You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@shiro.apache.org by "Emond Papegaaij (Jira)" <ji...@apache.org> on 2020/02/04 16:41:00 UTC
[jira] [Updated] (SHIRO-741) Matching of / (root) is broken
[ https://issues.apache.org/jira/browse/SHIRO-741?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Emond Papegaaij updated SHIRO-741:
----------------------------------
Description:
Since SHIRO-682 it is no longer possible match the root of your application with {{ /** }}. A request at {{/}} is transformed into an empty URI and no longer matches {{/**}}. This makes it impossible to secure your entire application and provide a whitelist for allowed urls, like this:
{code}
[urls]
/rest/v1/openapi.* = noSessionCreation,anon
/rest/v1/info = noSessionCreation,anon
/** = noSessionCreation,oauth2,oauth,secured
{code}
So far, I've found no way to match the root in 1.5.
was:
Since SHIRO-682 it is no longer possible match the root of your application with {{/**}}. A request at {{/}} is transformed into an empty URI and no longer matches {{/**}}. This makes it impossible to secure your entire application and provide a whitelist for allowed urls, like this:
{code}
[urls]
/rest/v1/openapi.* = noSessionCreation,anon
/rest/v1/info = noSessionCreation,anon
/** = noSessionCreation,oauth2,oauth,secured
{code}
So far, I've found no way to match the root in 1.5.
> Matching of / (root) is broken
> ------------------------------
>
> Key: SHIRO-741
> URL: https://issues.apache.org/jira/browse/SHIRO-741
> Project: Shiro
> Issue Type: Bug
> Components: Web
> Affects Versions: 1.5.0
> Reporter: Emond Papegaaij
> Priority: Major
>
> Since SHIRO-682 it is no longer possible match the root of your application with {{ /** }}. A request at {{/}} is transformed into an empty URI and no longer matches {{/**}}. This makes it impossible to secure your entire application and provide a whitelist for allowed urls, like this:
> {code}
> [urls]
> /rest/v1/openapi.* = noSessionCreation,anon
> /rest/v1/info = noSessionCreation,anon
> /** = noSessionCreation,oauth2,oauth,secured
> {code}
> So far, I've found no way to match the root in 1.5.
--
This message was sent by Atlassian Jira
(v8.3.4#803005)