This is an automated email from the ASF dual-hosted git repository.
jamesbognar pushed a commit to branch docs
in repository https://gitbox.apache.org/repos/asf/juneau.git
The following commit(s) were added to refs/heads/docs by this push:
new d2266e1ca1 READY-381/383/385/394: Release notes for the auth/lifecycle
hardening batch
d2266e1ca1 is described below
commit d2266e1ca1b39199c9e858b1843d0acfc839f31f
Author: James Bognar <[email protected]>
AuthorDate: Sun Aug 16 18:50:25 2026 -0400
READY-381/383/385/394: Release notes for the auth/lifecycle hardening batch
---
pages/release-notes/10.0.0.md | 9 +++++++++
1 file changed, 9 insertions(+)
diff --git a/pages/release-notes/10.0.0.md b/pages/release-notes/10.0.0.md
index 5de5b76fe7..cb15a46f68 100644
--- a/pages/release-notes/10.0.0.md
+++ b/pages/release-notes/10.0.0.md
@@ -1250,6 +1250,15 @@ See [OIDC Relying Party
Login](/docs/topics/OidcRelyingParty#login-state-store-c
**Migration:** none for normal usage; each of these only rejects
previously-out-of-spec or previously-exploitable input.
+- **Security hardening — auth boundary sweep (READY-385/383/381).** A further
hardening pass tightened three auth-adjacent boundaries flagged by adversarial
review:
+ - **`SamlMetadataResolvers.url(...)`** (`juneau-rest-server-auth-saml`) now
bounds a remote IdP metadata fetch to a configurable maximum (1 MiB by
default), enforced against both a declared `Content-Length` and the actual byte
stream as it arrives, so a malicious or misconfigured metadata endpoint can no
longer exhaust memory via an unbounded or falsely-small-`Content-Length`
response.
+ - **`AuthFilterChain`/`AuthResultAccumulator`** (`juneau-rest-server`) no
longer union roles across *different* authenticated principals when multiple
auth filters each succeed in the same request. Roles still union across
successive results for the *same* principal (e.g. a filter that
re-authenticates and adds roles); a second, differently-named principal's roles
are now ignored (logged as a `WARNING`) instead of being merged onto the first
principal's identity — closing a privilege-e [...]
+ - **`OAuthIntrospectionValidator`** (`juneau-rest-server-auth-oauth`) gains
`Builder.audience(String...)` / the RFC 8707-aliased
`Builder.resource(String...)`, checked against the introspection response's
`aud` claim(s). When configured, a token whose `aud` doesn't intersect the
expected set is rejected, closing a token-confusion path where a token issued
for a different resource/audience would otherwise be accepted. Unconfigured
(the default) preserves prior behavior exactly — no audi [...]
+
+ **Migration:** none for normal usage. An application relying on the old
cross-principal role union (uncommon and generally unintended) will see those
roles no longer merged; one that wants audience enforcement must now explicitly
call `audience(...)`/`resource(...)` on the `OAuthIntrospectionValidator`
builder (previously not available).
+
+- **Fixed `ReadinessState` incorrectly shared across multiple
default-configured microservices in one JVM (READY-394).**
`JettyServerComponent`/`TomcatServerComponent` previously flipped
`ReadinessState.resolve(ms.getBeanStore())` on start/stop without ever
registering a bean back into that store, and `HealthAggregator` resolved
readiness from the health-probe servlet's own (different) `RestContext` bean
store — so on the default (no app `@Bean ReadinessState`) path, both sides
silently [...]
+
- **Present-but-empty `RestContext.*` boolean settings no longer throw
(leniency improvement).** Landed alongside the new `RestContextProperties`
`@ConfigProperties` bean (see New Features above): previously, a
present-but-empty value for a boolean `RestContext.*` setting (e.g.
`RestContext.eagerInit=`) threw `BeanCreationException` at injection time,
because the old `@Value boolean` field's strict conversion had no tolerance for
an empty string. As of 10.0.0 this is resolved leniently t [...]
- **SVL variables in a `RestContext.*` boolean setting now resolve through the
resource's own var resolver (capability widening).** Landed alongside the same
`RestContextProperties` change: a `$C{...}` / `$R{...}` / `$S{...}`-style
variable embedded in a boolean `RestContext.*` value (e.g.
`RestContext.virtualThreads=$C{MyConfig/virtualThreads}`) is now resolved
through the owning resource's `VarResolver` rather than `VarResolver.DEFAULT`,
so resource-scoped variables like `$C{...}` (con [...]
