[java-identity-provider] branch master updated: IDP-1382 - Whitelist approach to web resource security constraint

[Scott Cantor]

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch master
in repository java-identity-provider.

View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=d010188961860a9210cb34da26f3b8a4b64dcd5d

The following commit(s) were added to refs/heads/master by this push:
       new  d01018896 IDP-1382 - Whitelist approach to web resource security constraint
d01018896 is described below

commit d010188961860a9210cb34da26f3b8a4b64dcd5d
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Mon May 4 13:43:11 2020 -0400

    IDP-1382 - Whitelist approach to web resource security constraint
    
    https://issues.shibboleth.net/jira/browse/IDP-1382
    
    Take 2.
---
 idp-war/src/main/webapp/WEB-INF/web.xml | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/idp-war/src/main/webapp/WEB-INF/web.xml b/idp-war/src/main/webapp/WEB-INF/web.xml
index 57df17db1..a073b487a 100644
--- a/idp-war/src/main/webapp/WEB-INF/web.xml
+++ b/idp-war/src/main/webapp/WEB-INF/web.xml
@@ -186,7 +186,7 @@
         <tracking-mode>COOKIE</tracking-mode>
     </session-config>
 
-    <!-- Allow intended methods by using an empty auth-constraint. -->
+    <!-- Allow intended methods by using an absent auth-constraint. -->
     <security-constraint>
         <web-resource-collection>
             <web-resource-name>Non-API Content</web-resource-name>
@@ -199,6 +199,19 @@
         <!-- no auth-constraint tag here -->
     </security-constraint>
 
+    <!-- Disallow other methods by using an empty auth-constraint. -->
+    <security-constraint>
+        <web-resource-collection>
+            <web-resource-name>Non-API Content</web-resource-name>
+            <url-pattern>/*</url-pattern>
+            <http-method-omission>GET</http-method-omission>
+            <http-method-omission>HEAD</http-method-omission>
+            <http-method-omission>OPTIONS</http-method-omission>
+            <http-method-omission>POST</http-method-omission>
+        </web-resource-collection>
+        <authn-constraint/>
+    </security-constraint>
+
     <!-- Allow any HTTP methods to the API flows. -->
     <security-constraint>
         <web-resource-collection>

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.