From ac61a9e67f43dd389f1c6a018311836d51d2b66a Mon Sep 17 00:00:00 2001 From: Henrik Niklaus Date: Tue, 5 May 2026 17:02:18 +0200 Subject: [PATCH 1/3] Upgrade to Spring 7 --- pom.xml | 6 +++--- .../web/OIDCInitiatingLoginRequestResolver.java | 2 +- .../PathOIDCInitiationRegistrationResolver.java | 17 +++++++++-------- .../ox/ctl/lti13/config/Lti13Configuration.java | 5 +++-- .../ox/ctl/lti13/stateful/Lti13Step3Test.java | 5 +++-- .../ox/ctl/lti13/stateless/Lti13Step3Test.java | 5 +++-- 6 files changed, 22 insertions(+), 18 deletions(-) diff --git a/pom.xml b/pom.xml index c8b5ea2..35aca21 100644 --- a/pom.xml +++ b/pom.xml @@ -9,9 +9,9 @@ 17 17 UTF-8 - 6.3.2 + 7.0.5 - 6.1.12 + 7.0.7 Spring Security LTI 1.3 @@ -128,7 +128,7 @@ org.junit.jupiter junit-jupiter-engine - 5.9.2 + 6.0.3 test diff --git a/src/main/java/uk/ac/ox/ctl/lti13/security/oauth2/client/lti/web/OIDCInitiatingLoginRequestResolver.java b/src/main/java/uk/ac/ox/ctl/lti13/security/oauth2/client/lti/web/OIDCInitiatingLoginRequestResolver.java index 29fe1f5..d2076cd 100644 --- a/src/main/java/uk/ac/ox/ctl/lti13/security/oauth2/client/lti/web/OIDCInitiatingLoginRequestResolver.java +++ b/src/main/java/uk/ac/ox/ctl/lti13/security/oauth2/client/lti/web/OIDCInitiatingLoginRequestResolver.java @@ -170,7 +170,7 @@ private String expandRedirectUri(HttpServletRequest request, ClientRegistration // Used in -> CommonOAuth2Provider.DEFAULT_REDIRECT_URL = "{baseUrl}/{action}/oauth2/code/{registrationId}" Map uriVariables = new HashMap<>(); uriVariables.put("registrationId", clientRegistration.getRegistrationId()); - String baseUrl = UriComponentsBuilder.fromHttpUrl(UrlUtils.buildFullRequestUrl(request)) + String baseUrl = UriComponentsBuilder.fromUriString(UrlUtils.buildFullRequestUrl(request)) .replaceQuery(null) .replacePath(request.getContextPath()) .build() diff --git a/src/main/java/uk/ac/ox/ctl/lti13/security/oauth2/client/lti/web/PathOIDCInitiationRegistrationResolver.java b/src/main/java/uk/ac/ox/ctl/lti13/security/oauth2/client/lti/web/PathOIDCInitiationRegistrationResolver.java index d4af51b..84531e4 100644 --- a/src/main/java/uk/ac/ox/ctl/lti13/security/oauth2/client/lti/web/PathOIDCInitiationRegistrationResolver.java +++ b/src/main/java/uk/ac/ox/ctl/lti13/security/oauth2/client/lti/web/PathOIDCInitiationRegistrationResolver.java @@ -1,27 +1,28 @@ package uk.ac.ox.ctl.lti13.security.oauth2.client.lti.web; import jakarta.servlet.http.HttpServletRequest; -import org.springframework.security.web.util.matcher.AntPathRequestMatcher; +import org.springframework.security.web.servlet.util.matcher.PathPatternRequestMatcher; +import org.springframework.security.web.util.matcher.RequestMatcher; import org.springframework.util.Assert; public class PathOIDCInitiationRegistrationResolver implements OIDCInitiationRegistrationResolver { - + private static final String REGISTRATION_ID_URI_VARIABLE_NAME = "registrationId"; - private final AntPathRequestMatcher authorizationRequestMatcher; + private final PathPatternRequestMatcher authorizationRequestMatcher; public PathOIDCInitiationRegistrationResolver(String authorizationRequestBaseUri) { Assert.hasText(authorizationRequestBaseUri, "authorizationRequestBaseUri cannot be empty"); - this.authorizationRequestMatcher = new AntPathRequestMatcher( - authorizationRequestBaseUri + "/{" + REGISTRATION_ID_URI_VARIABLE_NAME + "}"); + this.authorizationRequestMatcher = PathPatternRequestMatcher.withDefaults() + .matcher(authorizationRequestBaseUri + "/{" + REGISTRATION_ID_URI_VARIABLE_NAME + "}"); } @Override public String resolve(HttpServletRequest request) { - if (this.authorizationRequestMatcher.matches(request)) { - return this.authorizationRequestMatcher - .extractUriTemplateVariables(request).get(REGISTRATION_ID_URI_VARIABLE_NAME); + RequestMatcher.MatchResult matchResult = this.authorizationRequestMatcher.matcher(request); + if (matchResult.isMatch()) { + return matchResult.getVariables().get(REGISTRATION_ID_URI_VARIABLE_NAME); } return null; } diff --git a/src/test/java/uk/ac/ox/ctl/lti13/config/Lti13Configuration.java b/src/test/java/uk/ac/ox/ctl/lti13/config/Lti13Configuration.java index d04302a..fe7ed67 100644 --- a/src/test/java/uk/ac/ox/ctl/lti13/config/Lti13Configuration.java +++ b/src/test/java/uk/ac/ox/ctl/lti13/config/Lti13Configuration.java @@ -3,6 +3,7 @@ import org.mockito.Mockito; import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Configuration; +import org.springframework.security.config.Customizer; import org.springframework.security.config.annotation.web.builders.HttpSecurity; import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity; import org.springframework.security.oauth2.client.registration.ClientRegistration; @@ -25,9 +26,9 @@ public class Lti13Configuration { @Bean protected SecurityFilterChain configure(HttpSecurity http) throws Exception { - http.authorizeHttpRequests().anyRequest().authenticated(); + http.authorizeHttpRequests(auth -> auth.anyRequest().authenticated()); Lti13Configurer lti13Configurer = new Lti13Configurer(); - http.apply(lti13Configurer); + http.with(lti13Configurer, Customizer.withDefaults()); return http.build(); } diff --git a/src/test/java/uk/ac/ox/ctl/lti13/stateful/Lti13Step3Test.java b/src/test/java/uk/ac/ox/ctl/lti13/stateful/Lti13Step3Test.java index b8af27e..7296e7e 100644 --- a/src/test/java/uk/ac/ox/ctl/lti13/stateful/Lti13Step3Test.java +++ b/src/test/java/uk/ac/ox/ctl/lti13/stateful/Lti13Step3Test.java @@ -22,6 +22,7 @@ import org.springframework.context.annotation.Configuration; import org.springframework.http.HttpStatus; import org.springframework.http.ResponseEntity; +import org.springframework.security.config.Customizer; import org.springframework.security.config.annotation.web.builders.HttpSecurity; import org.springframework.security.oauth2.client.registration.ClientRegistrationRepository; import org.springframework.security.oauth2.client.web.AuthorizationRequestRepository; @@ -109,7 +110,7 @@ OptimisticAuthorizationRequestRepository optmisticAuthorizationRequestRepository @Bean protected SecurityFilterChain configure(HttpSecurity http) throws Exception { - http.authorizeHttpRequests().anyRequest().authenticated(); + http.authorizeHttpRequests(auth -> auth.anyRequest().authenticated()); Lti13Configurer lti13Configurer = new Lti13Configurer() { @Override @@ -132,7 +133,7 @@ protected OAuth2LoginAuthenticationFilter configureLoginFilter(ClientRegistratio return oAuth2LoginAuthenticationFilter; } }; - http.apply(lti13Configurer); + http.with(lti13Configurer, Customizer.withDefaults()); return http.build(); } } diff --git a/src/test/java/uk/ac/ox/ctl/lti13/stateless/Lti13Step3Test.java b/src/test/java/uk/ac/ox/ctl/lti13/stateless/Lti13Step3Test.java index 6972a2e..17b6bc5 100644 --- a/src/test/java/uk/ac/ox/ctl/lti13/stateless/Lti13Step3Test.java +++ b/src/test/java/uk/ac/ox/ctl/lti13/stateless/Lti13Step3Test.java @@ -20,6 +20,7 @@ import org.springframework.context.annotation.Configuration; import org.springframework.http.HttpStatus; import org.springframework.http.ResponseEntity; +import org.springframework.security.config.Customizer; import org.springframework.security.config.annotation.web.builders.HttpSecurity; import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity; import org.springframework.security.oauth2.client.registration.ClientRegistrationRepository; @@ -92,7 +93,7 @@ OptimisticAuthorizationRequestRepository authorizationRequestRepository() { @Bean protected SecurityFilterChain configure(HttpSecurity http) throws Exception { - http.authorizeHttpRequests().anyRequest().authenticated(); + http.authorizeHttpRequests(auth -> auth.anyRequest().authenticated()); Lti13Configurer lti13Configurer = new Lti13Configurer() { @Override @@ -115,7 +116,7 @@ protected OAuth2LoginAuthenticationFilter configureLoginFilter(ClientRegistratio return oAuth2LoginAuthenticationFilter; } }; - http.apply(lti13Configurer); + http.with(lti13Configurer, Customizer.withDefaults()); return http.build(); } } From a007df0eb90ca6d479056a2de9ebf77f31d00223 Mon Sep 17 00:00:00 2001 From: Henrik Niklaus Date: Tue, 25 Aug 2026 12:09:04 +0200 Subject: [PATCH 2/3] Align dependencies with the Jakarta EE 11 / Jackson 3 level Spring Framework 7 moved to the Jakarta EE 11 API level and deprecated Jackson 2.x support. --- pom.xml | 12 +++++++----- .../lti/web/StateAuthorizationRedirectHandler.java | 6 +++--- 2 files changed, 10 insertions(+), 8 deletions(-) diff --git a/pom.xml b/pom.xml index 35aca21..15947d3 100644 --- a/pom.xml +++ b/pom.xml @@ -100,9 +100,9 @@ spring-security-oauth2-jose - com.fasterxml.jackson.core + tools.jackson.core jackson-databind - 2.17.0 + 3.2.2 compile @@ -111,9 +111,11 @@ 2.1.0 - jakarta.platform - jakarta.jakartaee-api - 10.0.0 + + jakarta.servlet + jakarta.servlet-api + 6.1.0 + provided org.slf4j diff --git a/src/main/java/uk/ac/ox/ctl/lti13/security/oauth2/client/lti/web/StateAuthorizationRedirectHandler.java b/src/main/java/uk/ac/ox/ctl/lti13/security/oauth2/client/lti/web/StateAuthorizationRedirectHandler.java index bbe91e9..f886e2a 100644 --- a/src/main/java/uk/ac/ox/ctl/lti13/security/oauth2/client/lti/web/StateAuthorizationRedirectHandler.java +++ b/src/main/java/uk/ac/ox/ctl/lti13/security/oauth2/client/lti/web/StateAuthorizationRedirectHandler.java @@ -1,9 +1,9 @@ package uk.ac.ox.ctl.lti13.security.oauth2.client.lti.web; -import com.fasterxml.jackson.core.io.JsonStringEncoder; import org.slf4j.Logger; import org.slf4j.LoggerFactory; import org.springframework.security.oauth2.core.endpoint.OAuth2AuthorizationRequest; +import tools.jackson.core.io.JsonStringEncoder; import uk.ac.ox.ctl.lti13.utils.StringReader; import jakarta.servlet.http.HttpServletRequest; @@ -45,9 +45,9 @@ public void sendRedirect(HttpServletRequest request, HttpServletResponse respons logger.debug("Response has already been committed. Unable to redirect to {}", url); return; } - String state = new String(encoder.quoteAsString(authorizationRequest.getState())); + String state = new String(encoder.quoteAsCharArray(authorizationRequest.getState())); // TODO We should be using a LTI Specific Auth request here. - String nonce = new String(encoder.quoteAsString((String)authorizationRequest.getAdditionalParameters().get("nonce"))); + String nonce = new String(encoder.quoteAsCharArray((String)authorizationRequest.getAdditionalParameters().get("nonce"))); response.setContentType("text/html;charset=UTF-8"); PrintWriter writer = response.getWriter(); final String body = htmlTemplate From 9160d49fb57b7441f74e26c3c66c2224e6df3ec3 Mon Sep 17 00:00:00 2001 From: Henrik Niklaus Date: Tue, 25 Aug 2026 12:31:38 +0200 Subject: [PATCH 3/3] Upgrade to Spring Framework 7.0.9 / Spring Security 7.0.7 --- pom.xml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pom.xml b/pom.xml index 15947d3..717ca29 100644 --- a/pom.xml +++ b/pom.xml @@ -9,9 +9,9 @@ 17 17 UTF-8 - 7.0.5 + 7.0.7 - 7.0.7 + 7.0.9 Spring Security LTI 1.3