * Implementation of { @ link ServerLogoutSuccessHandler # onLogoutSuccess ( WebFilterExchange , Authentication ) } . Sets the status
 * on the { @ link WebFilterExchange } .
 * @ param exchange The exchange
 * @ param authentication The { @ link Authentication }
 * @ return A completion notification ( success or error ) */
@ Override public Mono < Void > onLogoutSuccess ( WebFilterExchange exchange , Authentication authentication ) { } }

implementation: return Mono . fromRunnable ( ( ) -> exchange . getExchange ( ) . getResponse ( ) . setStatusCode ( this . httpStatusToReturn ) ) ;


signature:
public class AbstractJaasAuthenticationProvider { /** * Validates the required properties are set . In addition , if
 * { @ link # setCallbackHandlers ( JaasAuthenticationCallbackHandler [ ] ) } has not been
 * called with valid handlers , initializes to use { @ link JaasNameCallbackHandler } and
 * { @ link JaasPasswordCallbackHandler } . */
public void afterPropertiesSet ( ) throws Exception { } }

implementation: Assert . hasLength ( this . loginContextName , "loginContextName cannot be null or empty" ) ; Assert . notEmpty ( this . authorityGranters , "authorityGranters cannot be null or empty" ) ; if ( ObjectUtils . isEmpty ( this . callbackHandlers ) ) { setCallbackHandlers ( new JaasAuthenticationCallbackHandler [ ] { new JaasNameCallbackHandler ( ) , new JaasPasswordCallbackHandler ( ) } ) ; } Assert . notNull ( this . loginExceptionResolver , "loginExceptionResolver cannot be null" ) ;


signature:
public class AbstractJaasAuthenticationProvider { /** * Attempts to login the user given the Authentication objects principal and
 * credential
 * @ param auth The Authentication object to be authenticated .
 * @ return The authenticated Authentication object , with it ' s grantedAuthorities set .
 * @ throws AuthenticationException This implementation does not handle ' locked ' or
 * ' disabled ' accounts . This method only throws a AuthenticationServiceException , with
 * the message of the LoginException that will be thrown , should the
 * loginContext . login ( ) method fail . */
public Authentication authenticate ( Authentication auth ) throws AuthenticationException { } }

implementation:
if ( ! ( auth instanceof UsernamePasswordAuthenticationToken ) ) { return null ; } UsernamePasswordAuthenticationToken request = ( UsernamePasswordAuthenticationToken ) auth ; Set < GrantedAuthority > authorities ; try { // Create the LoginContext object , and pass our InternallCallbackHandler
LoginContext loginContext = createLoginContext ( new InternalCallbackHandler ( auth ) ) ; // Attempt to login the user , the LoginContext will call our
// InternalCallbackHandler at this point .
loginContext . login ( ) ; // Create a set to hold the authorities , and add any that have already been
// applied .
authorities = new HashSet < > ( ) ; // Get the subject principals and pass them to each of the AuthorityGranters
Set < Principal > principals = loginContext . getSubject ( ) . getPrincipals ( ) ; for ( Principal principal : principals ) { for ( AuthorityGranter granter : this . authorityGranters ) { Set < String > roles = granter . grant ( principal ) ; // If the granter doesn ' t wish to grant any authorities , it should
// return null .
if ( ( roles != null ) && ! roles . isEmpty ( ) ) { for ( String role : roles ) { authorities . add ( new JaasGrantedAuthority ( role , principal ) ) ; } } } } // Convert the authorities set back to an array and apply it to the token .
JaasAuthenticationToken result = new JaasAuthenticationToken ( request . getPrincipal ( ) , request . getCredentials ( ) , new ArrayList < > ( authorities ) , loginContext ) ; // Publish the success event
publishSuccessEvent ( result ) ; // we ' re done , return the token .
return result ; } catch ( LoginException loginException ) { AuthenticationException ase = this . loginExceptionResolver . resolveException ( loginException ) ; publishFailureEvent ( request , ase ) ; throw ase ; }


signature:
public class AbstractJaasAuthenticationProvider { /** * Handles the logout by getting the security contexts for the destroyed session and
 * invoking { @ code LoginContext . logout ( ) } for any which contain a
 * { @ code JaasAuthenticationToken } .
 * @ param event the session event which contains the current session */
protected void handleLogout ( SessionDestroyedEvent event ) { } }

implementation: List < SecurityContext > contexts = event . getSecurityContexts ( ) ; if ( contexts . isEmpty ( ) ) { this . log . debug ( "The destroyed session has no SecurityContexts" ) ; return ; } for ( SecurityContext context : contexts ) { Authentication auth = context . getAuthentication ( ) ; if ( ( auth != null ) && ( auth instanceof JaasAuthenticationToken ) ) { JaasAuthenticationToken token = ( JaasAuthenticationToken ) auth ; try { LoginContext loginContext = token . getLoginContext ( ) ; boolean debug = this . log . isDebugEnabled ( ) ; if ( loginContext != null ) { if ( debug ) { this . log . debug ( "Logging principal: [" + token . getPrincipal ( ) + "] out of LoginContext" ) ; } loginContext . logout ( ) ; } else if ( debug ) { this . log . debug ( "Cannot logout principal: [" + token . getPrincipal ( ) + "] from LoginContext. " + "The LoginContext is unavailable" ) ; } } catch ( LoginException e ) { this . log . warn ( "Error error logging out of LoginContext" , e ) ; } } }


signature:
public class AbstractJaasAuthenticationProvider { /** * Publishes the { @ link JaasAuthenticationFailedEvent } . Can be overridden by
 * subclasses for different functionality
 * @ param token The authentication token being processed
 * @ param ase The excetion that caused the authentication failure */
protected void publishFailureEvent ( UsernamePasswordAuthenticationToken token , AuthenticationException ase ) { } }

implementation: if ( this . applicationEventPublisher != null ) { this . applicationEventPublisher . publishEvent ( new JaasAuthenticationFailedEvent ( token , ase ) ) ; }


signature:
public class DelegatingSecurityContextRunnable { /** * Factory method for creating a { @ link DelegatingSecurityContextRunnable } .
 * @ param delegate the original { @ link Runnable } that will be delegated to after
 * establishing a { @ link SecurityContext } on the { @ link SecurityContextHolder } . Cannot
 * have null .
 * @ param securityContext the { @ link SecurityContext } to establish before invoking the
 * delegate { @ link Runnable } . If null , the current { @ link SecurityContext } from the
 * { @ link SecurityContextHolder } will be used .
 * @ return */
public static Runnable create ( Runnable delegate , SecurityContext securityContext ) { } }

implementation: Assert . notNull ( delegate , "delegate cannot be  null" ) ; return securityContext == null ? new DelegatingSecurityContextRunnable ( delegate ) : new DelegatingSecurityContextRunnable ( delegate , securityContext ) ;


signature: public class DefaultFilterInvocationSecurityMetadataSource { public Collection < ConfigAttribute > getAllConfigAttributes ( ) { } }

implementation: Set < ConfigAttribute > allAttributes = new HashSet < > ( ) ; for ( Map . Entry < RequestMatcher , Collection < ConfigAttribute > > entry : requestMap . entrySet ( ) ) { allAttributes . addAll ( entry . getValue ( ) ) ; } return allAttributes ;


signature:
public class UserAttribute { /** * Set all authorities for this user from String values . It will create the necessary
 * { @ link GrantedAuthority } objects .
 * @ param authoritiesAsStrings { @ link List } & lt ; { @ link String } & gt ;
 * @ since 1.1 */
public void setAuthoritiesAsString ( List < String > authoritiesAsStrings ) { } }

implementation: setAuthorities ( new ArrayList < > ( authoritiesAsStrings . size ( ) ) ) ; for ( String authority : authoritiesAsStrings ) { addAuthority ( new SimpleGrantedAuthority ( authority ) ) ; }


signature:
public class SecurityHeaders { /** * Sets the provided value as a Bearer token in a header with the name of { @ link HttpHeaders # AUTHORIZATION }
 * @ param bearerTokenValue the bear token value
 * @ return a { @ link Consumer } that sets the header . */
public static Consumer < HttpHeaders > bearerToken ( String bearerTokenValue ) { } }

implementation: Assert . hasText ( bearerTokenValue , "bearerTokenValue cannot be null" ) ; return headers -> headers . set ( HttpHeaders . AUTHORIZATION , "Bearer " + bearerTokenValue ) ;


signature:
public class DefaultSpringSecurityContextSource { /** * Builds a Spring LDAP - compliant Provider URL string , i . e . a space - separated list of
 * LDAP servers with their base DNs . As the base DN must be identical for all servers ,
 * it needs to be supplied only once .
 * @ param urls A list of string values which are LDAP server URLs . An example would be
 * < pre >
 * ldap : / / ldap . company . com : 389
 * < / pre >
 * . LDAPS URLs may be used as well , given that Spring Security is able to connect to
 * the server .
 * @ param baseDn The common Base DN for all provided servers , e . g .
 * < pre >
 * dc = company , dc = com
 * < / pre >
 * @ return A Spring Security / Spring LDAP - compliant Provider URL string . */
private static String buildProviderUrl ( List < String > urls , String baseDn ) { } }

implementation: Assert . notNull ( baseDn , "The Base DN for the LDAP server must not be null." ) ; Assert . notEmpty ( urls , "At least one LDAP server URL must be provided." ) ; String trimmedBaseDn = baseDn . trim ( ) ; StringBuilder providerUrl = new StringBuilder ( ) ; for ( String serverUrl : urls ) { String trimmedUrl = serverUrl . trim ( ) ; if ( "" . equals ( trimmedUrl ) ) { continue ; } providerUrl . append ( trimmedUrl ) ; if ( ! trimmedUrl . endsWith ( "/" ) ) { providerUrl . append ( "/" ) ; } providerUrl . append ( trimmedBaseDn ) ; providerUrl . append ( " " ) ; } return providerUrl . toString ( ) ;


signature:
public class ActiveDirectoryLdapAuthenticationProvider { /** * Creates the user authority list from the values of the { @ code memberOf } attribute
 * obtained from the user ' s Active Directory entry . */
@ Override protected Collection < ? extends GrantedAuthority > loadUserAuthorities ( DirContextOperations userData , String username , String password ) { } }

implementation: String [ ] groups = userData . getStringAttributes ( "memberOf" ) ; if ( groups == null ) { logger . debug ( "No values for 'memberOf' attribute." ) ; return AuthorityUtils . NO_AUTHORITIES ; } if ( logger . isDebugEnabled ( ) ) { logger . debug ( "'memberOf' attribute values: " + Arrays . asList ( groups ) ) ; } ArrayList < GrantedAuthority > authorities = new ArrayList < > ( groups . length ) ; for ( String group : groups ) { authorities . add ( new SimpleGrantedAuthority ( new DistinguishedName ( group ) . removeLast ( ) . getValue ( ) ) ) ; } return authorities ;


signature:
public class ActiveDirectoryLdapAuthenticationProvider { /** * Allows a custom environment properties to be used to create initial LDAP context .
 * @ param environment the additional environment parameters to use when creating the LDAP Context */
public void setContextEnvironmentProperties ( Map < String , Object > environment ) { } }

implementation: Assert . notEmpty ( environment , "environment must not be empty" ) ; this . contextEnvironmentProperties = new Hashtable < > ( environment ) ;


signature:
public class WebSessionOAuth2ServerAuthorizationRequestRepository { /** * Gets the state parameter from the { @ link ServerHttpRequest }
 * @ param exchange the exchange to use
 * @ return the state parameter or null if not found */
private String getStateParameter ( ServerWebExchange exchange ) { } }

implementation: Assert . notNull ( exchange , "exchange cannot be null" ) ; return exchange . getRequest ( ) . getQueryParams ( ) . getFirst ( OAuth2ParameterNames . STATE ) ;


signature:
public class DefaultSavedRequest { /** * Determines if the current request matches the < code > DefaultSavedRequest < / code > .
 * All URL arguments are considered but not cookies , locales , headers or parameters .
 * @ param request the actual request to be matched against this one
 * @ param portResolver used to obtain the server port of the request
 * @ return true if the request is deemed to match this one . */
public boolean doesRequestMatch ( HttpServletRequest request , PortResolver portResolver ) { } }

implementation:
if ( ! propertyEquals ( "pathInfo" , this . pathInfo , request . getPathInfo ( ) ) ) { return false ; } if ( ! propertyEquals ( "queryString" , this . queryString , request . getQueryString ( ) ) ) { return false ; } if ( ! propertyEquals ( "requestURI" , this . requestURI , request . getRequestURI ( ) ) ) { return false ; } if ( ! "GET" . equals ( request . getMethod ( ) ) && "GET" . equals ( method ) ) { // A save GET should not match an incoming non - GET method
return false ; } if ( ! propertyEquals ( "serverPort" , Integer . valueOf ( this . serverPort ) , Integer . valueOf ( portResolver . getServerPort ( request ) ) ) ) { return false ; } if ( ! propertyEquals ( "requestURL" , this . requestURL , request . getRequestURL ( ) . toString ( ) ) ) { return false ; } if ( ! propertyEquals ( "scheme" , this . scheme , request . getScheme ( ) ) ) { return false ; } if ( ! propertyEquals ( "serverName" , this . serverName , request . getServerName ( ) ) ) { return false ; } if ( ! propertyEquals ( "contextPath" , this . contextPath , request . getContextPath ( ) ) ) { return false ; } return propertyEquals ( "servletPath" , this . servletPath , request . getServletPath ( ) ) ;


signature:
public class DefaultSavedRequest { /** * Indicates the URL that the user agent used for this request .
 * @ return the full URL of this request */
@ Override public String getRedirectUrl ( ) { } }

implementation: return UrlUtils . buildFullRequestUrl ( scheme , serverName , serverPort , requestURI , queryString ) ;


signature:
public class NimbusReactiveJwtDecoder { /** * Use the following { @ link Converter } for manipulating the JWT ' s claim set
 * @ param claimSetConverter the { @ link Converter } to use */
public void setClaimSetConverter ( Converter < Map < String , Object > , Map < String , Object > > claimSetConverter ) { } }

implementation: Assert . notNull ( claimSetConverter , "claimSetConverter cannot be null" ) ; this . claimSetConverter = claimSetConverter ;


signature:
public class CustomUserTypesOAuth2UserService { /** * Sets the { @ link Converter } used for converting the { @ link OAuth2UserRequest }
 * to a { @ link RequestEntity } representation of the UserInfo Request .
 * @ since 5.1
 * @ param requestEntityConverter the { @ link Converter } used for converting to a { @ link RequestEntity } representation of the UserInfo Request */
public final void setRequestEntityConverter ( Converter < OAuth2UserRequest , RequestEntity < ? > > requestEntityConverter ) { } }

implementation: Assert . notNull ( requestEntityConverter , "requestEntityConverter cannot be null" ) ; this . requestEntityConverter = requestEntityConverter ;


signature:
public class AuthenticationPrincipalArgumentResolver { /** * ( non - Javadoc )
 * @ see org . springframework . web . method . support . HandlerMethodArgumentResolver #
 * resolveArgument ( org . springframework . core . MethodParameter ,
 * org . springframework . web . method . support . ModelAndViewContainer ,
 * org . springframework . web . context . request . NativeWebRequest ,
 * org . springframework . web . bind . support . WebDataBinderFactory ) */
public Object resolveArgument ( MethodParameter parameter , ModelAndViewContainer mavContainer , NativeWebRequest webRequest , WebDataBinderFactory binderFactory ) throws Exception { } }

implementation: Authentication authentication = SecurityContextHolder . getContext ( ) . getAuthentication ( ) ; if ( authentication == null ) { return null ; } Object principal = authentication . getPrincipal ( ) ; if ( principal != null && ! parameter . getParameterType ( ) . isAssignableFrom ( principal . getClass ( ) ) ) { AuthenticationPrincipal authPrincipal = findMethodAnnotation ( AuthenticationPrincipal . class , parameter ) ; if ( authPrincipal . errorOnInvalidType ( ) ) { throw new ClassCastException ( principal + " is not assignable to " + parameter . getParameterType ( ) ) ; } else { return null ; } } return principal ;


signature:
public class JwtDecoders { /** * Creates a { @ link JwtDecoder } using the provided
 * < a href = " https : / / openid . net / specs / openid - connect - core - 1_0 . html # IssuerIdentifier " > Issuer < / a > by making an
 * < a href = " https : / / openid . net / specs / openid - connect - discovery - 1_0 . html # ProviderConfigurationRequest " > OpenID Provider
 * Configuration Request < / a > and using the values in the
 * < a href = " https : / / openid . net / specs / openid - connect - discovery - 1_0 . html # ProviderConfigurationResponse " > OpenID
 * Provider Configuration Response < / a > to initialize the { @ link JwtDecoder } .
 * @ param oidcIssuerLocation the < a href = " https : / / openid . net / specs / openid - connect - core - 1_0 . html # IssuerIdentifier " > Issuer < / a >
 * @ return a { @ link JwtDecoder } that was initialized by the OpenID Provider Configuration . */
public static JwtDecoder fromOidcIssuerLocation ( String oidcIssuerLocation ) { } }

implementation: Map < String , Object > openidConfiguration = getOpenidConfiguration ( oidcIssuerLocation ) ; String metadataIssuer = "(unavailable)" ; if ( openidConfiguration . containsKey ( "issuer" ) ) { metadataIssuer = openidConfiguration . get ( "issuer" ) . toString ( ) ; } if ( ! oidcIssuerLocation . equals ( metadataIssuer ) ) { throw new IllegalStateException ( "The Issuer \"" + metadataIssuer + "\" provided in the OpenID Configuration " + "did not match the requested issuer \"" + oidcIssuerLocation + "\"" ) ; } OAuth2TokenValidator < Jwt > jwtValidator = JwtValidators . createDefaultWithIssuer ( oidcIssuerLocation ) ; NimbusJwtDecoder jwtDecoder = withJwkSetUri ( openidConfiguration . get ( "jwks_uri" ) . toString ( ) ) . build ( ) ; jwtDecoder . setJwtValidator ( jwtValidator ) ; return jwtDecoder ;


signature:
public class HttpSecurityBeanDefinitionParser { /** * The aim of this method is to build the list of filters which have been defined by
 * the namespace elements and attributes within the & lt ; http & gt ; configuration , along
 * with any custom - filter ' s linked to user - defined filter beans .
 * By the end of this method , the default < tt > FilterChainProxy < / tt > bean should have
 * been registered and will have the map of filter chains defined , with the
 * " universal " match pattern mapped to the list of beans which have been parsed here . */
@ SuppressWarnings ( { } }

implementation:
"unchecked" } ) @ Override public BeanDefinition parse ( Element element , ParserContext pc ) { CompositeComponentDefinition compositeDef = new CompositeComponentDefinition ( element . getTagName ( ) , pc . extractSource ( element ) ) ; pc . pushContainingComponent ( compositeDef ) ; registerFilterChainProxyIfNecessary ( pc , pc . extractSource ( element ) ) ; // Obtain the filter chains and add the new chain to it
BeanDefinition listFactoryBean = pc . getRegistry ( ) . getBeanDefinition ( BeanIds . FILTER_CHAINS ) ; List < BeanReference > filterChains = ( List < BeanReference > ) listFactoryBean . getPropertyValues ( ) . getPropertyValue ( "sourceList" ) . getValue ( ) ; filterChains . add ( createFilterChain ( element , pc ) ) ; pc . popAndRegisterContainingComponent ( ) ; return null ;


signature:
public class HttpSecurityBeanDefinitionParser { /** * Creates the { @ code SecurityFilterChain } bean from an & lt ; http & gt ; element . */
private BeanReference createFilterChain ( Element element , ParserContext pc ) { } }

implementation:
boolean secured = ! OPT_SECURITY_NONE . equals ( element . getAttribute ( ATT_SECURED ) ) ; if ( ! secured ) { if ( ! StringUtils . hasText ( element . getAttribute ( ATT_PATH_PATTERN ) ) && ! StringUtils . hasText ( ATT_REQUEST_MATCHER_REF ) ) { pc . getReaderContext ( ) . error ( "The '" + ATT_SECURED + "' attribute must be used in combination with" + " the '" + ATT_PATH_PATTERN + "' or '" + ATT_REQUEST_MATCHER_REF + "' attributes." , pc . extractSource ( element ) ) ; } for ( int n = 0 ; n < element . getChildNodes ( ) . getLength ( ) ; n ++ ) { if ( element . getChildNodes ( ) . item ( n ) instanceof Element ) { pc . getReaderContext ( ) . error ( "If you are using <http> to define an unsecured pattern, " + "it cannot contain child elements." , pc . extractSource ( element ) ) ; } } return createSecurityFilterChainBean ( element , pc , Collections . emptyList ( ) ) ; } final BeanReference portMapper = createPortMapper ( element , pc ) ; final BeanReference portResolver = createPortResolver ( portMapper , pc ) ; ManagedList < BeanReference > authenticationProviders = new ManagedList < > ( ) ; BeanReference authenticationManager = createAuthenticationManager ( element , pc , authenticationProviders ) ; boolean forceAutoConfig = isDefaultHttpConfig ( element ) ; HttpConfigurationBuilder httpBldr = new HttpConfigurationBuilder ( element , forceAutoConfig , pc , portMapper , portResolver , authenticationManager ) ; AuthenticationConfigBuilder authBldr = new AuthenticationConfigBuilder ( element , forceAutoConfig , pc , httpBldr . getSessionCreationPolicy ( ) , httpBldr . getRequestCache ( ) , authenticationManager , httpBldr . getSessionStrategy ( ) , portMapper , portResolver , httpBldr . getCsrfLogoutHandler ( ) ) ; httpBldr . setLogoutHandlers ( authBldr . getLogoutHandlers ( ) ) ; httpBldr . setEntryPoint ( authBldr . getEntryPointBean ( ) ) ; httpBldr . setAccessDeniedHandler ( authBldr . getAccessDeniedHandlerBean ( ) ) ; authenticationProviders . addAll ( authBldr . getProviders ( ) ) ; List < OrderDecorator > unorderedFilterChain = new ArrayList < > ( ) ; unorderedFilterChain . addAll ( httpBldr . getFilters ( ) ) ; unorderedFilterChain . addAll ( authBldr . getFilters ( ) ) ; unorderedFilterChain . addAll ( buildCustomFilterList ( element , pc ) ) ; Collections . sort ( unorderedFilterChain , new OrderComparator ( ) ) ; checkFilterChainOrder ( unorderedFilterChain , pc , pc . extractSource ( element ) ) ; // The list of filter beans
List < BeanMetadataElement > filterChain = new ManagedList < > ( ) ; for ( OrderDecorator od : unorderedFilterChain ) { filterChain . add ( od . bean ) ; } return createSecurityFilterChainBean ( element , pc , filterChain ) ;


signature:
public class HttpSecurityBeanDefinitionParser { /** * Creates the internal AuthenticationManager bean which uses either the externally
 * registered ( global ) one as a parent or the bean specified by
 * " authentication - manager - ref " .
 * All the providers registered by this & lt ; http & gt ; block will be registered with the
 * internal authentication manager . */
private BeanReference createAuthenticationManager ( Element element , ParserContext pc , ManagedList < BeanReference > authenticationProviders ) { } }

implementation: String parentMgrRef = element . getAttribute ( ATT_AUTHENTICATION_MANAGER_REF ) ; BeanDefinitionBuilder authManager = BeanDefinitionBuilder . rootBeanDefinition ( ProviderManager . class ) ; authManager . addConstructorArgValue ( authenticationProviders ) ; if ( StringUtils . hasText ( parentMgrRef ) ) { RuntimeBeanReference parentAuthManager = new RuntimeBeanReference ( parentMgrRef ) ; authManager . addConstructorArgValue ( parentAuthManager ) ; RootBeanDefinition clearCredentials = new RootBeanDefinition ( ClearCredentialsMethodInvokingFactoryBean . class ) ; clearCredentials . getPropertyValues ( ) . addPropertyValue ( "targetObject" , parentAuthManager ) ; clearCredentials . getPropertyValues ( ) . addPropertyValue ( "targetMethod" , "isEraseCredentialsAfterAuthentication" ) ; authManager . addPropertyValue ( "eraseCredentialsAfterAuthentication" , clearCredentials ) ; } else { RootBeanDefinition amfb = new RootBeanDefinition ( AuthenticationManagerFactoryBean . class ) ; amfb . setRole ( BeanDefinition . ROLE_INFRASTRUCTURE ) ; String amfbId = pc . getReaderContext ( ) . generateBeanName ( amfb ) ; pc . registerBeanComponent ( new BeanComponentDefinition ( amfb , amfbId ) ) ; RootBeanDefinition clearCredentials = new RootBeanDefinition ( MethodInvokingFactoryBean . class ) ; clearCredentials . getPropertyValues ( ) . addPropertyValue ( "targetObject" , new RuntimeBeanReference ( amfbId ) ) ; clearCredentials . getPropertyValues ( ) . addPropertyValue ( "targetMethod" , "isEraseCredentialsAfterAuthentication" ) ; authManager . addConstructorArgValue ( new RuntimeBeanReference ( amfbId ) ) ; authManager . addPropertyValue ( "eraseCredentialsAfterAuthentication" , clearCredentials ) ; } authManager . getRawBeanDefinition ( ) . setSource ( pc . extractSource ( element ) ) ; BeanDefinition authMgrBean = authManager . getBeanDefinition ( ) ; String id = pc . getReaderContext ( ) . generateBeanName ( authMgrBean ) ; pc . registerBeanComponent ( new BeanComponentDefinition ( authMgrBean , id ) ) ; return new RuntimeBeanReference ( id ) ;


signature:
public class DelegatingOAuth2TokenValidator { /** * { @ inheritDoc } */
@ Override public OAuth2TokenValidatorResult validate ( T token ) { } }

implementation: Collection < OAuth2Error > errors = new ArrayList < > ( ) ; for ( OAuth2TokenValidator < T > validator : this . tokenValidators ) { errors . addAll ( validator . validate ( token ) . getErrors ( ) ) ; } return OAuth2TokenValidatorResult . failure ( errors ) ;


signature:
public class JspAuthorizeTag { /** * Invokes the base class { @ link AbstractAuthorizeTag # authorize ( ) } method to decide if
 * the body of the tag should be skipped or not .
 * @ return { @ link Tag # SKIP _ BODY } or { @ link Tag # EVAL _ BODY _ INCLUDE } */
public int doStartTag ( ) throws JspException { } }

implementation: try { authorized = super . authorize ( ) ; if ( ! authorized && TagLibConfig . isUiSecurityDisabled ( ) ) { pageContext . getOut ( ) . write ( TagLibConfig . getSecuredUiPrefix ( ) ) ; } if ( var != null ) { pageContext . setAttribute ( var , authorized , PageContext . PAGE_SCOPE ) ; } return TagLibConfig . evalOrSkip ( authorized ) ; } catch ( IOException e ) { throw new JspException ( e ) ; }


signature:
public class JspAuthorizeTag { /** * Default processing of the end tag returning EVAL _ PAGE .
 * @ return EVAL _ PAGE
 * @ see Tag # doEndTag ( ) */
public int doEndTag ( ) throws JspException { } }

implementation: try { if ( ! authorized && TagLibConfig . isUiSecurityDisabled ( ) ) { pageContext . getOut ( ) . write ( TagLibConfig . getSecuredUiSuffix ( ) ) ; } } catch ( IOException e ) { throw new JspException ( e ) ; } return EVAL_PAGE ;


signature:
public class UserDetailsManagerConfigurer { /** * Populates the users that have been added .
 * @ throws Exception */
@ Override protected void initUserDetailsService ( ) throws Exception { } }

implementation: for ( UserDetailsBuilder userBuilder : userBuilders ) { getUserDetailsService ( ) . createUser ( userBuilder . build ( ) ) ; } for ( UserDetails userDetails : this . users ) { getUserDetailsService ( ) . createUser ( userDetails ) ; }


signature:
public class UserDetailsManagerConfigurer { /** * Allows adding a user to the { @ link UserDetailsManager } that is being created . This
 * method can be invoked multiple times to add multiple users .
 * @ param userBuilder the user to add . Cannot be null .
 * @ return the { @ link UserDetailsBuilder } for further customizations */
@ SuppressWarnings ( "unchecked" ) public final C withUser ( User . UserBuilder userBuilder ) { } }

implementation: this . users . add ( userBuilder . build ( ) ) ; return ( C ) this ;


signature:
public class UserDetailsManagerConfigurer { /** * Allows adding a user to the { @ link UserDetailsManager } that is being created . This
 * method can be invoked multiple times to add multiple users .
 * @ param username the username for the user being added . Cannot be null .
 * @ return the { @ link UserDetailsBuilder } for further customizations */
@ SuppressWarnings ( "unchecked" ) public final UserDetailsBuilder withUser ( String username ) { } }

implementation: UserDetailsBuilder userBuilder = new UserDetailsBuilder ( ( C ) this ) ; userBuilder . username ( username ) ; this . userBuilders . add ( userBuilder ) ; return userBuilder ;


signature:
public class WebFluxSecurityConfiguration { /** * The default { @ link ServerHttpSecurity } configuration .
 * @ param http
 * @ return */
private SecurityWebFilterChain springSecurityFilterChain ( ServerHttpSecurity http ) { } }

implementation: http . authorizeExchange ( ) . anyExchange ( ) . authenticated ( ) ; if ( isOAuth2Present && OAuth2ClasspathGuard . shouldConfigure ( this . context ) ) { OAuth2ClasspathGuard . configure ( this . context , http ) ; } else { http . httpBasic ( ) . and ( ) . formLogin ( ) ; } SecurityWebFilterChain result = http . build ( ) ; return result ;


signature:
public class WebConfigUtils { /** * Checks the value of an XML attribute which represents a redirect URL . If not empty
 * or starting with " $ " ( potential placeholder ) , or starting with " # " ( potential
 * SpEL ) , " / " or " http " it will raise an error . */
static void validateHttpRedirect ( String url , ParserContext pc , Object source ) { } }

implementation: if ( ! StringUtils . hasText ( url ) || UrlUtils . isValidRedirectUrl ( url ) || url . startsWith ( "$" ) || url . startsWith ( "#" ) ) { return ; } pc . getReaderContext ( ) . warning ( url + " is not a valid redirect URL (must start with '/' or http(s))" , source ) ;


signature:
public class DigestAuthUtils { /** * Computes the < code > response < / code > portion of a Digest authentication header . Both
 * the server and user agent should compute the < code > response < / code > independently .
 * Provided as a static method to simplify the coding of user agents .
 * @ param passwordAlreadyEncoded true if the password argument is already encoded in
 * the correct format . False if it is plain text .
 * @ param username the user ' s login name .
 * @ param realm the name of the realm .
 * @ param password the user ' s password in plaintext or ready - encoded .
 * @ param httpMethod the HTTP request method ( GET , POST etc . )
 * @ param uri the request URI .
 * @ param qop the qop directive , or null if not set .
 * @ param nonce the nonce supplied by the server
 * @ param nc the " nonce - count " as defined in RFC 2617.
 * @ param cnonce opaque string supplied by the client when qop is set .
 * @ return the MD5 of the digest authentication response , encoded in hex
 * @ throws IllegalArgumentException if the supplied qop value is unsupported . */
static String generateDigest ( boolean passwordAlreadyEncoded , String username , String realm , String password , String httpMethod , String uri , String qop , String nonce , String nc , String cnonce ) throws IllegalArgumentException { } }

implementation:
String a1Md5 ; String a2 = httpMethod + ":" + uri ; String a2Md5 = md5Hex ( a2 ) ; if ( passwordAlreadyEncoded ) { a1Md5 = password ; } else { a1Md5 = DigestAuthUtils . encodePasswordInA1Format ( username , realm , password ) ; } String digest ; if ( qop == null ) { // as per RFC 2069 compliant clients ( also reaffirmed by RFC 2617)
digest = a1Md5 + ":" + nonce + ":" + a2Md5 ; } else if ( "auth" . equals ( qop ) ) { // As per RFC 2617 compliant clients
digest = a1Md5 + ":" + nonce + ":" + nc + ":" + cnonce + ":" + qop + ":" + a2Md5 ; } else { throw new IllegalArgumentException ( "This method does not support a qop: '" + qop + "'" ) ; } return md5Hex ( digest ) ;


signature:
public class DigestAuthUtils { /** * Takes an array of < code > String < / code > s , and for each element removes any instances
 * of < code > removeCharacter < / code > , and splits the element based on the
 * < code > delimiter < / code > . A < code > Map < / code > is then generated , with the left of the
 * delimiter providing the key , and the right of the delimiter providing the value .
 * Will trim both the key and value before adding to the < code > Map < / code > .
 * @ param array the array to process
 * @ param delimiter to split each element using ( typically the equals symbol )
 * @ param removeCharacters one or more characters to remove from each element prior to
 * attempting the split operation ( typically the quotation mark symbol ) or
 * < code > null < / code > if no removal should occur
 * @ return a < code > Map < / code > representing the array contents , or < code > null < / code > if
 * the array to process was null or empty */
static Map < String , String > splitEachArrayElementAndCreateMap ( String [ ] array , String delimiter , String removeCharacters ) { } }

implementation: if ( ( array == null ) || ( array . length == 0 ) ) { return null ; } Map < String , String > map = new HashMap < > ( ) ; for ( String s : array ) { String postRemove ; if ( removeCharacters == null ) { postRemove = s ; } else { postRemove = StringUtils . replace ( s , removeCharacters , "" ) ; } String [ ] splitThisArrayElement = split ( postRemove , delimiter ) ; if ( splitThisArrayElement == null ) { continue ; } map . put ( splitThisArrayElement [ 0 ] . trim ( ) , splitThisArrayElement [ 1 ] . trim ( ) ) ; } return map ;


signature:
public class DigestAuthUtils { /** * Splits a < code > String < / code > at the first instance of the delimiter .
 * Does not include the delimiter in the response .
 * @ param toSplit the string to split
 * @ param delimiter to split the string up with
 * @ return a two element array with index 0 being before the delimiter , and index 1
 * being after the delimiter ( neither element includes the delimiter )
 * @ throws IllegalArgumentException if an argument was invalid */
static String [ ] split ( String toSplit , String delimiter ) { } }

implementation: Assert . hasLength ( toSplit , "Cannot split a null or empty string" ) ; Assert . hasLength ( delimiter , "Cannot use a null or empty delimiter to split a string" ) ; if ( delimiter . length ( ) != 1 ) { throw new IllegalArgumentException ( "Delimiter can only be one character in length" ) ; } int offset = toSplit . indexOf ( delimiter ) ; if ( offset < 0 ) { return null ; } String beforeDelimiter = toSplit . substring ( 0 , offset ) ; String afterDelimiter = toSplit . substring ( offset + 1 ) ; return new String [ ] { beforeDelimiter , afterDelimiter } ;


signature: public class AbstractSecurityInterceptor { public void afterPropertiesSet ( ) throws Exception { } }

implementation: Assert . notNull ( getSecureObjectClass ( ) , "Subclass must provide a non-null response to getSecureObjectClass()" ) ; Assert . notNull ( this . messages , "A message source must be set" ) ; Assert . notNull ( this . authenticationManager , "An AuthenticationManager is required" ) ; Assert . notNull ( this . accessDecisionManager , "An AccessDecisionManager is required" ) ; Assert . notNull ( this . runAsManager , "A RunAsManager is required" ) ; Assert . notNull ( this . obtainSecurityMetadataSource ( ) , "An SecurityMetadataSource is required" ) ; Assert . isTrue ( this . obtainSecurityMetadataSource ( ) . supports ( getSecureObjectClass ( ) ) , ( ) -> "SecurityMetadataSource does not support secure object class: " + getSecureObjectClass ( ) ) ; Assert . isTrue ( this . runAsManager . supports ( getSecureObjectClass ( ) ) , ( ) -> "RunAsManager does not support secure object class: " + getSecureObjectClass ( ) ) ; Assert . isTrue ( this . accessDecisionManager . supports ( getSecureObjectClass ( ) ) , ( ) -> "AccessDecisionManager does not support secure object class: " + getSecureObjectClass ( ) ) ; if ( this . afterInvocationManager != null ) { Assert . isTrue ( this . afterInvocationManager . supports ( getSecureObjectClass ( ) ) , ( ) -> "AfterInvocationManager does not support secure object class: " + getSecureObjectClass ( ) ) ; } if ( this . validateConfigAttributes ) { Collection < ConfigAttribute > attributeDefs = this . obtainSecurityMetadataSource ( ) . getAllConfigAttributes ( ) ; if ( attributeDefs == null ) { logger . warn ( "Could not validate configuration attributes as the SecurityMetadataSource did not return " + "any attributes from getAllConfigAttributes()" ) ; return ; } Set < ConfigAttribute > unsupportedAttrs = new HashSet < > ( ) ; for ( ConfigAttribute attr : attributeDefs ) { if ( ! this . runAsManager . supports ( attr ) && ! this . accessDecisionManager . supports ( attr ) && ( ( this . afterInvocationManager == null ) || ! this . afterInvocationManager . supports ( attr ) ) ) { unsupportedAttrs . add ( attr ) ; } } if ( unsupportedAttrs . size ( ) != 0 ) { throw new IllegalArgumentException ( "Unsupported configuration attributes: " + unsupportedAttrs ) ; } logger . debug ( "Validated configuration attributes" ) ; }


signature:
public class AbstractSecurityInterceptor { /** * Cleans up the work of the < tt > AbstractSecurityInterceptor < / tt > after the secure
 * object invocation has been completed . This method should be invoked after the
 * secure object invocation and before afterInvocation regardless of the secure object
 * invocation returning successfully ( i . e . it should be done in a finally block ) .
 * @ param token as returned by the { @ link # beforeInvocation ( Object ) } method */
protected void finallyInvocation ( InterceptorStatusToken token ) { } }

implementation: if ( token != null && token . isContextHolderRefreshRequired ( ) ) { if ( logger . isDebugEnabled ( ) ) { logger . debug ( "Reverting to original Authentication: " + token . getSecurityContext ( ) . getAuthentication ( ) ) ; } SecurityContextHolder . setContext ( token . getSecurityContext ( ) ) ; }


signature:
public class AbstractSecurityInterceptor { /** * Completes the work of the < tt > AbstractSecurityInterceptor < / tt > after the secure
 * object invocation has been completed .
 * @ param token as returned by the { @ link # beforeInvocation ( Object ) } method
 * @ param returnedObject any object returned from the secure object invocation ( may be
 * < tt > null < / tt > )
 * @ return the object the secure object invocation should ultimately return to its
 * caller ( may be < tt > null < / tt > ) */
protected Object afterInvocation ( InterceptorStatusToken token , Object returnedObject ) { } }

implementation:
if ( token == null ) { // public object
return returnedObject ; } finallyInvocation ( token ) ; // continue to clean in this method for passivity
if ( afterInvocationManager != null ) { // Attempt after invocation handling
try { returnedObject = afterInvocationManager . decide ( token . getSecurityContext ( ) . getAuthentication ( ) , token . getSecureObject ( ) , token . getAttributes ( ) , returnedObject ) ; } catch ( AccessDeniedException accessDeniedException ) { AuthorizationFailureEvent event = new AuthorizationFailureEvent ( token . getSecureObject ( ) , token . getAttributes ( ) , token . getSecurityContext ( ) . getAuthentication ( ) , accessDeniedException ) ; publishEvent ( event ) ; throw accessDeniedException ; } } return returnedObject ;


signature:
public class AbstractSecurityInterceptor { /** * Checks the current authentication token and passes it to the AuthenticationManager
 * if { @ link org . springframework . security . core . Authentication # isAuthenticated ( ) }
 * returns false or the property < tt > alwaysReauthenticate < / tt > has been set to true .
 * @ return an authenticated < tt > Authentication < / tt > object . */
private Authentication authenticateIfRequired ( ) { } }

implementation:
Authentication authentication = SecurityContextHolder . getContext ( ) . getAuthentication ( ) ; if ( authentication . isAuthenticated ( ) && ! alwaysReauthenticate ) { if ( logger . isDebugEnabled ( ) ) { logger . debug ( "Previously Authenticated: " + authentication ) ; } return authentication ; } authentication = authenticationManager . authenticate ( authentication ) ; // We don ' t authenticated . setAuthentication ( true ) , because each provider should do
// that
if ( logger . isDebugEnabled ( ) ) { logger . debug ( "Successfully Authenticated: " + authentication ) ; } SecurityContextHolder . getContext ( ) . setAuthentication ( authentication ) ; return authentication ;


signature:
public class AbstractSecurityInterceptor { /** * Helper method which generates an exception containing the passed reason , and
 * publishes an event to the application context .
 * Always throws an exception .
 * @ param reason to be provided in the exception detail
 * @ param secureObject that was being called
 * @ param configAttribs that were defined for the secureObject */
private void credentialsNotFound ( String reason , Object secureObject , Collection < ConfigAttribute > configAttribs ) { } }

implementation: AuthenticationCredentialsNotFoundException exception = new AuthenticationCredentialsNotFoundException ( reason ) ; AuthenticationCredentialsNotFoundEvent event = new AuthenticationCredentialsNotFoundEvent ( secureObject , configAttribs , exception ) ; publishEvent ( event ) ; throw exception ;


signature:
public class UserDetailsServiceFactoryBean { /** * Obtains a user details service for use in RememberMeServices etc . Will return a
 * caching version if available so should not be used for beans which need to separate
 * the two . */
private UserDetailsService getUserDetailsService ( ) { } }

implementation: Map < String , ? > beans = getBeansOfType ( CachingUserDetailsService . class ) ; if ( beans . size ( ) == 0 ) { beans = getBeansOfType ( UserDetailsService . class ) ; } if ( beans . size ( ) == 0 ) { throw new ApplicationContextException ( "No UserDetailsService registered." ) ; } else if ( beans . size ( ) > 1 ) { throw new ApplicationContextException ( "More than one UserDetailsService registered. Please " + "use a specific Id reference in <remember-me/> <openid-login/> or <x509 /> elements." ) ; } return ( UserDetailsService ) beans . values ( ) . toArray ( ) [ 0 ] ;


signature:
public class DefaultServerOAuth2AuthorizationRequestResolver { /** * Creates and adds additional PKCE parameters for use in the OAuth 2.0 Authorization and Access Token Requests
 * @ param attributes where { @ link PkceParameterNames # CODE _ VERIFIER } is stored for the token request
 * @ param additionalParameters where { @ link PkceParameterNames # CODE _ CHALLENGE } and , usually ,
 * { @ link PkceParameterNames # CODE _ CHALLENGE _ METHOD } are added to be used in the authorization request .
 * @ since 5.2
 * @ see < a target = " _ blank " href = " https : / / tools . ietf . org / html / rfc7636 # section - 1.1 " > 1.1 . Protocol Flow < / a >
 * @ see < a target = " _ blank " href = " https : / / tools . ietf . org / html / rfc7636 # section - 4.1 " > 4.1 . Client Creates a Code Verifier < / a >
 * @ see < a target = " _ blank " href = " https : / / tools . ietf . org / html / rfc7636 # section - 4.2 " > 4.2 . Client Creates the Code Challenge < / a > */
private void addPkceParameters ( Map < String , Object > attributes , Map < String , Object > additionalParameters ) { } }

implementation: String codeVerifier = this . codeVerifierGenerator . generateKey ( ) ; attributes . put ( PkceParameterNames . CODE_VERIFIER , codeVerifier ) ; try { String codeChallenge = createCodeChallenge ( codeVerifier ) ; additionalParameters . put ( PkceParameterNames . CODE_CHALLENGE , codeChallenge ) ; additionalParameters . put ( PkceParameterNames . CODE_CHALLENGE_METHOD , "S256" ) ; } catch ( NoSuchAlgorithmException e ) { additionalParameters . put ( PkceParameterNames . CODE_CHALLENGE , codeVerifier ) ; }


signature: public class CasAuthenticationFilter { @ Override protected final void successfulAuthentication ( HttpServletRequest request , HttpServletResponse response , FilterChain chain , Authentication authResult ) throws IOException , ServletException { } }

implementation:
boolean continueFilterChain = proxyTicketRequest ( serviceTicketRequest ( request , response ) , request ) ; if ( ! continueFilterChain ) { super . successfulAuthentication ( request , response , chain , authResult ) ; return ; } if ( logger . isDebugEnabled ( ) ) { logger . debug ( "Authentication success. Updating SecurityContextHolder to contain: " + authResult ) ; } SecurityContextHolder . getContext ( ) . setAuthentication ( authResult ) ; // Fire event
if ( this . eventPublisher != null ) { eventPublisher . publishEvent ( new InteractiveAuthenticationSuccessEvent ( authResult , this . getClass ( ) ) ) ; } chain . doFilter ( request , response ) ;