Spring Security upgrade : We have upgraded Spring Security to version 5.8.7 to resolve vulnerabilities and prepare for the upgrade to Spring Security 6.0 (via Spring Boot 3).
Java 17 : Java 17 is now required to run Atoti CVA Risk Capital.
Swagger UI : Swagger UI is available at {base.url}/swagger-ui/index.html. This will display some REST endpoints exposed by Atoti CVA Risk Capital. It can be enabled/disabled by setting property swagger.enable to true/false.
Common Parent POM: The Atoti CVA Risk Capital module now inherits third-party plugin versions from the Common Parent POM version 1.2.0, in line with other solutions.
Incremental Measures: Incremental measures have been added to Atoti CVA Risk Capital.
We have upgraded to Spring Security 5.8.7. To do so, we override the version of Spring Security in Spring Boot by importing the common-dependencies-bom version
1.2.0 into the parent pom file. The common-dependencies-bom overrides the Spring Security version using Spring’s migration guide.You will eventually need to migrate your own custom security configuration(s) in preparation for
Spring Security 6.0. We have upgraded our out-of-the-box security configurations to help in this migration.
We recommend using your own custom security configuration(s) and referring to the out-of-the-box security configuration
provided only as a sample.
The default security users and roles have not changed, only the way we implement the security. We have done so by making the following changes:
In Authorize Http Requests, we have replaced invocations of http.authorizeHttpRequests((authz) -> authz.antMatchers(...)) with http.authorizeHttpRequests((authz) -> authz.requestMatchers(...)).
We have replaced invocations of http.antMatchers(...) with http.securityMatchers(...).As an example of the previous changes, the configuration for accessing the endpoint which exposes the JWT token changed from:
public static abstract class AJwtSecurityConfigurer extends WebSecurityConfigurerAdapter { @Autowired protected ApplicationContext context; @Autowired @Qualifier(BASIC_AUTH_BEAN_NAME) protected AuthenticationEntryPoint authenticationEntryPoint; @Override protected void configure(HttpSecurity http) throws Exception { http .antMatcher(JwtRestServiceConfig.REST_API_URL_PREFIX + "/**") // As of Spring Security 4.0, CSRF protection is enabled by default. .csrf().disable() // Configure CORS .cors().and() .authorizeRequests() .antMatchers("/**").hasAnyAuthority(APP_ROLE__USER) .and() .httpBasic().authenticationEntryPoint(authenticationEntryPoint); }}
Removed imports of ActivePivotRemotingServicesConfig
This class imports org.springframework.remoting.httpinvoker.HttpInvokerServiceExporter, which may (if used) expose access to CVE-2016-1000027 in the Spring-web project.
The Common Parent POM version 1.2.0 is now a parent of Atoti CVA Risk Capital. This parent merely defines plugin management and is used by other solutions.
The following dependency versions are now managed by this parent instead of by Atoti CVA Risk Capital:
