Skip to content

Commit bbe4f87

Browse files
jzheauxjzheaux
committed
Mark Serialization Support for Events
Issue gh-16276
1 parent 45da5c9 commit bbe4f87

File tree

46 files changed

+175
-10
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

46 files changed

+175
-10
lines changed

‎config/src/test/java/org/springframework/security/SpringSecurityCoreVersionSerializableTests.java

Lines changed: 61 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2024 the original author or authors.
2+
* Copyright 2002-2025 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -54,6 +54,7 @@
5454
import org.springframework.beans.factory.config.BeanDefinition;
5555
import org.springframework.context.annotation.ClassPathScanningCandidateComponentProvider;
5656
import org.springframework.core.type.filter.AssignableTypeFilter;
57+
import org.springframework.mock.web.MockHttpSession;
5758
import org.springframework.security.access.AccessDeniedException;
5859
import org.springframework.security.access.AuthorizationServiceException;
5960
import org.springframework.security.access.intercept.RunAsUserToken;
@@ -73,16 +74,33 @@
7374
import org.springframework.security.authentication.TestAuthentication;
7475
import org.springframework.security.authentication.TestingAuthenticationToken;
7576
import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
77+
import org.springframework.security.authentication.event.AuthenticationFailureBadCredentialsEvent;
78+
import org.springframework.security.authentication.event.AuthenticationFailureCredentialsExpiredEvent;
79+
import org.springframework.security.authentication.event.AuthenticationFailureDisabledEvent;
80+
import org.springframework.security.authentication.event.AuthenticationFailureExpiredEvent;
81+
import org.springframework.security.authentication.event.AuthenticationFailureLockedEvent;
82+
import org.springframework.security.authentication.event.AuthenticationFailureProviderNotFoundEvent;
83+
import org.springframework.security.authentication.event.AuthenticationFailureProxyUntrustedEvent;
84+
import org.springframework.security.authentication.event.AuthenticationFailureServiceExceptionEvent;
85+
import org.springframework.security.authentication.event.AuthenticationSuccessEvent;
86+
import org.springframework.security.authentication.event.InteractiveAuthenticationSuccessEvent;
87+
import org.springframework.security.authentication.event.LogoutSuccessEvent;
7688
import org.springframework.security.authentication.jaas.JaasAuthenticationToken;
89+
import org.springframework.security.authentication.jaas.event.JaasAuthenticationFailedEvent;
90+
import org.springframework.security.authentication.jaas.event.JaasAuthenticationSuccessEvent;
7791
import org.springframework.security.authentication.ott.InvalidOneTimeTokenException;
7892
import org.springframework.security.authentication.ott.OneTimeTokenAuthenticationToken;
7993
import org.springframework.security.authentication.password.CompromisedPasswordException;
8094
import org.springframework.security.cas.authentication.CasAssertionAuthenticationToken;
8195
import org.springframework.security.cas.authentication.CasAuthenticationToken;
8296
import org.springframework.security.cas.authentication.CasServiceTicketAuthenticationToken;
97+
import org.springframework.security.core.Authentication;
8398
import org.springframework.security.core.GrantedAuthority;
8499
import org.springframework.security.core.SpringSecurityCoreVersion;
85100
import org.springframework.security.core.authority.AuthorityUtils;
101+
import org.springframework.security.core.context.SecurityContext;
102+
import org.springframework.security.core.context.SecurityContextImpl;
103+
import org.springframework.security.core.session.AbstractSessionEvent;
86104
import org.springframework.security.core.session.ReactiveSessionInformation;
87105
import org.springframework.security.core.session.SessionInformation;
88106
import org.springframework.security.core.userdetails.UserDetails;
@@ -163,13 +181,16 @@
163181
import org.springframework.security.web.authentication.rememberme.InvalidCookieException;
164182
import org.springframework.security.web.authentication.rememberme.RememberMeAuthenticationException;
165183
import org.springframework.security.web.authentication.session.SessionAuthenticationException;
184+
import org.springframework.security.web.authentication.session.SessionFixationProtectionEvent;
185+
import org.springframework.security.web.authentication.switchuser.AuthenticationSwitchUserEvent;
166186
import org.springframework.security.web.authentication.www.NonceExpiredException;
167187
import org.springframework.security.web.csrf.CsrfException;
168188
import org.springframework.security.web.csrf.DefaultCsrfToken;
169189
import org.springframework.security.web.csrf.InvalidCsrfTokenException;
170190
import org.springframework.security.web.csrf.MissingCsrfTokenException;
171191
import org.springframework.security.web.firewall.RequestRejectedException;
172192
import org.springframework.security.web.server.firewall.ServerExchangeRejectedException;
193+
import org.springframework.security.web.session.HttpSessionCreatedEvent;
173194

174195
import static org.assertj.core.api.Assertions.assertThat;
175196
import static org.assertj.core.api.Assertions.fail;
@@ -200,6 +221,8 @@ class SpringSecurityCoreVersionSerializableTests {
200221

201222
static {
202223
UserDetails user = TestAuthentication.user();
224+
Authentication authentication = TestAuthentication.authenticated(user);
225+
SecurityContext securityContext = new SecurityContextImpl(authentication);
203226

204227
// oauth2-core
205228
generatorByClassName.put(DefaultOAuth2User.class, (r) -> TestOAuth2Users.create());
@@ -375,6 +398,37 @@ class SpringSecurityCoreVersionSerializableTests {
375398
(r) -> new UsernameNotFoundException("error", new RuntimeException()));
376399
generatorByClassName.put(TestingAuthenticationToken.class,
377400
(r) -> applyDetails(new TestingAuthenticationToken("username", "password")));
401+
generatorByClassName.put(AuthenticationFailureBadCredentialsEvent.class,
402+
(r) -> new AuthenticationFailureBadCredentialsEvent(authentication,
403+
new BadCredentialsException("message")));
404+
generatorByClassName.put(AuthenticationFailureCredentialsExpiredEvent.class,
405+
(r) -> new AuthenticationFailureCredentialsExpiredEvent(authentication,
406+
new CredentialsExpiredException("message")));
407+
generatorByClassName.put(AuthenticationFailureDisabledEvent.class,
408+
(r) -> new AuthenticationFailureDisabledEvent(authentication, new DisabledException("message")));
409+
generatorByClassName.put(AuthenticationFailureExpiredEvent.class,
410+
(r) -> new AuthenticationFailureExpiredEvent(authentication, new AccountExpiredException("message")));
411+
generatorByClassName.put(AuthenticationFailureLockedEvent.class,
412+
(r) -> new AuthenticationFailureLockedEvent(authentication, new LockedException("message")));
413+
generatorByClassName.put(AuthenticationFailureProviderNotFoundEvent.class,
414+
(r) -> new AuthenticationFailureProviderNotFoundEvent(authentication,
415+
new ProviderNotFoundException("message")));
416+
generatorByClassName.put(AuthenticationFailureProxyUntrustedEvent.class,
417+
(r) -> new AuthenticationFailureProxyUntrustedEvent(authentication,
418+
new AuthenticationServiceException("message")));
419+
generatorByClassName.put(AuthenticationFailureServiceExceptionEvent.class,
420+
(r) -> new AuthenticationFailureServiceExceptionEvent(authentication,
421+
new AuthenticationServiceException("message")));
422+
generatorByClassName.put(AuthenticationSuccessEvent.class,
423+
(r) -> new AuthenticationSuccessEvent(authentication));
424+
generatorByClassName.put(InteractiveAuthenticationSuccessEvent.class,
425+
(r) -> new InteractiveAuthenticationSuccessEvent(authentication, Authentication.class));
426+
generatorByClassName.put(LogoutSuccessEvent.class, (r) -> new LogoutSuccessEvent(authentication));
427+
generatorByClassName.put(JaasAuthenticationFailedEvent.class,
428+
(r) -> new JaasAuthenticationFailedEvent(authentication, new RuntimeException("message")));
429+
generatorByClassName.put(JaasAuthenticationSuccessEvent.class,
430+
(r) -> new JaasAuthenticationSuccessEvent(authentication));
431+
generatorByClassName.put(AbstractSessionEvent.class, (r) -> new AbstractSessionEvent(securityContext));
378432

379433
// cas
380434
generatorByClassName.put(CasServiceTicketAuthenticationToken.class, (r) -> {
@@ -448,6 +502,12 @@ class SpringSecurityCoreVersionSerializableTests {
448502
generatorByClassName.put(RequestRejectedException.class, (r) -> new RequestRejectedException("message"));
449503
generatorByClassName.put(ServerExchangeRejectedException.class,
450504
(r) -> new ServerExchangeRejectedException("message"));
505+
generatorByClassName.put(SessionFixationProtectionEvent.class,
506+
(r) -> new SessionFixationProtectionEvent(authentication, "old", "new"));
507+
generatorByClassName.put(AuthenticationSwitchUserEvent.class,
508+
(r) -> new AuthenticationSwitchUserEvent(authentication, user));
509+
generatorByClassName.put(HttpSessionCreatedEvent.class,
510+
(r) -> new HttpSessionCreatedEvent(new MockHttpSession()));
451511
}
452512

453513
@ParameterizedTest

‎config/src/test/resources/serialized/6.4.x/org.springframework.security.authentication.event.AuthenticationFailureBadCredentialsEvent.serialized

11 KB
Binary file not shown.

‎config/src/test/resources/serialized/6.4.x/org.springframework.security.authentication.event.AuthenticationFailureCredentialsExpiredEvent.serialized

11.1 KB
Binary file not shown.

‎config/src/test/resources/serialized/6.4.x/org.springframework.security.authentication.event.AuthenticationFailureDisabledEvent.serialized

11.1 KB
Binary file not shown.

‎config/src/test/resources/serialized/6.4.x/org.springframework.security.authentication.event.AuthenticationFailureExpiredEvent.serialized

11.1 KB
Binary file not shown.

‎config/src/test/resources/serialized/6.4.x/org.springframework.security.authentication.event.AuthenticationFailureLockedEvent.serialized

11.1 KB
Binary file not shown.

‎config/src/test/resources/serialized/6.4.x/org.springframework.security.authentication.event.AuthenticationFailureProviderNotFoundEvent.serialized

11 KB
Binary file not shown.

‎config/src/test/resources/serialized/6.4.x/org.springframework.security.authentication.event.AuthenticationFailureProxyUntrustedEvent.serialized

11 KB
Binary file not shown.

‎config/src/test/resources/serialized/6.4.x/org.springframework.security.authentication.event.AuthenticationFailureServiceExceptionEvent.serialized

11 KB
Binary file not shown.

‎config/src/test/resources/serialized/6.4.x/org.springframework.security.authentication.event.AuthenticationSuccessEvent.serialized

304 Bytes
Binary file not shown.

‎config/src/test/resources/serialized/6.4.x/org.springframework.security.authentication.event.InteractiveAuthenticationSuccessEvent.serialized

414 Bytes
Binary file not shown.

‎config/src/test/resources/serialized/6.4.x/org.springframework.security.authentication.event.LogoutSuccessEvent.serialized

296 Bytes
Binary file not shown.

‎config/src/test/resources/serialized/6.4.x/org.springframework.security.authentication.jaas.event.JaasAuthenticationFailedEvent.serialized

10.7 KB
Binary file not shown.

‎config/src/test/resources/serialized/6.4.x/org.springframework.security.authentication.jaas.event.JaasAuthenticationSuccessEvent.serialized

314 Bytes
Binary file not shown.

‎config/src/test/resources/serialized/6.4.x/org.springframework.security.core.session.AbstractSessionEvent.serialized

198 Bytes
Binary file not shown.

‎config/src/test/resources/serialized/6.4.x/org.springframework.security.web.authentication.session.SessionFixationProtectionEvent.serialized

382 Bytes
Binary file not shown.

‎config/src/test/resources/serialized/6.4.x/org.springframework.security.web.authentication.switchuser.AuthenticationSwitchUserEvent.serialized

1016 Bytes
Binary file not shown.

‎config/src/test/resources/serialized/6.4.x/org.springframework.security.web.session.HttpSessionCreatedEvent.serialized

354 Bytes
Binary file not shown.

‎core/src/main/java/org/springframework/security/access/event/AuthenticationCredentialsNotFoundEvent.java

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,7 @@
3232
* instead.
3333
*/
3434
@Deprecated
35+
@SuppressWarnings("serial")
3536
public class AuthenticationCredentialsNotFoundEvent extends AbstractAuthorizationEvent {
3637

3738
private final AuthenticationCredentialsNotFoundException credentialsNotFoundException;

‎core/src/main/java/org/springframework/security/access/event/AuthorizationFailureEvent.java

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,7 @@
3939
* instead
4040
*/
4141
@Deprecated
42+
@SuppressWarnings("serial")
4243
public class AuthorizationFailureEvent extends AbstractAuthorizationEvent {
4344

4445
private final AccessDeniedException accessDeniedException;

‎core/src/main/java/org/springframework/security/access/event/AuthorizedEvent.java

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,7 @@
3434
* instead
3535
*/
3636
@Deprecated
37+
@SuppressWarnings("serial")
3738
public class AuthorizedEvent extends AbstractAuthorizationEvent {
3839

3940
private final Authentication authentication;

‎core/src/main/java/org/springframework/security/access/event/PublicInvocationEvent.java

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,7 @@
3434
* {@link AuthorizationGrantedEvent#getSource()} to deduce public invocations.
3535
*/
3636
@Deprecated
37+
@SuppressWarnings("serial")
3738
public class PublicInvocationEvent extends AbstractAuthorizationEvent {
3839

3940
/**

‎core/src/main/java/org/springframework/security/authentication/event/AuthenticationFailureBadCredentialsEvent.java

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,8 @@
1616

1717
package org.springframework.security.authentication.event;
1818

19+
import java.io.Serial;
20+
1921
import org.springframework.security.core.Authentication;
2022
import org.springframework.security.core.AuthenticationException;
2123

@@ -27,6 +29,9 @@
2729
*/
2830
public class AuthenticationFailureBadCredentialsEvent extends AbstractAuthenticationFailureEvent {
2931

32+
@Serial
33+
private static final long serialVersionUID = -5245144711561130379L;
34+
3035
public AuthenticationFailureBadCredentialsEvent(Authentication authentication, AuthenticationException exception) {
3136
super(authentication, exception);
3237
}

‎core/src/main/java/org/springframework/security/authentication/event/AuthenticationFailureCredentialsExpiredEvent.java

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,8 @@
1616

1717
package org.springframework.security.authentication.event;
1818

19+
import java.io.Serial;
20+
1921
import org.springframework.security.core.Authentication;
2022
import org.springframework.security.core.AuthenticationException;
2123

@@ -27,6 +29,9 @@
2729
*/
2830
public class AuthenticationFailureCredentialsExpiredEvent extends AbstractAuthenticationFailureEvent {
2931

32+
@Serial
33+
private static final long serialVersionUID = -7595086332769705203L;
34+
3035
public AuthenticationFailureCredentialsExpiredEvent(Authentication authentication,
3136
AuthenticationException exception) {
3237
super(authentication, exception);

‎core/src/main/java/org/springframework/security/authentication/event/AuthenticationFailureDisabledEvent.java

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,8 @@
1616

1717
package org.springframework.security.authentication.event;
1818

19+
import java.io.Serial;
20+
1921
import org.springframework.security.core.Authentication;
2022
import org.springframework.security.core.AuthenticationException;
2123

@@ -27,6 +29,9 @@
2729
*/
2830
public class AuthenticationFailureDisabledEvent extends AbstractAuthenticationFailureEvent {
2931

32+
@Serial
33+
private static final long serialVersionUID = 8037552364666766279L;
34+
3035
public AuthenticationFailureDisabledEvent(Authentication authentication, AuthenticationException exception) {
3136
super(authentication, exception);
3237
}

‎core/src/main/java/org/springframework/security/authentication/event/AuthenticationFailureExpiredEvent.java

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,8 @@
1616

1717
package org.springframework.security.authentication.event;
1818

19+
import java.io.Serial;
20+
1921
import org.springframework.security.core.Authentication;
2022
import org.springframework.security.core.AuthenticationException;
2123

@@ -27,6 +29,9 @@
2729
*/
2830
public class AuthenticationFailureExpiredEvent extends AbstractAuthenticationFailureEvent {
2931

32+
@Serial
33+
private static final long serialVersionUID = -8437264795214121718L;
34+
3035
public AuthenticationFailureExpiredEvent(Authentication authentication, AuthenticationException exception) {
3136
super(authentication, exception);
3237
}

‎core/src/main/java/org/springframework/security/authentication/event/AuthenticationFailureLockedEvent.java

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,8 @@
1616

1717
package org.springframework.security.authentication.event;
1818

19+
import java.io.Serial;
20+
1921
import org.springframework.security.core.Authentication;
2022
import org.springframework.security.core.AuthenticationException;
2123

@@ -27,6 +29,9 @@
2729
*/
2830
public class AuthenticationFailureLockedEvent extends AbstractAuthenticationFailureEvent {
2931

32+
@Serial
33+
private static final long serialVersionUID = -5126110096093568463L;
34+
3035
public AuthenticationFailureLockedEvent(Authentication authentication, AuthenticationException exception) {
3136
super(authentication, exception);
3237
}

‎core/src/main/java/org/springframework/security/authentication/event/AuthenticationFailureProviderNotFoundEvent.java

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,8 @@
1616

1717
package org.springframework.security.authentication.event;
1818

19+
import java.io.Serial;
20+
1921
import org.springframework.security.core.Authentication;
2022
import org.springframework.security.core.AuthenticationException;
2123

@@ -27,6 +29,9 @@
2729
*/
2830
public class AuthenticationFailureProviderNotFoundEvent extends AbstractAuthenticationFailureEvent {
2931

32+
@Serial
33+
private static final long serialVersionUID = 9122219669183263487L;
34+
3035
public AuthenticationFailureProviderNotFoundEvent(Authentication authentication,
3136
AuthenticationException exception) {
3237
super(authentication, exception);

‎core/src/main/java/org/springframework/security/authentication/event/AuthenticationFailureProxyUntrustedEvent.java

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,8 @@
1616

1717
package org.springframework.security.authentication.event;
1818

19+
import java.io.Serial;
20+
1921
import org.springframework.security.core.Authentication;
2022
import org.springframework.security.core.AuthenticationException;
2123

@@ -27,6 +29,9 @@
2729
*/
2830
public class AuthenticationFailureProxyUntrustedEvent extends AbstractAuthenticationFailureEvent {
2931

32+
@Serial
33+
private static final long serialVersionUID = 1801476426012753252L;
34+
3035
public AuthenticationFailureProxyUntrustedEvent(Authentication authentication, AuthenticationException exception) {
3136
super(authentication, exception);
3237
}

‎core/src/main/java/org/springframework/security/authentication/event/AuthenticationFailureServiceExceptionEvent.java

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,8 @@
1616

1717
package org.springframework.security.authentication.event;
1818

19+
import java.io.Serial;
20+
1921
import org.springframework.security.core.Authentication;
2022
import org.springframework.security.core.AuthenticationException;
2123

@@ -27,6 +29,9 @@
2729
*/
2830
public class AuthenticationFailureServiceExceptionEvent extends AbstractAuthenticationFailureEvent {
2931

32+
@Serial
33+
private static final long serialVersionUID = 5580062757249390756L;
34+
3035
public AuthenticationFailureServiceExceptionEvent(Authentication authentication,
3136
AuthenticationException exception) {
3237
super(authentication, exception);

‎core/src/main/java/org/springframework/security/authentication/event/AuthenticationSuccessEvent.java

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,8 @@
1616

1717
package org.springframework.security.authentication.event;
1818

19+
import java.io.Serial;
20+
1921
import org.springframework.security.core.Authentication;
2022

2123
/**
@@ -25,6 +27,9 @@
2527
*/
2628
public class AuthenticationSuccessEvent extends AbstractAuthenticationEvent {
2729

30+
@Serial
31+
private static final long serialVersionUID = 2537206344128673963L;
32+
2833
public AuthenticationSuccessEvent(Authentication authentication) {
2934
super(authentication);
3035
}

‎core/src/main/java/org/springframework/security/authentication/event/InteractiveAuthenticationSuccessEvent.java

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,8 @@
1616

1717
package org.springframework.security.authentication.event;
1818

19+
import java.io.Serial;
20+
1921
import org.springframework.security.core.Authentication;
2022
import org.springframework.util.Assert;
2123

@@ -34,6 +36,9 @@
3436
*/
3537
public class InteractiveAuthenticationSuccessEvent extends AbstractAuthenticationEvent {
3638

39+
@Serial
40+
private static final long serialVersionUID = -1990271553478571709L;
41+
3742
private final Class<?> generatedBy;
3843

3944
public InteractiveAuthenticationSuccessEvent(Authentication authentication, Class<?> generatedBy) {

‎core/src/main/java/org/springframework/security/authentication/event/LogoutSuccessEvent.java

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2002-2019 the original author or authors.
2+
* Copyright 2002-2025 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -16,6 +16,8 @@
1616

1717
package org.springframework.security.authentication.event;
1818

19+
import java.io.Serial;
20+
1921
import org.springframework.security.core.Authentication;
2022

2123
/**
@@ -26,6 +28,9 @@
2628
*/
2729
public class LogoutSuccessEvent extends AbstractAuthenticationEvent {
2830

31+
@Serial
32+
private static final long serialVersionUID = 5112491795571632311L;
33+
2934
public LogoutSuccessEvent(Authentication authentication) {
3035
super(authentication);
3136
}

‎core/src/main/java/org/springframework/security/authentication/jaas/event/JaasAuthenticationFailedEvent.java

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,8 @@
1616

1717
package org.springframework.security.authentication.jaas.event;
1818

19+
import java.io.Serial;
20+
1921
import org.springframework.security.core.Authentication;
2022

2123
/**
@@ -26,6 +28,9 @@
2628
*/
2729
public class JaasAuthenticationFailedEvent extends JaasAuthenticationEvent {
2830

31+
@Serial
32+
private static final long serialVersionUID = -240510538971925002L;
33+
2934
private final Exception exception;
3035

3136
public JaasAuthenticationFailedEvent(Authentication auth, Exception exception) {

0 commit comments

Comments
 (0)