[java-identity-provider] branch master updated: IDP-1382 - Whitelist approach to web resource security contstraint

[Scott Cantor]

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch master
in repository java-identity-provider.

View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=f7b95b96ac2198587eb171be1bccdd8ddc39e5ac

The following commit(s) were added to refs/heads/master by this push:
       new  f7b95b9   IDP-1382 - Whitelist approach to web resource security contstraint
f7b95b9 is described below

commit f7b95b96ac2198587eb171be1bccdd8ddc39e5ac
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Tue Apr 21 09:18:29 2020 -0400

    IDP-1382 - Whitelist approach to web resource security contstraint
    
    https://issues.shibboleth.net/jira/browse/IDP-1382
---
 idp-war/src/main/webapp/WEB-INF/web.xml | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/idp-war/src/main/webapp/WEB-INF/web.xml b/idp-war/src/main/webapp/WEB-INF/web.xml
index 160f600..57df17d 100644
--- a/idp-war/src/main/webapp/WEB-INF/web.xml
+++ b/idp-war/src/main/webapp/WEB-INF/web.xml
@@ -186,17 +186,17 @@
         <tracking-mode>COOKIE</tracking-mode>
     </session-config>
 
-    <!-- Block commonly flagged methods by using an empty auth-constraint. -->
+    <!-- Allow intended methods by using an empty auth-constraint. -->
     <security-constraint>
         <web-resource-collection>
             <web-resource-name>Non-API Content</web-resource-name>
             <url-pattern>/*</url-pattern>
-            <http-method>PUT</http-method>
-            <http-method>PATCH</http-method>
-            <http-method>DELETE</http-method>
-            <http-method>TRACE</http-method>
+            <http-method>GET</http-method>
+            <http-method>HEAD</http-method>
+            <http-method>OPTIONS</http-method>
+            <http-method>POST</http-method>
         </web-resource-collection>
-        <auth-constraint/>
+        <!-- no auth-constraint tag here -->
     </security-constraint>
 
     <!-- Allow any HTTP methods to the API flows. -->

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.