SHIBUI-2394

Fixes for websecurity not liking semicolons
TIER · Nov 9, 2022 · 1564e59 · 1564e59
1 parent a113ab6
commit 1564e59
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 0 deletions.
diff --git a/...ain/java/edu/internet2/tier/shibboleth/admin/ui/configuration/auto/WebSecurityConfig.java b/...ain/java/edu/internet2/tier/shibboleth/admin/ui/configuration/auto/WebSecurityConfig.java
@@ -67,6 +67,7 @@ private HttpFirewall allowUrlEncodedSlashHttpFirewall() {
         StrictHttpFirewall firewall = new StrictHttpFirewall();
         firewall.setAllowUrlEncodedSlash(true);
         firewall.setAllowUrlEncodedDoubleSlash(true);
+        firewall.setAllowSemicolon(true);
         return firewall;
     }
 

diff --git a/pac4j-module/src/main/java/net/unicon/shibui/pac4j/WebSecurity.java b/pac4j-module/src/main/java/net/unicon/shibui/pac4j/WebSecurity.java
@@ -116,6 +116,7 @@ public void configure(org.springframework.security.config.annotation.web.builder
             StrictHttpFirewall firewall = new StrictHttpFirewall();
             firewall.setAllowUrlEncodedSlash(true);
             firewall.setAllowUrlEncodedDoubleSlash(true);
+            firewall.setAllowSemicolon(true);
             web.httpFirewall(firewall);
 
             // These don't need to be secured