signature:
public class RoleHierarchyImpl { /** * SEC - 863 */
private void addReachableRoles ( Set < GrantedAuthority > reachableRoles , GrantedAuthority authority ) { } }

implementation: for ( GrantedAuthority testAuthority : reachableRoles ) { String testKey = testAuthority . getAuthority ( ) ; if ( ( testKey != null ) && ( testKey . equals ( authority . getAuthority ( ) ) ) ) { return ; } } reachableRoles . add ( authority ) ;


signature:
public class RoleHierarchyImpl { /** * SEC - 863 */
private Set < GrantedAuthority > getRolesReachableInOneOrMoreSteps ( GrantedAuthority authority ) { } }

implementation: if ( authority . getAuthority ( ) == null ) { return null ; } for ( GrantedAuthority testAuthority : this . rolesReachableInOneOrMoreStepsMap . keySet ( ) ) { String testKey = testAuthority . getAuthority ( ) ; if ( ( testKey != null ) && ( testKey . equals ( authority . getAuthority ( ) ) ) ) { return this . rolesReachableInOneOrMoreStepsMap . get ( testAuthority ) ; } } return null ;


signature:
public class RoleHierarchyImpl { /** * Parse input and build the map for the roles reachable in one step : the higher role
 * will become a key that references a set of the reachable lower roles . */
private void buildRolesReachableInOneStepMap ( ) { } }

implementation: this . rolesReachableInOneStepMap = new HashMap < GrantedAuthority , Set < GrantedAuthority > > ( ) ; try ( BufferedReader bufferedReader = new BufferedReader ( new StringReader ( this . roleHierarchyStringRepresentation ) ) ) { for ( String readLine ; ( readLine = bufferedReader . readLine ( ) ) != null ; ) { String [ ] roles = readLine . split ( " > " ) ; for ( int i = 1 ; i < roles . length ; i ++ ) { GrantedAuthority higherRole = new SimpleGrantedAuthority ( roles [ i - 1 ] . replaceAll ( "^\\s+|\\s+$" , "" ) ) ; GrantedAuthority lowerRole = new SimpleGrantedAuthority ( roles [ i ] . replaceAll ( "^\\s+|\\s+$" , "" ) ) ; Set < GrantedAuthority > rolesReachableInOneStepSet ; if ( ! this . rolesReachableInOneStepMap . containsKey ( higherRole ) ) { rolesReachableInOneStepSet = new HashSet < GrantedAuthority > ( ) ; this . rolesReachableInOneStepMap . put ( higherRole , rolesReachableInOneStepSet ) ; } else { rolesReachableInOneStepSet = this . rolesReachableInOneStepMap . get ( higherRole ) ; } addReachableRoles ( rolesReachableInOneStepSet , lowerRole ) ; if ( logger . isDebugEnabled ( ) ) { logger . debug ( "buildRolesReachableInOneStepMap() - From role " + higherRole + " one can reach role " + lowerRole + " in one step." ) ; } } } } catch ( IOException e ) { throw new IllegalStateException ( e ) ; }


signature:
public class RoleHierarchyImpl { /** * For every higher role from rolesReachableInOneStepMap store all roles that are
 * reachable from it in the map of roles reachable in one or more steps . ( Or throw a
 * CycleInRoleHierarchyException if a cycle in the role hierarchy definition is
 * detected ) */
private void buildRolesReachableInOneOrMoreStepsMap ( ) { } }

implementation:
this . rolesReachableInOneOrMoreStepsMap = new HashMap < > ( ) ; // iterate over all higher roles from rolesReachableInOneStepMap
for ( GrantedAuthority role : this . rolesReachableInOneStepMap . keySet ( ) ) { Set < GrantedAuthority > rolesToVisitSet = new HashSet < > ( ) ; if ( this . rolesReachableInOneStepMap . containsKey ( role ) ) { rolesToVisitSet . addAll ( this . rolesReachableInOneStepMap . get ( role ) ) ; } Set < GrantedAuthority > visitedRolesSet = new HashSet < > ( ) ; while ( ! rolesToVisitSet . isEmpty ( ) ) { // take a role from the rolesToVisit set
GrantedAuthority aRole = rolesToVisitSet . iterator ( ) . next ( ) ; rolesToVisitSet . remove ( aRole ) ; addReachableRoles ( visitedRolesSet , aRole ) ; if ( this . rolesReachableInOneStepMap . containsKey ( aRole ) ) { Set < GrantedAuthority > newReachableRoles = this . rolesReachableInOneStepMap . get ( aRole ) ; // definition of a cycle : you can reach the role you are starting from
if ( rolesToVisitSet . contains ( role ) || visitedRolesSet . contains ( role ) ) { throw new CycleInRoleHierarchyException ( ) ; } else { // no cycle
rolesToVisitSet . addAll ( newReachableRoles ) ; } } } this . rolesReachableInOneOrMoreStepsMap . put ( role , visitedRolesSet ) ; logger . debug ( "buildRolesReachableInOneOrMoreStepsMap() - From role " + role + " one can reach " + visitedRolesSet + " in one or more steps." ) ; }


signature:
public class AesBytesEncryptor { /** * internal helpers */
private byte [ ] iv ( byte [ ] encrypted ) { } }

implementation: return this . ivGenerator != NULL_IV_GENERATOR ? subArray ( encrypted , 0 , this . ivGenerator . getKeyLength ( ) ) : NULL_IV_GENERATOR . generateKey ( ) ;


signature:
public class LogoutConfigurer { /** * Adds a { @ link LogoutHandler } . The { @ link SecurityContextLogoutHandler } is added as
 * the last { @ link LogoutHandler } by default .
 * @ param logoutHandler the { @ link LogoutHandler } to add
 * @ return the { @ link LogoutConfigurer } for further customization */
public LogoutConfigurer < H > addLogoutHandler ( LogoutHandler logoutHandler ) { } }

implementation: Assert . notNull ( logoutHandler , "logoutHandler cannot be null" ) ; this . logoutHandlers . add ( logoutHandler ) ; return this ;


signature:
public class LogoutConfigurer { /** * Sets the { @ link LogoutSuccessHandler } to use . If this is specified ,
 * { @ link # logoutSuccessUrl ( String ) } is ignored .
 * @ param logoutSuccessHandler the { @ link LogoutSuccessHandler } to use after a user
 * has been logged out .
 * @ return the { @ link LogoutConfigurer } for further customizations */
public LogoutConfigurer < H > logoutSuccessHandler ( LogoutSuccessHandler logoutSuccessHandler ) { } }

implementation: this . logoutSuccessUrl = null ; this . customLogoutSuccess = true ; this . logoutSuccessHandler = logoutSuccessHandler ; return this ;


signature:
public class LogoutConfigurer { /** * Sets a default { @ link LogoutSuccessHandler } to be used which prefers being invoked
 * for the provided { @ link RequestMatcher } . If no { @ link LogoutSuccessHandler } is
 * specified a { @ link SimpleUrlLogoutSuccessHandler } will be used .
 * If any default { @ link LogoutSuccessHandler } instances are configured , then a
 * { @ link DelegatingLogoutSuccessHandler } will be used that defaults to a
 * { @ link SimpleUrlLogoutSuccessHandler } .
 * @ param handler the { @ link LogoutSuccessHandler } to use
 * @ param preferredMatcher the { @ link RequestMatcher } for this default
 * { @ link LogoutSuccessHandler }
 * @ return the { @ link LogoutConfigurer } for further customizations */
public LogoutConfigurer < H > defaultLogoutSuccessHandlerFor ( LogoutSuccessHandler handler , RequestMatcher preferredMatcher ) { } }

implementation: Assert . notNull ( handler , "handler cannot be null" ) ; Assert . notNull ( preferredMatcher , "preferredMatcher cannot be null" ) ; this . defaultLogoutSuccessHandlerMappings . put ( preferredMatcher , handler ) ; return this ;


signature:
public class LogoutConfigurer { /** * Gets the { @ link LogoutSuccessHandler } if not null , otherwise creates a new
 * { @ link SimpleUrlLogoutSuccessHandler } using the { @ link # logoutSuccessUrl ( String ) } .
 * @ return the { @ link LogoutSuccessHandler } to use */
private LogoutSuccessHandler getLogoutSuccessHandler ( ) { } }

implementation: LogoutSuccessHandler handler = this . logoutSuccessHandler ; if ( handler == null ) { handler = createDefaultSuccessHandler ( ) ; } return handler ;


signature:
public class LogoutConfigurer { /** * Creates the { @ link LogoutFilter } using the { @ link LogoutHandler } instances , the
 * { @ link # logoutSuccessHandler ( LogoutSuccessHandler ) } and the
 * { @ link # logoutUrl ( String ) } .
 * @ param http the builder to use
 * @ return the { @ link LogoutFilter } to use .
 * @ throws Exception */
private LogoutFilter createLogoutFilter ( H http ) throws Exception { } }

implementation: logoutHandlers . add ( contextLogoutHandler ) ; LogoutHandler [ ] handlers = logoutHandlers . toArray ( new LogoutHandler [ logoutHandlers . size ( ) ] ) ; LogoutFilter result = new LogoutFilter ( getLogoutSuccessHandler ( ) , handlers ) ; result . setLogoutRequestMatcher ( getLogoutRequestMatcher ( http ) ) ; result = postProcess ( result ) ; return result ;


signature: public class DelegatingMethodSecurityMetadataSource { public Collection < ConfigAttribute > getAttributes ( Method method , Class < ? > targetClass ) { } }

implementation:
DefaultCacheKey cacheKey = new DefaultCacheKey ( method , targetClass ) ; synchronized ( attributeCache ) { Collection < ConfigAttribute > cached = attributeCache . get ( cacheKey ) ; // Check for canonical value indicating there is no config attribute ,
if ( cached != null ) { return cached ; } // No cached value , so query the sources to find a result
Collection < ConfigAttribute > attributes = null ; for ( MethodSecurityMetadataSource s : methodSecurityMetadataSources ) { attributes = s . getAttributes ( method , targetClass ) ; if ( attributes != null && ! attributes . isEmpty ( ) ) { break ; } } // Put it in the cache .
if ( attributes == null || attributes . isEmpty ( ) ) { this . attributeCache . put ( cacheKey , NULL_CONFIG_ATTRIBUTE ) ; return NULL_CONFIG_ATTRIBUTE ; } if ( logger . isDebugEnabled ( ) ) { logger . debug ( "Caching method [" + cacheKey + "] with attributes " + attributes ) ; } this . attributeCache . put ( cacheKey , attributes ) ; return attributes ; }


signature: public class LdapShaPasswordEncoder { private byte [ ] combineHashAndSalt ( byte [ ] hash , byte [ ] salt ) { } }

implementation: if ( salt == null ) { return hash ; } byte [ ] hashAndSalt = new byte [ hash . length + salt . length ] ; System . arraycopy ( hash , 0 , hashAndSalt , 0 , hash . length ) ; System . arraycopy ( salt , 0 , hashAndSalt , hash . length , salt . length ) ; return hashAndSalt ;


signature:
public class LdapShaPasswordEncoder { /** * Calculates the hash of password ( and salt bytes , if supplied ) and returns a base64
 * encoded concatenation of the hash and salt , prefixed with { SHA } ( or { SSHA } if salt
 * was used ) .
 * @ param rawPass the password to be encoded .
 * @ return the encoded password in the specified format */
public String encode ( CharSequence rawPass ) { } }

implementation: byte [ ] salt = this . saltGenerator . generateKey ( ) ; return encode ( rawPass , salt ) ;


signature:
public class LdapShaPasswordEncoder { /** * Checks the validity of an unencoded password against an encoded one in the form
 * " { SSHA } sQuQF8vj8Eg2Y1hPdh3bkQhCKQBgjhQI " .
 * @ param rawPassword unencoded password to be verified .
 * @ param encodedPassword the actual SSHA or SHA encoded password
 * @ return true if they match ( independent of the case of the prefix ) . */
public boolean matches ( CharSequence rawPassword , String encodedPassword ) { } }

implementation: return matches ( rawPassword == null ? null : rawPassword . toString ( ) , encodedPassword ) ;


signature:
public class LdapShaPasswordEncoder { /** * Returns the hash prefix or null if there isn ' t one . */
private String extractPrefix ( String encPass ) { } }

implementation: if ( ! encPass . startsWith ( "{" ) ) { return null ; } int secondBrace = encPass . lastIndexOf ( '}' ) ; if ( secondBrace < 0 ) { throw new IllegalArgumentException ( "Couldn't find closing brace for SHA prefix" ) ; } return encPass . substring ( 0 , secondBrace + 1 ) ;


signature:
public class ServletApiController { /** * Demonstrates that { @ link HttpServletRequest # authenticate ( HttpServletResponse ) } will
 * send the user to the log in page configured within Spring Security if the user is
 * not already authenticated .
 * @ param request
 * @ param response
 * @ return
 * @ throws ServletException
 * @ throws IOException */
@ RequestMapping ( "/authenticate" ) public String authenticate ( HttpServletRequest request , HttpServletResponse response ) throws ServletException , IOException { } }

implementation: boolean authenticate = request . authenticate ( response ) ; return authenticate ? "index" : null ;


signature:
public class ServletApiController { /** * Demonstrates that you can authenticate with Spring Security using
 * { @ link HttpServletRequest # login ( String , String ) } .
 * If we fail to authenticate , a { @ link ServletException } is thrown that wraps the
 * original { @ link AuthenticationException } from Spring Security . This means we can
 * catch the { @ link ServletException } to display the error message . Alternatively , we
 * could allow the { @ link ServletException } to propegate and Spring Security ' s
 * { @ link ExceptionTranslationFilter } would catch it and process it appropriately .
 * In this method we choose to use Spring MVC ' s { @ link ModelAttribute } to make things
 * easier for our form . However , this is not necessary . We could have just as easily
 * obtained the request parameters from the { @ link HttpServletRequest } object .
 * Remember all of these examples would work in a standard { @ link Servlet } or anything
 * with access to the { @ link HttpServletRequest } and { @ link HttpServletResponse } .
 * @ param request
 * @ param response
 * @ param loginForm
 * @ param result
 * @ return
 * @ throws ServletException */
@ RequestMapping ( value = "/login" , method = RequestMethod . POST ) public String login ( HttpServletRequest request , HttpServletResponse response , @ ModelAttribute LoginForm loginForm , BindingResult result ) throws ServletException { } }

implementation: try { request . login ( loginForm . getUsername ( ) , loginForm . getPassword ( ) ) ; } catch ( ServletException authenticationFailed ) { result . rejectValue ( null , "authentication.failed" , authenticationFailed . getMessage ( ) ) ; return "login" ; } return "redirect:/" ;


signature:
public class ServletApiController { /** * Demonstrates that invoking { @ link HttpServletRequest # logout ( ) } will log the user
 * out . Note that the response does not get processed , so you need to write something
 * to the response .
 * @ param request
 * @ param response
 * @ param redirect
 * @ return
 * @ throws ServletException */
@ RequestMapping ( "/logout" ) public String logout ( HttpServletRequest request , HttpServletResponse response , RedirectAttributes redirect ) throws ServletException { } }

implementation: request . logout ( ) ; return "redirect:/" ;


signature:
public class ServletApiController { /** * Demonstrates Spring Security with { @ link AsyncContext # start ( Runnable ) } . Spring
 * Security will automatically transfer the { @ link SecurityContext } from the thread
 * that { @ link AsyncContext # start ( Runnable ) } is invoked to the new Thread that invokes
 * the { @ link Runnable } .
 * @ param request
 * @ param response */
@ RequestMapping ( "/async" ) public void asynch ( HttpServletRequest request , HttpServletResponse response ) { } }

implementation: final AsyncContext async = request . startAsync ( ) ; async . start ( new Runnable ( ) { public void run ( ) { Authentication authentication = SecurityContextHolder . getContext ( ) . getAuthentication ( ) ; try { final HttpServletResponse asyncResponse = ( HttpServletResponse ) async . getResponse ( ) ; asyncResponse . setStatus ( HttpServletResponse . SC_OK ) ; asyncResponse . getWriter ( ) . write ( String . valueOf ( authentication ) ) ; async . complete ( ) ; } catch ( Exception e ) { throw new RuntimeException ( e ) ; } } } ) ;


signature:
public class Http403ForbiddenEntryPoint { /** * Always returns a 403 error code to the client . */
public void commence ( HttpServletRequest request , HttpServletResponse response , AuthenticationException arg2 ) throws IOException , ServletException { } }

implementation: if ( logger . isDebugEnabled ( ) ) { logger . debug ( "Pre-authenticated entry point called. Rejecting access" ) ; } response . sendError ( HttpServletResponse . SC_FORBIDDEN , "Access Denied" ) ;


signature: public class AclEntryAfterInvocationCollectionFilteringProvider { @ SuppressWarnings ( "unchecked" ) public Object decide ( Authentication authentication , Object object , Collection < ConfigAttribute > config , Object returnedObject ) throws AccessDeniedException { } }

implementation:
if ( returnedObject == null ) { logger . debug ( "Return object is null, skipping" ) ; return null ; } for ( ConfigAttribute attr : config ) { if ( ! this . supports ( attr ) ) { continue ; } // Need to process the Collection for this invocation
Filterer filterer ; if ( returnedObject instanceof Collection ) { filterer = new CollectionFilterer ( ( Collection ) returnedObject ) ; } else if ( returnedObject . getClass ( ) . isArray ( ) ) { filterer = new ArrayFilterer ( ( Object [ ] ) returnedObject ) ; } else { throw new AuthorizationServiceException ( "A Collection or an array (or null) was required as the " + "returnedObject, but the returnedObject was: " + returnedObject ) ; } // Locate unauthorised Collection elements
for ( Object domainObject : filterer ) { // Ignore nulls or entries which aren ' t instances of the configured domain
// object class
if ( domainObject == null || ! getProcessDomainObjectClass ( ) . isAssignableFrom ( domainObject . getClass ( ) ) ) { continue ; } if ( ! hasPermission ( authentication , domainObject ) ) { filterer . remove ( domainObject ) ; if ( logger . isDebugEnabled ( ) ) { logger . debug ( "Principal is NOT authorised for element: " + domainObject ) ; } } } return filterer . getFilteredObject ( ) ; } return returnedObject ;


signature:
public class DefaultHttpFirewall { /** * Checks whether a path is normalized ( doesn ' t contain path traversal
 * sequences like " . / " , " / . . / " or " / . " )
 * @ param path
 * the path to test
 * @ return true if the path doesn ' t contain any path - traversal character
 * sequences . */
private boolean isNormalized ( String path ) { } }

implementation:
if ( path == null ) { return true ; } for ( int j = path . length ( ) ; j > 0 ; ) { int i = path . lastIndexOf ( '/' , j - 1 ) ; int gap = j - i ; if ( gap == 2 && path . charAt ( i + 1 ) == '.' ) { // " . " , " / . / " or " / . "
return false ; } else if ( gap == 3 && path . charAt ( i + 1 ) == '.' && path . charAt ( i + 2 ) == '.' ) { return false ; } j = i ; } return true ;


signature:
public class DefaultFilterChainValidator { /** * Checks the filter list for possible errors and logs them */
private void checkFilterStack ( List < Filter > filters ) { } }

implementation: checkForDuplicates ( SecurityContextPersistenceFilter . class , filters ) ; checkForDuplicates ( UsernamePasswordAuthenticationFilter . class , filters ) ; checkForDuplicates ( SessionManagementFilter . class , filters ) ; checkForDuplicates ( BasicAuthenticationFilter . class , filters ) ; checkForDuplicates ( SecurityContextHolderAwareRequestFilter . class , filters ) ; checkForDuplicates ( JaasApiIntegrationFilter . class , filters ) ; checkForDuplicates ( ExceptionTranslationFilter . class , filters ) ; checkForDuplicates ( FilterSecurityInterceptor . class , filters ) ;


signature:
public class DefaultFilterChainValidator { /** * Checks for the common error of having a login page URL protected by the security
 * interceptor */
private void checkLoginPageIsntProtected ( FilterChainProxy fcp , List < Filter > filterStack ) { } }

implementation:
ExceptionTranslationFilter etf = getFilter ( ExceptionTranslationFilter . class , filterStack ) ; if ( etf == null || ! ( etf . getAuthenticationEntryPoint ( ) instanceof LoginUrlAuthenticationEntryPoint ) ) { return ; } String loginPage = ( ( LoginUrlAuthenticationEntryPoint ) etf . getAuthenticationEntryPoint ( ) ) . getLoginFormUrl ( ) ; logger . info ( "Checking whether login URL '" + loginPage + "' is accessible with your configuration" ) ; FilterInvocation loginRequest = new FilterInvocation ( loginPage , "POST" ) ; List < Filter > filters = null ; try { filters = fcp . getFilters ( loginPage ) ; } catch ( Exception e ) { // May happen legitimately if a filter - chain request matcher requires more
// request data than that provided
// by the dummy request used when creating the filter invocation .
logger . info ( "Failed to obtain filter chain information for the login page. Unable to complete check." ) ; } if ( filters == null || filters . isEmpty ( ) ) { logger . debug ( "Filter chain is empty for the login page" ) ; return ; } if ( getFilter ( DefaultLoginPageGeneratingFilter . class , filters ) != null ) { logger . debug ( "Default generated login page is in use" ) ; return ; } FilterSecurityInterceptor fsi = getFilter ( FilterSecurityInterceptor . class , filters ) ; FilterInvocationSecurityMetadataSource fids = fsi . getSecurityMetadataSource ( ) ; Collection < ConfigAttribute > attributes = fids . getAttributes ( loginRequest ) ; if ( attributes == null ) { logger . debug ( "No access attributes defined for login page URL" ) ; if ( fsi . isRejectPublicInvocations ( ) ) { logger . warn ( "FilterSecurityInterceptor is configured to reject public invocations." + " Your login page may not be accessible." ) ; } return ; } AnonymousAuthenticationFilter anonPF = getFilter ( AnonymousAuthenticationFilter . class , filters ) ; if ( anonPF == null ) { logger . warn ( "The login page is being protected by the filter chain, but you don't appear to have" + " anonymous authentication enabled. This is almost certainly an error." ) ; return ; } // Simulate an anonymous access with the supplied attributes .
AnonymousAuthenticationToken token = new AnonymousAuthenticationToken ( "key" , anonPF . getPrincipal ( ) , anonPF . getAuthorities ( ) ) ; try { fsi . getAccessDecisionManager ( ) . decide ( token , loginRequest , attributes ) ; } catch ( AccessDeniedException e ) { logger . warn ( "Anonymous access to the login page doesn't appear to be enabled. This is almost certainly " + "an error. Please check your configuration allows unauthenticated access to the configured " + "login page. (Simulated access was rejected: " + e + ")" ) ; } catch ( Exception e ) { // May happen legitimately if a filter - chain request matcher requires more
// request data than that provided
// by the dummy request used when creating the filter invocation . See SEC - 1878
logger . info ( "Unable to check access to the login page to determine if anonymous access is allowed. This might be an error, but can happen under normal circumstances." , e ) ; }


signature:
public class ThrowableAnalyzer { /** * Registers a < code > ThrowableCauseExtractor < / code > for the specified type . < i > Can be
 * used in subclasses overriding { @ link # initExtractorMap ( ) } . < / i >
 * @ param throwableType the type ( has to be a subclass of < code > Throwable < / code > )
 * @ param extractor the associated < code > ThrowableCauseExtractor < / code > ( not
 * < code > null < / code > )
 * @ throws IllegalArgumentException if one of the arguments is invalid */
protected final void registerExtractor ( Class < ? extends Throwable > throwableType , ThrowableCauseExtractor extractor ) { } }

implementation: Assert . notNull ( extractor , "Invalid extractor: null" ) ; this . extractorMap . put ( throwableType , extractor ) ;


signature:
public class ThrowableAnalyzer { /** * Returns an array containing the classes for which extractors are registered . The
 * order of the classes is the order in which comparisons will occur for resolving a
 * matching extractor .
 * @ return the types for which extractors are registered */
@ SuppressWarnings ( "unchecked" ) final Class < ? extends Throwable > [ ] getRegisteredTypes ( ) { } }

implementation: Set < Class < ? extends Throwable > > typeList = this . extractorMap . keySet ( ) ; return typeList . toArray ( new Class [ typeList . size ( ) ] ) ;


signature:
public class ThrowableAnalyzer { /** * Determines the cause chain of the provided < code > Throwable < / code > . The returned
 * array contains all throwables extracted from the stacktrace , using the registered
 * { @ link ThrowableCauseExtractor extractors } . The elements of the array are ordered :
 * The first element is the passed in throwable itself . The following elements appear
 * in their order downward the stacktrace .
 * Note : If no { @ link ThrowableCauseExtractor } is registered for this instance then
 * the returned array will always only contain the passed in throwable .
 * @ param throwable the < code > Throwable < / code > to analyze
 * @ return an array of all determined throwables from the stacktrace
 * @ throws IllegalArgumentException if the throwable is < code > null < / code >
 * @ see # initExtractorMap ( ) */
public final Throwable [ ] determineCauseChain ( Throwable throwable ) { } }

implementation: if ( throwable == null ) { throw new IllegalArgumentException ( "Invalid throwable: null" ) ; } List < Throwable > chain = new ArrayList < > ( ) ; Throwable currentThrowable = throwable ; while ( currentThrowable != null ) { chain . add ( currentThrowable ) ; currentThrowable = extractCause ( currentThrowable ) ; } return chain . toArray ( new Throwable [ chain . size ( ) ] ) ;


signature:
public class ThrowableAnalyzer { /** * Extracts the cause of the given throwable using an appropriate extractor .
 * @ param throwable the < code > Throwable < / code > ( not < code > null < / code >
 * @ return the cause , may be < code > null < / code > if none could be resolved */
private Throwable extractCause ( Throwable throwable ) { } }

implementation: for ( Map . Entry < Class < ? extends Throwable > , ThrowableCauseExtractor > entry : extractorMap . entrySet ( ) ) { Class < ? extends Throwable > throwableType = entry . getKey ( ) ; if ( throwableType . isInstance ( throwable ) ) { ThrowableCauseExtractor extractor = entry . getValue ( ) ; return extractor . extractCause ( throwable ) ; } } return null ;


signature:
public class ThrowableAnalyzer { /** * Returns the first throwable from the passed in array that is assignable to the
 * provided type . A returned instance is safe to be cast to the specified type .
 * If the passed in array is null or empty this method returns < code > null < / code > .
 * @ param throwableType the type to look for
 * @ param chain the array ( will be processed in element order )
 * @ return the found < code > Throwable < / code > , < code > null < / code > if not found
 * @ throws IllegalArgumentException if the provided type is < code > null < / code > or no
 * subclass of < code > Throwable < / code > */
public final Throwable getFirstThrowableOfType ( Class < ? extends Throwable > throwableType , Throwable [ ] chain ) { } }

implementation: if ( chain != null ) { for ( Throwable t : chain ) { if ( ( t != null ) && throwableType . isInstance ( t ) ) { return t ; } } } return null ;


signature:
public class ThrowableAnalyzer { /** * Verifies that the provided throwable is a valid subclass of the provided type ( or
 * of the type itself ) . If < code > expectdBaseType < / code > is < code > null < / code > , no check
 * will be performed .
 * Can be used for verification purposes in implementations of
 * { @ link ThrowableCauseExtractor extractors } .
 * @ param throwable the < code > Throwable < / code > to check
 * @ param expectedBaseType the type to check against
 * @ throws IllegalArgumentException if < code > throwable < / code > is either
 * < code > null < / code > or its type is not assignable to < code > expectedBaseType < / code > */
public static void verifyThrowableHierarchy ( Throwable throwable , Class < ? extends Throwable > expectedBaseType ) { } }

implementation: if ( expectedBaseType == null ) { return ; } if ( throwable == null ) { throw new IllegalArgumentException ( "Invalid throwable: null" ) ; } Class < ? extends Throwable > throwableType = throwable . getClass ( ) ; if ( ! expectedBaseType . isAssignableFrom ( throwableType ) ) { throw new IllegalArgumentException ( "Invalid type: '" + throwableType . getName ( ) + "'. Has to be a subclass of '" + expectedBaseType . getName ( ) + "'" ) ; }


signature:
public class ReactiveMethodSecuritySelector { /** * Return the imports to use if the { @ link AdviceMode } is set to { @ link AdviceMode # PROXY } .
 * < p > Take care of adding the necessary JSR - 107 import if it is available . */
private String [ ] getProxyImports ( ) { } }

implementation: List < String > result = new ArrayList < > ( ) ; result . add ( AutoProxyRegistrar . class . getName ( ) ) ; result . add ( ReactiveMethodSecurityConfiguration . class . getName ( ) ) ; return result . toArray ( new String [ result . size ( ) ] ) ;


signature:
public class GlobalMethodSecurityBeanDefinitionParser { /** * Register the default AccessDecisionManager . Adds the special JSR 250 voter jsr - 250
 * is enabled and an expression voter if expression - based access control is enabled .
 * @ return */
@ SuppressWarnings ( { } }

implementation: "unchecked" , "rawtypes" } ) private String registerAccessManager ( ParserContext pc , boolean jsr250Enabled , BeanDefinition expressionVoter ) { BeanDefinitionBuilder accessMgrBuilder = BeanDefinitionBuilder . rootBeanDefinition ( AffirmativeBased . class ) ; ManagedList voters = new ManagedList ( 4 ) ; if ( expressionVoter != null ) { voters . add ( expressionVoter ) ; } voters . add ( new RootBeanDefinition ( RoleVoter . class ) ) ; voters . add ( new RootBeanDefinition ( AuthenticatedVoter . class ) ) ; if ( jsr250Enabled ) { voters . add ( new RootBeanDefinition ( Jsr250Voter . class ) ) ; } accessMgrBuilder . addConstructorArgValue ( voters ) ; BeanDefinition accessManager = accessMgrBuilder . getBeanDefinition ( ) ; String id = pc . getReaderContext ( ) . generateBeanName ( accessManager ) ; pc . registerBeanComponent ( new BeanComponentDefinition ( accessManager , id ) ) ; return id ;


signature:
public class ContentSecurityPolicyServerHttpHeadersWriter { /** * Set the policy directive ( s ) to be used in the response header .
 * @ param policyDirectives the policy directive ( s )
 * @ throws IllegalArgumentException if policyDirectives is { @ code null } or empty */
public void setPolicyDirectives ( String policyDirectives ) { } }

implementation: Assert . hasLength ( policyDirectives , "policyDirectives must not be null or empty" ) ; this . policyDirectives = policyDirectives ; this . delegate = createDelegate ( ) ;


signature:
public class DefaultAuthorizationCodeTokenResponseClient { /** * Sets the { @ link Converter } used for converting the { @ link OAuth2AuthorizationCodeGrantRequest }
 * to a { @ link RequestEntity } representation of the OAuth 2.0 Access Token Request .
 * @ param requestEntityConverter the { @ link Converter } used for converting to a { @ link RequestEntity } representation of the Access Token Request */
public void setRequestEntityConverter ( Converter < OAuth2AuthorizationCodeGrantRequest , RequestEntity < ? > > requestEntityConverter ) { } }

implementation: Assert . notNull ( requestEntityConverter , "requestEntityConverter cannot be null" ) ; this . requestEntityConverter = requestEntityConverter ;


signature:
public class DefaultAuthenticationEventPublisher { /** * Sets additional exception to event mappings . These are automatically merged with
 * the default exception to event mappings that < code > ProviderManager < / code > defines .
 * @ param additionalExceptionMappings where keys are the fully - qualified string name
 * of the exception class and the values are the fully - qualified string name of the
 * event class to fire . */
@ SuppressWarnings ( { } }

implementation: "unchecked" } ) public void setAdditionalExceptionMappings ( Properties additionalExceptionMappings ) { Assert . notNull ( additionalExceptionMappings , "The exceptionMappings object must not be null" ) ; for ( Object exceptionClass : additionalExceptionMappings . keySet ( ) ) { String eventClass = ( String ) additionalExceptionMappings . get ( exceptionClass ) ; try { Class < ? > clazz = getClass ( ) . getClassLoader ( ) . loadClass ( eventClass ) ; Assert . isAssignable ( AbstractAuthenticationFailureEvent . class , clazz ) ; addMapping ( ( String ) exceptionClass , ( Class < ? extends AbstractAuthenticationFailureEvent > ) clazz ) ; } catch ( ClassNotFoundException e ) { throw new RuntimeException ( "Failed to load authentication event class " + eventClass ) ; } }


signature:
public class ServerOAuth2AuthorizedClientExchangeFilterFunction { /** * Modifies the { @ link ClientRequest # attributes ( ) } to include the { @ link OAuth2AuthorizedClient } to be used for
 * providing the Bearer Token . Example usage :
 * < pre >
 * WebClient webClient = WebClient . builder ( )
 * . filter ( new OAuth2AuthorizedClientExchangeFilterFunction ( authorizedClientRepository ) )
 * . build ( ) ;
 * Mono < String > response = webClient
 * . get ( )
 * . uri ( uri )
 * . attributes ( serverWebExchange ( serverWebExchange ) )
 * . retrieve ( )
 * . bodyToMono ( String . class ) ;
 * < / pre >
 * @ param serverWebExchange the { @ link ServerWebExchange } to use
 * @ return the { @ link Consumer } to populate the client request attributes */
public static Consumer < Map < String , Object > > serverWebExchange ( ServerWebExchange serverWebExchange ) { } }

implementation: return attributes -> attributes . put ( SERVER_WEB_EXCHANGE_ATTR_NAME , serverWebExchange ) ;


signature:
public class HttpSessionEventPublisher { /** * Handles the HttpSessionEvent by publishing a { @ link HttpSessionCreatedEvent } to the
 * application appContext .
 * @ param event HttpSessionEvent passed in by the container */
public void sessionCreated ( HttpSessionEvent event ) { } }

implementation: HttpSessionCreatedEvent e = new HttpSessionCreatedEvent ( event . getSession ( ) ) ; Log log = LogFactory . getLog ( LOGGER_NAME ) ; if ( log . isDebugEnabled ( ) ) { log . debug ( "Publishing event: " + e ) ; } getContext ( event . getSession ( ) . getServletContext ( ) ) . publishEvent ( e ) ;


signature:
public class HttpSessionEventPublisher { /** * Handles the HttpSessionEvent by publishing a { @ link HttpSessionDestroyedEvent } to
 * the application appContext .
 * @ param event The HttpSessionEvent pass in by the container */
public void sessionDestroyed ( HttpSessionEvent event ) { } }

implementation: HttpSessionDestroyedEvent e = new HttpSessionDestroyedEvent ( event . getSession ( ) ) ; Log log = LogFactory . getLog ( LOGGER_NAME ) ; if ( log . isDebugEnabled ( ) ) { log . debug ( "Publishing event: " + e ) ; } getContext ( event . getSession ( ) . getServletContext ( ) ) . publishEvent ( e ) ;


signature:
public class AuthorityUtils { /** * Converts an array of GrantedAuthority objects to a Set .
 * @ return a Set of the Strings obtained from each call to
 * GrantedAuthority . getAuthority ( ) */
public static Set < String > authorityListToSet ( Collection < ? extends GrantedAuthority > userAuthorities ) { } }

implementation: Assert . notNull ( userAuthorities , "userAuthorities cannot be null" ) ; Set < String > set = new HashSet < > ( userAuthorities . size ( ) ) ; for ( GrantedAuthority authority : userAuthorities ) { set . add ( authority . getAuthority ( ) ) ; } return set ;


signature:
public class StandardPasswordEncoder { /** * Constant time comparison to prevent against timing attacks . */
private boolean matches ( byte [ ] expected , byte [ ] actual ) { } }

implementation: if ( expected . length != actual . length ) { return false ; } int result = 0 ; for ( int i = 0 ; i < expected . length ; i ++ ) { result |= expected [ i ] ^ actual [ i ] ; } return result == 0 ;


signature:
public class OAuth2AuthorizationCodeGrantRequestEntityConverter { /** * Returns the { @ link RequestEntity } used for the Access Token Request .
 * @ param authorizationCodeGrantRequest the authorization code grant request
 * @ return the { @ link RequestEntity } used for the Access Token Request */
@ Override public RequestEntity < ? > convert ( OAuth2AuthorizationCodeGrantRequest authorizationCodeGrantRequest ) { } }

implementation: ClientRegistration clientRegistration = authorizationCodeGrantRequest . getClientRegistration ( ) ; HttpHeaders headers = OAuth2AuthorizationGrantRequestEntityUtils . getTokenRequestHeaders ( clientRegistration ) ; MultiValueMap < String , String > formParameters = this . buildFormParameters ( authorizationCodeGrantRequest ) ; URI uri = UriComponentsBuilder . fromUriString ( clientRegistration . getProviderDetails ( ) . getTokenUri ( ) ) . build ( ) . toUri ( ) ; return new RequestEntity < > ( formParameters , headers , HttpMethod . POST , uri ) ;


signature:
public class OAuth2AuthorizationCodeGrantRequestEntityConverter { /** * Returns a { @ link MultiValueMap } of the form parameters used for the Access Token Request body .
 * @ param authorizationCodeGrantRequest the authorization code grant request
 * @ return a { @ link MultiValueMap } of the form parameters used for the Access Token Request body */
private MultiValueMap < String , String > buildFormParameters ( OAuth2AuthorizationCodeGrantRequest authorizationCodeGrantRequest ) { } }

implementation: ClientRegistration clientRegistration = authorizationCodeGrantRequest . getClientRegistration ( ) ; OAuth2AuthorizationExchange authorizationExchange = authorizationCodeGrantRequest . getAuthorizationExchange ( ) ; MultiValueMap < String , String > formParameters = new LinkedMultiValueMap < > ( ) ; formParameters . add ( OAuth2ParameterNames . GRANT_TYPE , authorizationCodeGrantRequest . getGrantType ( ) . getValue ( ) ) ; formParameters . add ( OAuth2ParameterNames . CODE , authorizationExchange . getAuthorizationResponse ( ) . getCode ( ) ) ; String redirectUri = authorizationExchange . getAuthorizationRequest ( ) . getRedirectUri ( ) ; String codeVerifier = authorizationExchange . getAuthorizationRequest ( ) . getAttribute ( PkceParameterNames . CODE_VERIFIER ) ; if ( redirectUri != null ) { formParameters . add ( OAuth2ParameterNames . REDIRECT_URI , redirectUri ) ; } if ( ! ClientAuthenticationMethod . BASIC . equals ( clientRegistration . getClientAuthenticationMethod ( ) ) ) { formParameters . add ( OAuth2ParameterNames . CLIENT_ID , clientRegistration . getClientId ( ) ) ; } if ( ClientAuthenticationMethod . POST . equals ( clientRegistration . getClientAuthenticationMethod ( ) ) ) { formParameters . add ( OAuth2ParameterNames . CLIENT_SECRET , clientRegistration . getClientSecret ( ) ) ; } if ( codeVerifier != null ) { formParameters . add ( PkceParameterNames . CODE_VERIFIER , codeVerifier ) ; } return formParameters ;


signature:
public class ImplicitGrantConfigurer { /** * Sets the base { @ code URI } used for authorization requests .
 * @ param authorizationRequestBaseUri the base { @ code URI } used for authorization requests
 * @ return the { @ link ImplicitGrantConfigurer } for further configuration */
public ImplicitGrantConfigurer < B > authorizationRequestBaseUri ( String authorizationRequestBaseUri ) { } }

implementation: Assert . hasText ( authorizationRequestBaseUri , "authorizationRequestBaseUri cannot be empty" ) ; this . authorizationRequestBaseUri = authorizationRequestBaseUri ; return this ;


signature:
public class ImplicitGrantConfigurer { /** * Sets the repository of client registrations .
 * @ param clientRegistrationRepository the repository of client registrations
 * @ return the { @ link ImplicitGrantConfigurer } for further configuration */
public ImplicitGrantConfigurer < B > clientRegistrationRepository ( ClientRegistrationRepository clientRegistrationRepository ) { } }

implementation: Assert . notNull ( clientRegistrationRepository , "clientRegistrationRepository cannot be null" ) ; this . getBuilder ( ) . setSharedObject ( ClientRegistrationRepository . class , clientRegistrationRepository ) ; return this ;


signature:
public class SimpleUrlAuthenticationFailureHandler { /** * Performs the redirect or forward to the { @ code defaultFailureUrl } if set , otherwise
 * returns a 401 error code .
 * If redirecting or forwarding , { @ code saveException } will be called to cache the
 * exception for use in the target view . */
public void onAuthenticationFailure ( HttpServletRequest request , HttpServletResponse response , AuthenticationException exception ) throws IOException , ServletException { } }

implementation: if ( defaultFailureUrl == null ) { logger . debug ( "No failure URL set, sending 401 Unauthorized error" ) ; response . sendError ( HttpStatus . UNAUTHORIZED . value ( ) , HttpStatus . UNAUTHORIZED . getReasonPhrase ( ) ) ; } else { saveException ( request , exception ) ; if ( forwardToDestination ) { logger . debug ( "Forwarding to " + defaultFailureUrl ) ; request . getRequestDispatcher ( defaultFailureUrl ) . forward ( request , response ) ; } else { logger . debug ( "Redirecting to " + defaultFailureUrl ) ; redirectStrategy . sendRedirect ( request , response , defaultFailureUrl ) ; } }


signature:
public class SimpleUrlAuthenticationFailureHandler { /** * Caches the { @ code AuthenticationException } for use in view rendering .
 * If { @ code forwardToDestination } is set to true , request scope will be used ,
 * otherwise it will attempt to store the exception in the session . If there is no
 * session and { @ code allowSessionCreation } is { @ code true } a session will be created .
 * Otherwise the exception will not be stored . */
protected final void saveException ( HttpServletRequest request , AuthenticationException exception ) { } }

implementation: if ( forwardToDestination ) { request . setAttribute ( WebAttributes . AUTHENTICATION_EXCEPTION , exception ) ; } else { HttpSession session = request . getSession ( false ) ; if ( session != null || allowSessionCreation ) { request . getSession ( ) . setAttribute ( WebAttributes . AUTHENTICATION_EXCEPTION , exception ) ; } }


signature:
public class SimpleUrlAuthenticationFailureHandler { /** * The URL which will be used as the failure destination .
 * @ param defaultFailureUrl the failure URL , for example " / loginFailed . jsp " . */
public void setDefaultFailureUrl ( String defaultFailureUrl ) { } }

implementation: Assert . isTrue ( UrlUtils . isValidRedirectUrl ( defaultFailureUrl ) , ( ) -> "'" + defaultFailureUrl + "' is not a valid redirect URL" ) ; this . defaultFailureUrl = defaultFailureUrl ;


signature:
public class PreAuthenticatedAuthenticationProvider { /** * Authenticate the given PreAuthenticatedAuthenticationToken .
 * If the principal contained in the authentication object is null , the request will
 * be ignored to allow other providers to authenticate it . */
public Authentication authenticate ( Authentication authentication ) throws AuthenticationException { } }

implementation: if ( ! supports ( authentication . getClass ( ) ) ) { return null ; } if ( logger . isDebugEnabled ( ) ) { logger . debug ( "PreAuthenticated authentication request: " + authentication ) ; } if ( authentication . getPrincipal ( ) == null ) { logger . debug ( "No pre-authenticated principal found in request." ) ; if ( throwExceptionWhenTokenRejected ) { throw new BadCredentialsException ( "No pre-authenticated principal found in request." ) ; } return null ; } if ( authentication . getCredentials ( ) == null ) { logger . debug ( "No pre-authenticated credentials found in request." ) ; if ( throwExceptionWhenTokenRejected ) { throw new BadCredentialsException ( "No pre-authenticated credentials found in request." ) ; } return null ; } UserDetails ud = preAuthenticatedUserDetailsService . loadUserDetails ( ( PreAuthenticatedAuthenticationToken ) authentication ) ; userDetailsChecker . check ( ud ) ; PreAuthenticatedAuthenticationToken result = new PreAuthenticatedAuthenticationToken ( ud , authentication . getCredentials ( ) , ud . getAuthorities ( ) ) ; result . setDetails ( authentication . getDetails ( ) ) ; return result ;


signature:
public class DefaultLogoutPageGeneratingFilter { /** * Sets a Function used to resolve a Map of the hidden inputs where the key is the
 * name of the input and the value is the value of the input . Typically this is used
 * to resolve the CSRF token .
 * @ param resolveHiddenInputs the function to resolve the inputs */
public void setResolveHiddenInputs ( Function < HttpServletRequest , Map < String , String > > resolveHiddenInputs ) { } }

implementation: Assert . notNull ( resolveHiddenInputs , "resolveHiddenInputs cannot be null" ) ; this . resolveHiddenInputs = resolveHiddenInputs ;


signature:
public class OAuth2IntrospectionAuthenticationProvider { /** * Introspect and validate the opaque
 * < a href = " https : / / tools . ietf . org / html / rfc6750 # section - 1.2 " target = " _ blank " > Bearer Token < / a > .
 * @ param authentication the authentication request object .
 * @ return A successful authentication
 * @ throws AuthenticationException if authentication failed for some reason */
@ Override public Authentication authenticate ( Authentication authentication ) throws AuthenticationException { } }

implementation: if ( ! ( authentication instanceof BearerTokenAuthenticationToken ) ) { return null ; } BearerTokenAuthenticationToken bearer = ( BearerTokenAuthenticationToken ) authentication ; Map < String , Object > claims ; try { claims = this . introspectionClient . introspect ( bearer . getToken ( ) ) ; } catch ( OAuth2IntrospectionException failed ) { OAuth2Error invalidToken = invalidToken ( failed . getMessage ( ) ) ; throw new OAuth2AuthenticationException ( invalidToken ) ; } AbstractAuthenticationToken result = convert ( bearer . getToken ( ) , claims ) ; result . setDetails ( bearer . getDetails ( ) ) ; return result ;


signature:
public class PreAuthenticatedGrantedAuthoritiesUserDetailsService { /** * Get a UserDetails object based on the user name contained in the given token , and
 * the GrantedAuthorities as returned by the GrantedAuthoritiesContainer
 * implementation as returned by the token . getDetails ( ) method . */
public final UserDetails loadUserDetails ( PreAuthenticatedAuthenticationToken token ) throws AuthenticationException { } }

implementation: Assert . notNull ( token . getDetails ( ) , "token.getDetails() cannot be null" ) ; Assert . isInstanceOf ( GrantedAuthoritiesContainer . class , token . getDetails ( ) ) ; Collection < ? extends GrantedAuthority > authorities = ( ( GrantedAuthoritiesContainer ) token . getDetails ( ) ) . getGrantedAuthorities ( ) ; return createUserDetails ( token , authorities ) ;


signature:
public class PreAuthenticatedGrantedAuthoritiesUserDetailsService { /** * Creates the final < tt > UserDetails < / tt > object . Can be overridden to customize the
 * contents .
 * @ param token the authentication request token
 * @ param authorities the pre - authenticated authorities . */
protected UserDetails createUserDetails ( Authentication token , Collection < ? extends GrantedAuthority > authorities ) { } }

implementation: return new User ( token . getName ( ) , "N/A" , true , true , true , true , authorities ) ;


signature:
public class OAuth2TokenValidatorResult { /** * Construct a failure { @ link OAuth2TokenValidatorResult } with the provided detail
 * @ param errors the list of errors
 * @ return an { @ link OAuth2TokenValidatorResult } with the errors specified */
public static OAuth2TokenValidatorResult failure ( Collection < OAuth2Error > errors ) { } }

implementation: if ( errors . isEmpty ( ) ) { return NO_ERRORS ; } return new OAuth2TokenValidatorResult ( errors ) ;


signature:
public class RequestCacheConfigurer { /** * Gets the { @ link RequestCache } to use . If one is defined using
 * { @ link # requestCache ( org . springframework . security . web . savedrequest . RequestCache ) } ,
 * then it is used . Otherwise , an attempt to find a { @ link RequestCache } shared object
 * is made . If that fails , an { @ link HttpSessionRequestCache } is used
 * @ param http the { @ link HttpSecurity } to attempt to fined the shared object
 * @ return the { @ link RequestCache } to use */
private RequestCache getRequestCache ( H http ) { } }

implementation: RequestCache result = http . getSharedObject ( RequestCache . class ) ; if ( result != null ) { return result ; } result = getBeanOrNull ( RequestCache . class ) ; if ( result != null ) { return result ; } HttpSessionRequestCache defaultCache = new HttpSessionRequestCache ( ) ; defaultCache . setRequestMatcher ( createDefaultSavedRequestMatcher ( http ) ) ; return defaultCache ;


signature: public class UrlUtils { public static String buildFullRequestUrl ( HttpServletRequest r ) { } }

implementation: return buildFullRequestUrl ( r . getScheme ( ) , r . getServerName ( ) , r . getServerPort ( ) , r . getRequestURI ( ) , r . getQueryString ( ) ) ;


signature:
public class UrlUtils { /** * Obtains the full URL the client used to make the request .
 * Note that the server port will not be shown if it is the default server port for
 * HTTP or HTTPS ( 80 and 443 respectively ) .
 * @ return the full URL , suitable for redirects ( not decoded ) . */
public static String buildFullRequestUrl ( String scheme , String serverName , int serverPort , String requestURI , String queryString ) { } }

implementation:
scheme = scheme . toLowerCase ( ) ; StringBuilder url = new StringBuilder ( ) ; url . append ( scheme ) . append ( "://" ) . append ( serverName ) ; // Only add port if not default
if ( "http" . equals ( scheme ) ) { if ( serverPort != 80 ) { url . append ( ":" ) . append ( serverPort ) ; } } else if ( "https" . equals ( scheme ) ) { if ( serverPort != 443 ) { url . append ( ":" ) . append ( serverPort ) ; } } // Use the requestURI as it is encoded ( RFC 3986 ) and hence suitable for
// redirects .
url . append ( requestURI ) ; if ( queryString != null ) { url . append ( "?" ) . append ( queryString ) ; } return url . toString ( ) ;


signature:
public class UrlUtils { /** * Obtains the web application - specific fragment of the request URL .
 * Under normal spec conditions ,
 * < pre >
 * requestURI = contextPath + servletPath + pathInfo
 * < / pre >
 * But the requestURI is not decoded , whereas the servletPath and pathInfo are
 * ( SEC - 1255 ) . This method is typically used to return a URL for matching against
 * secured paths , hence the decoded form is used in preference to the requestURI for
 * building the returned value . But this method may also be called using dummy request
 * objects which just have the requestURI and contextPatth set , for example , so it
 * will fall back to using those .
 * @ return the decoded URL , excluding any server name , context path or servlet path */
public static String buildRequestUrl ( HttpServletRequest r ) { } }

implementation: return buildRequestUrl ( r . getServletPath ( ) , r . getRequestURI ( ) , r . getContextPath ( ) , r . getPathInfo ( ) , r . getQueryString ( ) ) ;


signature:
public class UrlUtils { /** * Obtains the web application - specific fragment of the URL . */
private static String buildRequestUrl ( String servletPath , String requestURI , String contextPath , String pathInfo , String queryString ) { } }

implementation: StringBuilder url = new StringBuilder ( ) ; if ( servletPath != null ) { url . append ( servletPath ) ; if ( pathInfo != null ) { url . append ( pathInfo ) ; } } else { url . append ( requestURI . substring ( contextPath . length ( ) ) ) ; } if ( queryString != null ) { url . append ( "?" ) . append ( queryString ) ; } return url . toString ( ) ;


signature:
public class UrlUtils { /** * Decides if a URL is absolute based on whether it contains a valid scheme name , as
 * defined in RFC 1738. */
public static boolean isAbsoluteUrl ( String url ) { } }

implementation: if ( url == null ) { return false ; } final Pattern ABSOLUTE_URL = Pattern . compile ( "\\A[a-z0-9.+-]+://.*" , Pattern . CASE_INSENSITIVE ) ; return ABSOLUTE_URL . matcher ( url ) . matches ( ) ;


signature:
public class RegexBasedAxFetchListFactory { /** * Iterates through the patterns stored in the map and returns the list of attributes
 * defined for the first match . If no match is found , returns an empty list . */
public List < OpenIDAttribute > createAttributeList ( String identifier ) { } }

implementation: for ( Map . Entry < Pattern , List < OpenIDAttribute > > entry : idToAttributes . entrySet ( ) ) { if ( entry . getKey ( ) . matcher ( identifier ) . matches ( ) ) { return entry . getValue ( ) ; } } return Collections . emptyList ( ) ;


signature: public class AnonymousAuthenticationFilter { @ Override public void afterPropertiesSet ( ) { } }

implementation: Assert . hasLength ( key , "key must have length" ) ; Assert . notNull ( principal , "Anonymous authentication principal must be set" ) ; Assert . notNull ( authorities , "Anonymous authorities must be set" ) ;


signature:
public class AclFormattingUtils { /** * Returns a representation of the active bits in the presented mask , with each active
 * bit being denoted by the passed character .
 * Inactive bits will be denoted by character { @ link Permission # RESERVED _ OFF } .
 * @ param mask the integer bit mask to print the active bits for
 * @ param code the character to print when an active bit is detected
 * @ return a 32 - character representation of the bit mask */
public static String printBinary ( int mask , char code ) { } }

implementation: Assert . doesNotContain ( Character . toString ( code ) , Character . toString ( Permission . RESERVED_ON ) , ( ) -> Permission . RESERVED_ON + " is a reserved character code" ) ; Assert . doesNotContain ( Character . toString ( code ) , Character . toString ( Permission . RESERVED_OFF ) , ( ) -> Permission . RESERVED_OFF + " is a reserved character code" ) ; return printBinary ( mask , Permission . RESERVED_ON , Permission . RESERVED_OFF ) . replace ( Permission . RESERVED_ON , code ) ;


signature:
public class AclClassIdUtils { /** * Converts the raw type from the database into the right Java type . For most applications the ' raw type ' will be Long , for some applications
 * it could be String .
 * @ param identifier The identifier from the database
 * @ param resultSet Result set of the query
 * @ return The identifier in the appropriate target Java type . Typically Long or UUID .
 * @ throws SQLException */
Serializable identifierFrom ( Serializable identifier , ResultSet resultSet ) throws SQLException { } }

implementation:
if ( isString ( identifier ) && hasValidClassIdType ( resultSet ) && canConvertFromStringTo ( classIdTypeFrom ( resultSet ) ) ) { identifier = convertFromStringTo ( ( String ) identifier , classIdTypeFrom ( resultSet ) ) ; } else { // Assume it should be a Long type
identifier = convertToLong ( identifier ) ; } return identifier ;


signature:
public class AclClassIdUtils { /** * Converts to a { @ link Long } , attempting to use the { @ link ConversionService } if available .
 * @ param identifier The identifier
 * @ return Long version of the identifier
 * @ throws NumberFormatException if the string cannot be parsed to a long .
 * @ throws org . springframework . core . convert . ConversionException if a conversion exception occurred
 * @ throws IllegalArgumentException if targetType is null */
private Long convertToLong ( Serializable identifier ) { } }

implementation: Long idAsLong ; if ( canConvertFromStringTo ( Long . class ) ) { idAsLong = conversionService . convert ( identifier , Long . class ) ; } else { idAsLong = Long . valueOf ( identifier . toString ( ) ) ; } return idAsLong ;


signature:
public class User { /** * < b > WARNING : < / b > This method is considered unsafe for production and is only intended
 * for sample applications .
 * Creates a user and automatically encodes the provided password using
 * { @ code PasswordEncoderFactories . createDelegatingPasswordEncoder ( ) } . For example :
 * < pre >
 * < code >
 * UserDetails user = User . withDefaultPasswordEncoder ( )
 * . username ( " user " )
 * . password ( " password " )
 * . roles ( " USER " )
 * . build ( ) ;
 * / / outputs { bcrypt } $ 2a $ 10 $ dXJ3SW6G7P50lGmMkkmwe . 20cQQubK3 . HZWzG3YB1tlRy . fqvM / BG
 * System . out . println ( user . getPassword ( ) ) ;
 * < / code >
 * < / pre >
 * This is not safe for production ( it is intended for getting started experience )
 * because the password " password " is compiled into the source code and then is
 * included in memory at the time of creation . This means there are still ways to
 * recover the plain text password making it unsafe . It does provide a slight
 * improvement to using plain text passwords since the UserDetails password is
 * securely hashed . This means if the UserDetails password is accidentally exposed ,
 * the password is securely stored .
 * In a production setting , it is recommended to hash the password ahead of time .
 * For example :
 * < pre >
 * < code >
 * PasswordEncoder encoder = PasswordEncoderFactories . createDelegatingPasswordEncoder ( ) ;
 * / / outputs { bcrypt } $ 2a $ 10 $ dXJ3SW6G7P50lGmMkkmwe . 20cQQubK3 . HZWzG3YB1tlRy . fqvM / BG
 * / / remember the password that is printed out and use in the next step
 * System . out . println ( encoder . encode ( " password " ) ) ;
 * < / code >
 * < / pre >
 * < pre >
 * < code >
 * UserDetails user = User . withUsername ( " user " )
 * . password ( " { bcrypt } $ 2a $ 10 $ dXJ3SW6G7P50lGmMkkmwe . 20cQQubK3 . HZWzG3YB1tlRy . fqvM / BG " )
 * . roles ( " USER " )
 * . build ( ) ;
 * < / code >
 * < / pre >
 * @ return a UserBuilder that automatically encodes the password with the default
 * PasswordEncoder
 * @ deprecated Using this method is not considered safe for production , but is
 * acceptable for demos and getting started . For production purposes , ensure the
 * password is encoded externally . See the method Javadoc for additional details .
 * There are no plans to remove this support . It is deprecated to indicate
 * that this is considered insecure for production purposes . */
@ Deprecated public static UserBuilder withDefaultPasswordEncoder ( ) { } }

implementation: logger . warn ( "User.withDefaultPasswordEncoder() is considered unsafe for production and is only intended for sample applications." ) ; PasswordEncoder encoder = PasswordEncoderFactories . createDelegatingPasswordEncoder ( ) ; return builder ( ) . passwordEncoder ( encoder :: encode ) ;


signature:
public class ClientRegistrations { /** * Creates a { @ link ClientRegistration . Builder } using the provided
 * < a href = " https : / / openid . net / specs / openid - connect - core - 1_0 . html # IssuerIdentifier " > Issuer < / a > by making an
 * < a href = " https : / / openid . net / specs / openid - connect - discovery - 1_0 . html # ProviderConfigurationRequest " > OpenID Provider
 * Configuration Request < / a > and using the values in the
 * < a href = " https : / / openid . net / specs / openid - connect - discovery - 1_0 . html # ProviderConfigurationResponse " > OpenID
 * Provider Configuration Response < / a > to initialize the { @ link ClientRegistration . Builder } .
 * For example , if the issuer provided is " https : / / example . com " , then an " OpenID Provider Configuration Request " will
 * be made to " https : / / example . com / . well - known / openid - configuration " . The result is expected to be an " OpenID
 * Provider Configuration Response " .
 * Example usage :
 * < pre >
 * ClientRegistration registration = ClientRegistrations . fromOidcIssuerLocation ( " https : / / example . com " )
 * . clientId ( " client - id " )
 * . clientSecret ( " client - secret " )
 * . build ( ) ;
 * < / pre >
 * @ param issuer the < a href = " https : / / openid . net / specs / openid - connect - core - 1_0 . html # IssuerIdentifier " > Issuer < / a >
 * @ return a { @ link ClientRegistration . Builder } that was initialized by the OpenID Provider Configuration . */
public static ClientRegistration . Builder fromOidcIssuerLocation ( String issuer ) { } }

implementation:
String openidConfiguration = getOpenidConfiguration ( issuer ) ; OIDCProviderMetadata metadata = parse ( openidConfiguration ) ; String metadataIssuer = metadata . getIssuer ( ) . getValue ( ) ; if ( ! issuer . equals ( metadataIssuer ) ) { throw new IllegalStateException ( "The Issuer \"" + metadataIssuer + "\" provided in the OpenID Configuration did not match the requested issuer \"" + issuer + "\"" ) ; } String name = URI . create ( issuer ) . getHost ( ) ; ClientAuthenticationMethod method = getClientAuthenticationMethod ( issuer , metadata . getTokenEndpointAuthMethods ( ) ) ; List < GrantType > grantTypes = metadata . getGrantTypes ( ) ; // If null , the default includes authorization _ code
if ( grantTypes != null && ! grantTypes . contains ( GrantType . AUTHORIZATION_CODE ) ) { throw new IllegalArgumentException ( "Only AuthorizationGrantType.AUTHORIZATION_CODE is supported. The issuer \"" + issuer + "\" returned a configuration of " + grantTypes ) ; } List < String > scopes = getScopes ( metadata ) ; Map < String , Object > configurationMetadata = new LinkedHashMap < > ( metadata . toJSONObject ( ) ) ; return ClientRegistration . withRegistrationId ( name ) . userNameAttributeName ( IdTokenClaimNames . SUB ) . scope ( scopes ) . authorizationGrantType ( AuthorizationGrantType . AUTHORIZATION_CODE ) . clientAuthenticationMethod ( method ) . redirectUriTemplate ( "{baseUrl}/{action}/oauth2/code/{registrationId}" ) . authorizationUri ( metadata . getAuthorizationEndpointURI ( ) . toASCIIString ( ) ) . jwkSetUri ( metadata . getJWKSetURI ( ) . toASCIIString ( ) ) . providerConfigurationMetadata ( configurationMetadata ) . userInfoUri ( metadata . getUserInfoEndpointURI ( ) . toASCIIString ( ) ) . tokenUri ( metadata . getTokenEndpointURI ( ) . toASCIIString ( ) ) . clientName ( issuer ) ;


signature: public class NullRunAsManager { public Authentication buildRunAs ( Authentication authentication , Object object , Collection < ConfigAttribute > config ) { } }

implementation: return null ;


signature:
public class CsrfServerLogoutHandler { /** * Clears the { @ link CsrfToken }
 * @ param exchange the exchange
 * @ param authentication the { @ link Authentication }
 * @ return A completion notification ( success or error ) */
@ Override public Mono < Void > logout ( WebFilterExchange exchange , Authentication authentication ) { } }

implementation: return this . csrfTokenRepository . saveToken ( exchange . getExchange ( ) , null ) ;


signature:
public class ExceptionHandlingConfigurer { /** * Shortcut to specify the { @ link AccessDeniedHandler } to be used is a specific error
 * page
 * @ param accessDeniedUrl the URL to the access denied page ( i . e . / errors / 401)
 * @ return the { @ link ExceptionHandlingConfigurer } for further customization
 * @ see AccessDeniedHandlerImpl
 * @ see # accessDeniedHandler ( org . springframework . security . web . access . AccessDeniedHandler ) */
public ExceptionHandlingConfigurer < H > accessDeniedPage ( String accessDeniedUrl ) { } }

implementation: AccessDeniedHandlerImpl accessDeniedHandler = new AccessDeniedHandlerImpl ( ) ; accessDeniedHandler . setErrorPage ( accessDeniedUrl ) ; return accessDeniedHandler ( accessDeniedHandler ) ;


signature:
public class ExceptionHandlingConfigurer { /** * Sets a default { @ link AccessDeniedHandler } to be used which prefers being
 * invoked for the provided { @ link RequestMatcher } . If only a single default
 * { @ link AccessDeniedHandler } is specified , it will be what is used for the
 * default { @ link AccessDeniedHandler } . If multiple default
 * { @ link AccessDeniedHandler } instances are configured , then a
 * { @ link RequestMatcherDelegatingAccessDeniedHandler } will be used .
 * @ param deniedHandler the { @ link AccessDeniedHandler } to use
 * @ param preferredMatcher the { @ link RequestMatcher } for this default
 * { @ link AccessDeniedHandler }
 * @ return the { @ link ExceptionHandlingConfigurer } for further customizations
 * @ since 5.1 */
public ExceptionHandlingConfigurer < H > defaultAccessDeniedHandlerFor ( AccessDeniedHandler deniedHandler , RequestMatcher preferredMatcher ) { } }

implementation: this . defaultDeniedHandlerMappings . put ( preferredMatcher , deniedHandler ) ; return this ;


signature:
public class ExceptionHandlingConfigurer { /** * Sets a default { @ link AuthenticationEntryPoint } to be used which prefers being
 * invoked for the provided { @ link RequestMatcher } . If only a single default
 * { @ link AuthenticationEntryPoint } is specified , it will be what is used for the
 * default { @ link AuthenticationEntryPoint } . If multiple default
 * { @ link AuthenticationEntryPoint } instances are configured , then a
 * { @ link DelegatingAuthenticationEntryPoint } will be used .
 * @ param entryPoint the { @ link AuthenticationEntryPoint } to use
 * @ param preferredMatcher the { @ link RequestMatcher } for this default
 * { @ link AuthenticationEntryPoint }
 * @ return the { @ link ExceptionHandlingConfigurer } for further customizations */
public ExceptionHandlingConfigurer < H > defaultAuthenticationEntryPointFor ( AuthenticationEntryPoint entryPoint , RequestMatcher preferredMatcher ) { } }

implementation: this . defaultEntryPointMappings . put ( preferredMatcher , entryPoint ) ; return this ;


signature:
public class ExceptionHandlingConfigurer { /** * Gets the { @ link AccessDeniedHandler } according to the rules specified by
 * { @ link # accessDeniedHandler ( AccessDeniedHandler ) }
 * @ param http the { @ link HttpSecurity } used to look up shared
 * { @ link AccessDeniedHandler }
 * @ return the { @ link AccessDeniedHandler } to use */
AccessDeniedHandler getAccessDeniedHandler ( H http ) { } }

implementation: AccessDeniedHandler deniedHandler = this . accessDeniedHandler ; if ( deniedHandler == null ) { deniedHandler = createDefaultDeniedHandler ( http ) ; } return deniedHandler ;


signature:
public class ExceptionHandlingConfigurer { /** * Gets the { @ link AuthenticationEntryPoint } according to the rules specified by
 * { @ link # authenticationEntryPoint ( AuthenticationEntryPoint ) }
 * @ param http the { @ link HttpSecurity } used to look up shared
 * { @ link AuthenticationEntryPoint }
 * @ return the { @ link AuthenticationEntryPoint } to use */
AuthenticationEntryPoint getAuthenticationEntryPoint ( H http ) { } }

implementation: AuthenticationEntryPoint entryPoint = this . authenticationEntryPoint ; if ( entryPoint == null ) { entryPoint = createDefaultEntryPoint ( http ) ; } return entryPoint ;


signature:
public class ExceptionHandlingConfigurer { /** * Gets the { @ link RequestCache } to use . If one is defined using
 * { @ link # requestCache ( org . springframework . security . web . savedrequest . RequestCache ) } ,
 * then it is used . Otherwise , an attempt to find a { @ link RequestCache } shared object
 * is made . If that fails , an { @ link HttpSessionRequestCache } is used
 * @ param http the { @ link HttpSecurity } to attempt to fined the shared object
 * @ return the { @ link RequestCache } to use */
private RequestCache getRequestCache ( H http ) { } }

implementation: RequestCache result = http . getSharedObject ( RequestCache . class ) ; if ( result != null ) { return result ; } return new HttpSessionRequestCache ( ) ;


signature:
public class RoleHierarchyUtils { /** * Converts the supplied { @ link Map } of role name to implied role name ( s ) to a string
 * representation understood by { @ link RoleHierarchyImpl # setHierarchy ( String ) } .
 * The map key is the role name and the map value is a { @ link List } of implied role name ( s ) .
 * @ param roleHierarchyMap the mapping ( s ) of role name to implied role name ( s )
 * @ return a string representation of a role hierarchy
 * @ throws IllegalArgumentException if roleHierarchyMap is null or empty or if a role name is null or
 * empty or if an implied role name ( s ) is null or empty */
public static String roleHierarchyFromMap ( Map < String , List < String > > roleHierarchyMap ) { } }

implementation: Assert . notEmpty ( roleHierarchyMap , "roleHierarchyMap cannot be empty" ) ; StringWriter roleHierarchyBuffer = new StringWriter ( ) ; PrintWriter roleHierarchyWriter = new PrintWriter ( roleHierarchyBuffer ) ; for ( Map . Entry < String , List < String > > roleHierarchyEntry : roleHierarchyMap . entrySet ( ) ) { String role = roleHierarchyEntry . getKey ( ) ; List < String > impliedRoles = roleHierarchyEntry . getValue ( ) ; Assert . hasLength ( role , "role name must be supplied" ) ; Assert . notEmpty ( impliedRoles , "implied role name(s) cannot be empty" ) ; for ( String impliedRole : impliedRoles ) { String roleMapping = role + " > " + impliedRole ; roleHierarchyWriter . println ( roleMapping ) ; } } return roleHierarchyBuffer . toString ( ) ;


signature: public class JdbcMutableAclService { public MutableAcl createAcl ( ObjectIdentity objectIdentity ) throws AlreadyExistsException { } }

implementation:
Assert . notNull ( objectIdentity , "Object Identity required" ) ; // Check this object identity hasn ' t already been persisted
if ( retrieveObjectIdentityPrimaryKey ( objectIdentity ) != null ) { throw new AlreadyExistsException ( "Object identity '" + objectIdentity + "' already exists" ) ; } // Need to retrieve the current principal , in order to know who " owns " this ACL
// ( can be changed later on )
Authentication auth = SecurityContextHolder . getContext ( ) . getAuthentication ( ) ; PrincipalSid sid = new PrincipalSid ( auth ) ; // Create the acl _ object _ identity row
createObjectIdentity ( objectIdentity , sid ) ; // Retrieve the ACL via superclass ( ensures cache registration , proper retrieval
// etc )
Acl acl = readAclById ( objectIdentity ) ; Assert . isInstanceOf ( MutableAcl . class , acl , "MutableAcl should be been returned" ) ; return ( MutableAcl ) acl ;


signature:
public class JdbcMutableAclService { /** * Creates a new row in acl _ entry for every ACE defined in the passed MutableAcl
 * object .
 * @ param acl containing the ACEs to insert */
protected void createEntries ( final MutableAcl acl ) { } }

implementation: if ( acl . getEntries ( ) . isEmpty ( ) ) { return ; } jdbcOperations . batchUpdate ( insertEntry , new BatchPreparedStatementSetter ( ) { public int getBatchSize ( ) { return acl . getEntries ( ) . size ( ) ; } public void setValues ( PreparedStatement stmt , int i ) throws SQLException { AccessControlEntry entry_ = acl . getEntries ( ) . get ( i ) ; Assert . isTrue ( entry_ instanceof AccessControlEntryImpl , "Unknown ACE class" ) ; AccessControlEntryImpl entry = ( AccessControlEntryImpl ) entry_ ; stmt . setLong ( 1 , ( ( Long ) acl . getId ( ) ) . longValue ( ) ) ; stmt . setInt ( 2 , i ) ; stmt . setLong ( 3 , createOrRetrieveSidPrimaryKey ( entry . getSid ( ) , true ) . longValue ( ) ) ; stmt . setInt ( 4 , entry . getPermission ( ) . getMask ( ) ) ; stmt . setBoolean ( 5 , entry . isGranting ( ) ) ; stmt . setBoolean ( 6 , entry . isAuditSuccess ( ) ) ; stmt . setBoolean ( 7 , entry . isAuditFailure ( ) ) ; } } ) ;


signature:
public class JdbcMutableAclService { /** * Creates an entry in the acl _ object _ identity table for the passed ObjectIdentity .
 * The Sid is also necessary , as acl _ object _ identity has defined the sid column as
 * non - null .
 * @ param object to represent an acl _ object _ identity for
 * @ param owner for the SID column ( will be created if there is no acl _ sid entry for
 * this particular Sid already ) */
protected void createObjectIdentity ( ObjectIdentity object , Sid owner ) { } }

implementation: Long sidId = createOrRetrieveSidPrimaryKey ( owner , true ) ; Long classId = createOrRetrieveClassPrimaryKey ( object . getType ( ) , true , object . getIdentifier ( ) . getClass ( ) ) ; jdbcOperations . update ( insertObjectIdentity , classId , object . getIdentifier ( ) . toString ( ) , sidId , Boolean . TRUE ) ;


signature:
public class JdbcMutableAclService { /** * Retrieves the primary key from { @ code acl _ class } , creating a new row if needed and
 * the { @ code allowCreate } property is { @ code true } .
 * @ param type to find or create an entry for ( often the fully - qualified class name )
 * @ param allowCreate true if creation is permitted if not found
 * @ return the primary key or null if not found */
protected Long createOrRetrieveClassPrimaryKey ( String type , boolean allowCreate , Class idType ) { } }

implementation: List < Long > classIds = jdbcOperations . queryForList ( selectClassPrimaryKey , new Object [ ] { type } , Long . class ) ; if ( ! classIds . isEmpty ( ) ) { return classIds . get ( 0 ) ; } if ( allowCreate ) { if ( ! isAclClassIdSupported ( ) ) { jdbcOperations . update ( insertClass , type ) ; } else { jdbcOperations . update ( insertClass , type , idType . getCanonicalName ( ) ) ; } Assert . isTrue ( TransactionSynchronizationManager . isSynchronizationActive ( ) , "Transaction must be running" ) ; return jdbcOperations . queryForObject ( classIdentityQuery , Long . class ) ; } return null ;


signature:
public class JdbcMutableAclService { /** * Retrieves the primary key from acl _ sid , creating a new row if needed and the
 * allowCreate property is true .
 * @ param sid to find or create
 * @ param allowCreate true if creation is permitted if not found
 * @ return the primary key or null if not found
 * @ throws IllegalArgumentException if the < tt > Sid < / tt > is not a recognized
 * implementation . */
protected Long createOrRetrieveSidPrimaryKey ( Sid sid , boolean allowCreate ) { } }

implementation: Assert . notNull ( sid , "Sid required" ) ; String sidName ; boolean sidIsPrincipal = true ; if ( sid instanceof PrincipalSid ) { sidName = ( ( PrincipalSid ) sid ) . getPrincipal ( ) ; } else if ( sid instanceof GrantedAuthoritySid ) { sidName = ( ( GrantedAuthoritySid ) sid ) . getGrantedAuthority ( ) ; sidIsPrincipal = false ; } else { throw new IllegalArgumentException ( "Unsupported implementation of Sid" ) ; } return createOrRetrieveSidPrimaryKey ( sidName , sidIsPrincipal , allowCreate ) ;


signature:
public class JdbcMutableAclService { /** * Retrieves the primary key from acl _ sid , creating a new row if needed and the
 * allowCreate property is true .
 * @ param sidName name of Sid to find or to create
 * @ param sidIsPrincipal whether it ' s a user or granted authority like role
 * @ param allowCreate true if creation is permitted if not found
 * @ return the primary key or null if not found */
protected Long createOrRetrieveSidPrimaryKey ( String sidName , boolean sidIsPrincipal , boolean allowCreate ) { } }

implementation: List < Long > sidIds = jdbcOperations . queryForList ( selectSidPrimaryKey , new Object [ ] { Boolean . valueOf ( sidIsPrincipal ) , sidName } , Long . class ) ; if ( ! sidIds . isEmpty ( ) ) { return sidIds . get ( 0 ) ; } if ( allowCreate ) { jdbcOperations . update ( insertSid , Boolean . valueOf ( sidIsPrincipal ) , sidName ) ; Assert . isTrue ( TransactionSynchronizationManager . isSynchronizationActive ( ) , "Transaction must be running" ) ; return jdbcOperations . queryForObject ( sidIdentityQuery , Long . class ) ; } return null ;


signature:
public class JdbcMutableAclService { /** * Retrieves the primary key from the acl _ object _ identity table for the passed
 * ObjectIdentity . Unlike some other methods in this implementation , this method will
 * NOT create a row ( use { @ link # createObjectIdentity ( ObjectIdentity , Sid ) } instead ) .
 * @ param oid to find
 * @ return the object identity or null if not found */
protected Long retrieveObjectIdentityPrimaryKey ( ObjectIdentity oid ) { } }

implementation: try { return jdbcOperations . queryForObject ( selectObjectIdentityPrimaryKey , Long . class , oid . getType ( ) , oid . getIdentifier ( ) . toString ( ) ) ; } catch ( DataAccessException notFound ) { return null ; }


signature:
public class JdbcMutableAclService { /** * This implementation will simply delete all ACEs in the database and recreate them
 * on each invocation of this method . A more comprehensive implementation might use
 * dirty state checking , or more likely use ORM capabilities for create , update and
 * delete operations of { @ link MutableAcl } . */
public MutableAcl updateAcl ( MutableAcl acl ) throws NotFoundException { } }

implementation:
Assert . notNull ( acl . getId ( ) , "Object Identity doesn't provide an identifier" ) ; // Delete this ACL ' s ACEs in the acl _ entry table
deleteEntries ( retrieveObjectIdentityPrimaryKey ( acl . getObjectIdentity ( ) ) ) ; // Create this ACL ' s ACEs in the acl _ entry table
createEntries ( acl ) ; // Change the mutable columns in acl _ object _ identity
updateObjectIdentity ( acl ) ; // Clear the cache , including children
clearCacheIncludingChildren ( acl . getObjectIdentity ( ) ) ; // Retrieve the ACL via superclass ( ensures cache registration , proper retrieval
// etc )
return ( MutableAcl ) super . readAclById ( acl . getObjectIdentity ( ) ) ;


signature:
public class JdbcMutableAclService { /** * Updates an existing acl _ object _ identity row , with new information presented in the
 * passed MutableAcl object . Also will create an acl _ sid entry if needed for the Sid
 * that owns the MutableAcl .
 * @ param acl to modify ( a row must already exist in acl _ object _ identity )
 * @ throws NotFoundException if the ACL could not be found to update . */
protected void updateObjectIdentity ( MutableAcl acl ) { } }

implementation: Long parentId = null ; if ( acl . getParentAcl ( ) != null ) { Assert . isInstanceOf ( ObjectIdentityImpl . class , acl . getParentAcl ( ) . getObjectIdentity ( ) , "Implementation only supports ObjectIdentityImpl" ) ; ObjectIdentityImpl oii = ( ObjectIdentityImpl ) acl . getParentAcl ( ) . getObjectIdentity ( ) ; parentId = retrieveObjectIdentityPrimaryKey ( oii ) ; } Assert . notNull ( acl . getOwner ( ) , "Owner is required in this implementation" ) ; Long ownerSid = createOrRetrieveSidPrimaryKey ( acl . getOwner ( ) , true ) ; int count = jdbcOperations . update ( updateObjectIdentity , parentId , ownerSid , Boolean . valueOf ( acl . isEntriesInheriting ( ) ) , acl . getId ( ) ) ; if ( count != 1 ) { throw new NotFoundException ( "Unable to locate ACL to update" ) ; }


signature:
public class HttpSessionRequestCache { /** * Stores the current request , provided the configuration properties allow it . */
public void saveRequest ( HttpServletRequest request , HttpServletResponse response ) { } }

implementation:
if ( requestMatcher . matches ( request ) ) { DefaultSavedRequest savedRequest = new DefaultSavedRequest ( request , portResolver ) ; if ( createSessionAllowed || request . getSession ( false ) != null ) { // Store the HTTP request itself . Used by
// AbstractAuthenticationProcessingFilter
// for redirection after successful authentication ( SEC - 29)
request . getSession ( ) . setAttribute ( this . sessionAttrName , savedRequest ) ; logger . debug ( "DefaultSavedRequest added to Session: " + savedRequest ) ; } } else { logger . debug ( "Request not saved as configured RequestMatcher did not match" ) ; }


signature:
public class DelegatingSecurityContextCallable { /** * Creates a { @ link DelegatingSecurityContextCallable } and with the given
 * { @ link Callable } and { @ link SecurityContext } , but if the securityContext is null
 * will defaults to the current { @ link SecurityContext } on the
 * { @ link SecurityContextHolder }
 * @ param delegate the delegate { @ link DelegatingSecurityContextCallable } to run with
 * the specified { @ link SecurityContext } . Cannot be null .
 * @ param securityContext the { @ link SecurityContext } to establish for the delegate
 * { @ link Callable } . If null , defaults to { @ link SecurityContextHolder # getContext ( ) }
 * @ return */
public static < V > Callable < V > create ( Callable < V > delegate , SecurityContext securityContext ) { } }

implementation: return securityContext == null ? new DelegatingSecurityContextCallable < > ( delegate ) : new DelegatingSecurityContextCallable < > ( delegate , securityContext ) ;


signature:
public class HttpServlet3RequestFactory { /** * Sets the { @ link LogoutHandler } s used when integrating with
 * { @ link HttpServletRequest } with Servlet 3 APIs . Specifically it will be used when
 * { @ link HttpServletRequest # logout ( ) } is invoked in order to log the user out . So
 * long as the { @ link LogoutHandler } s do not commit the { @ link HttpServletResponse }
 * ( expected ) , then the user is in charge of handling the response .
 * If the value is null ( default ) , the default container behavior will be retained
 * when invoking { @ link HttpServletRequest # logout ( ) } .
 * @ param logoutHandlers the { @ link List < LogoutHandler > } s when invoking
 * { @ link HttpServletRequest # logout ( ) } . */
public void setLogoutHandlers ( List < LogoutHandler > logoutHandlers ) { } }

implementation: this . logoutHandler = CollectionUtils . isEmpty ( logoutHandlers ) ? null : new CompositeLogoutHandler ( logoutHandlers ) ;


signature:
public class ServerWebExchangeMatchers { /** * Creates a matcher that matches on the specific method and any of the provided patterns .
 * @ param method the method to match on . If null , any method will be matched
 * @ param patterns the patterns to match on
 * @ return the matcher to use */
public static ServerWebExchangeMatcher pathMatchers ( HttpMethod method , String ... patterns ) { } }

implementation: List < ServerWebExchangeMatcher > matchers = new ArrayList < > ( patterns . length ) ; for ( String pattern : patterns ) { matchers . add ( new PathPatternParserServerWebExchangeMatcher ( pattern , method ) ) ; } return new OrServerWebExchangeMatcher ( matchers ) ;


signature:
public class ServerWebExchangeMatchers { /** * Matches any exchange
 * @ return the matcher to use */
public static ServerWebExchangeMatcher anyExchange ( ) { } }

implementation:
// we don ' t use a lambda to ensure a unique equals and hashcode
// which otherwise can cause problems with adding multiple entries to an ordered LinkedHashMap
return new ServerWebExchangeMatcher ( ) { @ Override public Mono < MatchResult > matches ( ServerWebExchange exchange ) { return ServerWebExchangeMatcher . MatchResult . match ( ) ; } } ;


signature:
public class Encryptors { /** * Creates a standard password - based bytes encryptor using 256 bit AES encryption with
 * Galois Counter Mode ( GCM ) . Derives the secret key using PKCS # 5 ' s PBKDF2
 * ( Password - Based Key Derivation Function # 2 ) . Salts the password to prevent
 * dictionary attacks against the key . The provided salt is expected to be
 * hex - encoded ; it should be random and at least 8 bytes in length . Also applies a
 * random 16 byte initialization vector to ensure each encrypted message will be
 * unique . Requires Java 6.
 * @ param password the password used to generate the encryptor ' s secret key ; should
 * not be shared
 * @ param salt a hex - encoded , random , site - global salt value to use to generate the
 * key
 * @ see # standard ( CharSequence , CharSequence ) which uses the slightly weaker CBC mode
 * ( instead of GCM ) */
public static BytesEncryptor stronger ( CharSequence password , CharSequence salt ) { } }

implementation: return new AesBytesEncryptor ( password . toString ( ) , salt , KeyGenerators . secureRandom ( 16 ) , CipherAlgorithm . GCM ) ;


signature:
public class Encryptors { /** * Creates a standard password - based bytes encryptor using 256 bit AES encryption .
 * Derives the secret key using PKCS # 5 ' s PBKDF2 ( Password - Based Key Derivation
 * Function # 2 ) . Salts the password to prevent dictionary attacks against the key . The
 * provided salt is expected to be hex - encoded ; it should be random and at least 8
 * bytes in length . Also applies a random 16 byte initialization vector to ensure each
 * encrypted message will be unique . Requires Java 6.
 * @ param password the password used to generate the encryptor ' s secret key ; should
 * not be shared
 * @ param salt a hex - encoded , random , site - global salt value to use to generate the
 * key */
public static BytesEncryptor standard ( CharSequence password , CharSequence salt ) { } }

implementation: return new AesBytesEncryptor ( password . toString ( ) , salt , KeyGenerators . secureRandom ( 16 ) ) ;


signature:
public class Encryptors { /** * Creates a text encryptor that uses " stronger " password - based encryption . Encrypted
 * text is hex - encoded .
 * @ param password the password used to generate the encryptor ' s secret key ; should
 * not be shared
 * @ see Encryptors # stronger ( CharSequence , CharSequence ) */
public static TextEncryptor delux ( CharSequence password , CharSequence salt ) { } }

implementation: return new HexEncodingTextEncryptor ( stronger ( password , salt ) ) ;


signature:
public class Encryptors { /** * Creates a text encryptor that uses " standard " password - based encryption . Encrypted
 * text is hex - encoded .
 * @ param password the password used to generate the encryptor ' s secret key ; should
 * not be shared
 * @ see Encryptors # standard ( CharSequence , CharSequence ) */
public static TextEncryptor text ( CharSequence password , CharSequence salt ) { } }

implementation: return new HexEncodingTextEncryptor ( standard ( password , salt ) ) ;


signature:
public class Encryptors { /** * Creates an encryptor for queryable text strings that uses standard password - based
 * encryption . Uses a 16 - byte all - zero initialization vector so encrypting the same
 * data results in the same encryption result . This is done to allow encrypted data to
 * be queried against . Encrypted text is hex - encoded .
 * @ param password the password used to generate the encryptor ' s secret key ; should
 * not be shared
 * @ param salt a hex - encoded , random , site - global salt value to use to generate the
 * secret key */
public static TextEncryptor queryableText ( CharSequence password , CharSequence salt ) { } }

implementation: return new HexEncodingTextEncryptor ( new AesBytesEncryptor ( password . toString ( ) , salt ) ) ;


signature:
public class WebSecurity { /** * Set the { @ link SecurityExpressionHandler } to be used . If this is null , then a
 * { @ link DefaultWebSecurityExpressionHandler } will be used .
 * @ param expressionHandler the { @ link SecurityExpressionHandler } to use
 * @ return the { @ link WebSecurity } for further customizations */
public WebSecurity expressionHandler ( SecurityExpressionHandler < FilterInvocation > expressionHandler ) { } }

implementation: Assert . notNull ( expressionHandler , "expressionHandler cannot be null" ) ; this . expressionHandler = expressionHandler ; return this ;


signature:
public class WebSecurity { /** * Gets the { @ link WebInvocationPrivilegeEvaluator } to be used .
 * @ return the { @ link WebInvocationPrivilegeEvaluator } for further customizations */
public WebInvocationPrivilegeEvaluator getPrivilegeEvaluator ( ) { } }

implementation: if ( privilegeEvaluator != null ) { return privilegeEvaluator ; } return filterSecurityInterceptor == null ? null : new DefaultWebInvocationPrivilegeEvaluator ( filterSecurityInterceptor ) ;


signature:
public class UnanimousBased { /** * This concrete implementation polls all configured { @ link AccessDecisionVoter } s for
 * each { @ link ConfigAttribute } and grants access if < b > only < / b > grant ( or abstain )
 * votes were received .
 * Other voting implementations usually pass the entire list of
 * < tt > ConfigAttribute < / tt > s to the < code > AccessDecisionVoter < / code > . This
 * implementation differs in that each < code > AccessDecisionVoter < / code > knows only
 * about a single < code > ConfigAttribute < / code > at a time .
 * If every < code > AccessDecisionVoter < / code > abstained from voting , the decision will
 * be based on the { @ link # isAllowIfAllAbstainDecisions ( ) } property ( defaults to
 * false ) .
 * @ param authentication the caller invoking the method
 * @ param object the secured object
 * @ param attributes the configuration attributes associated with the method being
 * invoked
 * @ throws AccessDeniedException if access is denied */
public void decide ( Authentication authentication , Object object , Collection < ConfigAttribute > attributes ) throws AccessDeniedException { } }

implementation:
int grant = 0 ; List < ConfigAttribute > singleAttributeList = new ArrayList < > ( 1 ) ; singleAttributeList . add ( null ) ; for ( ConfigAttribute attribute : attributes ) { singleAttributeList . set ( 0 , attribute ) ; for ( AccessDecisionVoter voter : getDecisionVoters ( ) ) { int result = voter . vote ( authentication , object , singleAttributeList ) ; if ( logger . isDebugEnabled ( ) ) { logger . debug ( "Voter: " + voter + ", returned: " + result ) ; } switch ( result ) { case AccessDecisionVoter . ACCESS_GRANTED : grant ++ ; break ; case AccessDecisionVoter . ACCESS_DENIED : throw new AccessDeniedException ( messages . getMessage ( "AbstractAccessDecisionManager.accessDenied" , "Access is denied" ) ) ; default : break ; } } } // To get this far , there were no deny votes
if ( grant > 0 ) { return ; } // To get this far , every AccessDecisionVoter abstained
checkAllowIfAllAbstainDecisions ( ) ;


signature:
public class PasswordEncoderFactories { /** * Creates a { @ link DelegatingPasswordEncoder } with default mappings . Additional
 * mappings may be added and the encoding will be updated to conform with best
 * practices . However , due to the nature of { @ link DelegatingPasswordEncoder } the
 * updates should not impact users . The mappings current are :
 * < ul >
 * < li > bcrypt - { @ link BCryptPasswordEncoder } ( Also used for encoding ) < / li >
 * < li > ldap - { @ link org . springframework . security . crypto . password . LdapShaPasswordEncoder } < / li >
 * < li > MD4 - { @ link org . springframework . security . crypto . password . Md4PasswordEncoder } < / li >
 * < li > MD5 - { @ code new MessageDigestPasswordEncoder ( " MD5 " ) } < / li >
 * < li > noop - { @ link org . springframework . security . crypto . password . NoOpPasswordEncoder } < / li >
 * < li > pbkdf2 - { @ link Pbkdf2PasswordEncoder } < / li >
 * < li > scrypt - { @ link SCryptPasswordEncoder } < / li >
 * < li > SHA - 1 - { @ code new MessageDigestPasswordEncoder ( " SHA - 1 " ) } < / li >
 * < li > SHA - 256 - { @ code new MessageDigestPasswordEncoder ( " SHA - 256 " ) } < / li >
 * < li > sha256 - { @ link org . springframework . security . crypto . password . StandardPasswordEncoder } < / li >
 * < / ul >
 * @ return the { @ link PasswordEncoder } to use */
@ SuppressWarnings ( "deprecation" ) public static PasswordEncoder createDelegatingPasswordEncoder ( ) { } }

implementation: String encodingId = "bcrypt" ; Map < String , PasswordEncoder > encoders = new HashMap < > ( ) ; encoders . put ( encodingId , new BCryptPasswordEncoder ( ) ) ; encoders . put ( "ldap" , new org . springframework . security . crypto . password . LdapShaPasswordEncoder ( ) ) ; encoders . put ( "MD4" , new org . springframework . security . crypto . password . Md4PasswordEncoder ( ) ) ; encoders . put ( "MD5" , new org . springframework . security . crypto . password . MessageDigestPasswordEncoder ( "MD5" ) ) ; encoders . put ( "noop" , org . springframework . security . crypto . password . NoOpPasswordEncoder . getInstance ( ) ) ; encoders . put ( "pbkdf2" , new Pbkdf2PasswordEncoder ( ) ) ; encoders . put ( "scrypt" , new SCryptPasswordEncoder ( ) ) ; encoders . put ( "SHA-1" , new org . springframework . security . crypto . password . MessageDigestPasswordEncoder ( "SHA-1" ) ) ; encoders . put ( "SHA-256" , new org . springframework . security . crypto . password . MessageDigestPasswordEncoder ( "SHA-256" ) ) ; encoders . put ( "sha256" , new org . springframework . security . crypto . password . StandardPasswordEncoder ( ) ) ; return new DelegatingPasswordEncoder ( encodingId , encoders ) ;


signature:
public class BearerTokenAccessDeniedHandler { /** * Collect error details from the provided parameters and format according to
 * RFC 6750 , specifically { @ code error } , { @ code error _ description } , { @ code error _ uri } , and { @ scope scope } .
 * @ param request that resulted in an < code > AccessDeniedException < / code >
 * @ param response so that the user agent can be advised of the failure
 * @ param accessDeniedException that caused the invocation */
@ Override public void handle ( HttpServletRequest request , HttpServletResponse response , AccessDeniedException accessDeniedException ) throws IOException , ServletException { } }

implementation: Map < String , String > parameters = new LinkedHashMap < > ( ) ; if ( this . realmName != null ) { parameters . put ( "realm" , this . realmName ) ; } if ( request . getUserPrincipal ( ) instanceof AbstractOAuth2TokenAuthenticationToken ) { AbstractOAuth2TokenAuthenticationToken token = ( AbstractOAuth2TokenAuthenticationToken ) request . getUserPrincipal ( ) ; String scope = getScope ( token ) ; parameters . put ( "error" , BearerTokenErrorCodes . INSUFFICIENT_SCOPE ) ; parameters . put ( "error_description" , String . format ( "The token provided has insufficient scope [%s] for this request" , scope ) ) ; parameters . put ( "error_uri" , "https://tools.ietf.org/html/rfc6750#section-3.1" ) ; if ( StringUtils . hasText ( scope ) ) { parameters . put ( "scope" , scope ) ; } } String wwwAuthenticate = computeWWWAuthenticateHeaderValue ( parameters ) ; response . addHeader ( HttpHeaders . WWW_AUTHENTICATE , wwwAuthenticate ) ; response . setStatus ( HttpStatus . FORBIDDEN . value ( ) ) ;


signature:
public class XFrameOptionsHeaderWriter { /** * Writes the X - Frame - Options header value , overwritting any previous value .
 * @ param request the servlet request
 * @ param response the servlet response */
public void writeHeaders ( HttpServletRequest request , HttpServletResponse response ) { } }

implementation: if ( XFrameOptionsMode . ALLOW_FROM . equals ( frameOptionsMode ) ) { String allowFromValue = this . allowFromStrategy . getAllowFromValue ( request ) ; if ( XFrameOptionsMode . DENY . getMode ( ) . equals ( allowFromValue ) ) { if ( ! response . containsHeader ( XFRAME_OPTIONS_HEADER ) ) { response . setHeader ( XFRAME_OPTIONS_HEADER , XFrameOptionsMode . DENY . getMode ( ) ) ; } } else if ( allowFromValue != null ) { if ( ! response . containsHeader ( XFRAME_OPTIONS_HEADER ) ) { response . setHeader ( XFRAME_OPTIONS_HEADER , XFrameOptionsMode . ALLOW_FROM . getMode ( ) + " " + allowFromValue ) ; } } } else { response . setHeader ( XFRAME_OPTIONS_HEADER , frameOptionsMode . getMode ( ) ) ; }


signature:
public class JaasApiIntegrationFilter { /** * Attempts to obtain and run as a JAAS < code > Subject < / code > using
 * { @ link # obtainSubject ( ServletRequest ) } .
 * If the < code > Subject < / code > is < code > null < / code > and < tt > createEmptySubject < / tt > is
 * < code > true < / code > , an empty , writeable < code > Subject < / code > is used . This allows
 * for the < code > Subject < / code > to be populated at the time of login . If the
 * < code > Subject < / code > is < code > null < / code > , the < code > FilterChain < / code > continues
 * with no additional processing . If the < code > Subject < / code > is not < code > null < / code >
 * , the < code > FilterChain < / code > is ran with
 * { @ link Subject # doAs ( Subject , PrivilegedExceptionAction ) } in conjunction with the
 * < code > Subject < / code > obtained . */
public final void doFilter ( final ServletRequest request , final ServletResponse response , final FilterChain chain ) throws ServletException , IOException { } }

implementation: Subject subject = obtainSubject ( request ) ; if ( subject == null && createEmptySubject ) { if ( logger . isDebugEnabled ( ) ) { logger . debug ( "Subject returned was null and createEmtpySubject is true; creating new empty subject to run as." ) ; } subject = new Subject ( ) ; } if ( subject == null ) { if ( logger . isDebugEnabled ( ) ) { logger . debug ( "Subject is null continue running with no Subject." ) ; } chain . doFilter ( request , response ) ; return ; } final PrivilegedExceptionAction < Object > continueChain = new PrivilegedExceptionAction < Object > ( ) { public Object run ( ) throws IOException , ServletException { chain . doFilter ( request , response ) ; return null ; } } ; if ( logger . isDebugEnabled ( ) ) { logger . debug ( "Running as Subject " + subject ) ; } try { Subject . doAs ( subject , continueChain ) ; } catch ( PrivilegedActionException e ) { throw new ServletException ( e . getMessage ( ) , e ) ; }


signature:
public class JaasApiIntegrationFilter { /** * Obtains the < code > Subject < / code > to run as or < code > null < / code > if no
 * < code > Subject < / code > is available .
 * The default implementation attempts to obtain the < code > Subject < / code > from the
 * < code > SecurityContext < / code > ' s < code > Authentication < / code > . If it is of type
 * < code > JaasAuthenticationToken < / code > and is authenticated , the < code > Subject < / code >
 * is returned from it . Otherwise , < code > null < / code > is returned .
 * @ param request the current < code > ServletRequest < / code >
 * @ return the Subject to run as or < code > null < / code > if no < code > Subject < / code > is
 * available . */
protected Subject obtainSubject ( ServletRequest request ) { } }

implementation: Authentication authentication = SecurityContextHolder . getContext ( ) . getAuthentication ( ) ; if ( logger . isDebugEnabled ( ) ) { logger . debug ( "Attempting to obtainSubject using authentication : " + authentication ) ; } if ( authentication == null ) { return null ; } if ( ! authentication . isAuthenticated ( ) ) { return null ; } if ( ! ( authentication instanceof JaasAuthenticationToken ) ) { return null ; } JaasAuthenticationToken token = ( JaasAuthenticationToken ) authentication ; LoginContext loginContext = token . getLoginContext ( ) ; if ( loginContext == null ) { return null ; } return loginContext . getSubject ( ) ;


signature:
public class CsrfConfigurer { /** * Specify the { @ link CsrfTokenRepository } to use . The default is an
 * { @ link HttpSessionCsrfTokenRepository } wrapped by { @ link LazyCsrfTokenRepository } .
 * @ param csrfTokenRepository the { @ link CsrfTokenRepository } to use
 * @ return the { @ link CsrfConfigurer } for further customizations */
public CsrfConfigurer < H > csrfTokenRepository ( CsrfTokenRepository csrfTokenRepository ) { } }

implementation: Assert . notNull ( csrfTokenRepository , "csrfTokenRepository cannot be null" ) ; this . csrfTokenRepository = csrfTokenRepository ; return this ;


signature:
public class CsrfConfigurer { /** * Specify the { @ link RequestMatcher } to use for determining when CSRF should be
 * applied . The default is to ignore GET , HEAD , TRACE , OPTIONS and process all other
 * requests .
 * @ param requireCsrfProtectionMatcher the { @ link RequestMatcher } to use
 * @ return the { @ link CsrfConfigurer } for further customizations */
public CsrfConfigurer < H > requireCsrfProtectionMatcher ( RequestMatcher requireCsrfProtectionMatcher ) { } }

implementation: Assert . notNull ( requireCsrfProtectionMatcher , "requireCsrfProtectionMatcher cannot be null" ) ; this . requireCsrfProtectionMatcher = requireCsrfProtectionMatcher ; return this ;