$Id: HISTORY,v 1.28 2004/12/13 14:46:53 maxcooper Exp $
$Revision: 1.28 $
$Date: 2004/12/13 14:46:53 $


Security Filter v2.0
======================================
http://securityfilter.sourceforge.net/


This document describes the history of the Security Filter project by lising the
changes made for each release.


Release 2.0, 2004-Dec-13
========================
* Fixed URL-rewriting to support session persistence without cookies.
http://sourceforge.net/tracker/index.php?func=detail&aid=734184&group_id=59484&atid=491164

* New DTD for version 2.0. form-default-page is now required in form-login-config. Added
"remember me" elements.

* Added "remember me" functionality. See securityfilter-rememberme.war for an example of
how to add this feature to an application.

* Fixed bug with BASIC auth that was ignoring username/password unless sf asked for them:
http://sourceforge.net/tracker/index.php?func=detail&aid=968276&group_id=59484&atid=491164


Release 1.1, 2003-Oct-25
========================
* Session is now invalidated if the user spontaneously logs in again as a different user.
The session is kept if they login as the same user.
http://sourceforge.net/tracker/index.php?func=detail&aid=824791&group_id=59484&atid=491164

* Query string parameters on <form-login-page> and <form-error-page> URIs is now supported.
http://sourceforge.net/tracker/index.php?func=detail&aid=783697&group_id=59484&atid=491164

* Fixed classloader issue that was causing problems on Tomcat + JBoss 3.x:
http://sourceforge.net/tracker/index.php?func=detail&aid=770075&group_id=59484&atid=491164


Release 1.1-b1, 2003-Jul-15
===========================
* Added support for BASIC authentication scheme.

* [THIS FEATURE HAS BEEN REMOVED] User is compeletely logged out of the system on a logout
request even when using BASIC Authentication scheme. This feature has not been implemented
in any J2EE Application server known so far. This feature has been tested on Orion 1.5.2
(which implements "Servlet 2.3 public final draft" but not "Servlet 2.3 specification") and
Weblogic 6.1 SP3. This feature is useful for developers using Orion 1.5.2.


Release 1.0.1, 2003-Mar-30
==========================
* Fixed welcome-file element in web.xml for example apps; was '/index.jsp' now 'index.jsp'.

* Fixed matching of UTF-encoded URLs.


Release 1.0, 2003-Feb-07
========================
* Fixed bug that prevented password encryption from working with the Catalina realm adapter:
http://sourceforge.net/tracker/index.php?func=detail&aid=663088&group_id=59484&atid=491164

* Fixed bug that was preventing access to the login error page if it was protected. The
previous fix for this only worked for the login page:
http://sourceforge.net/tracker/index.php?func=detail&aid=650833&group_id=59484&atid=491164


Release 1.0-b5, 2003-Jan-05
===========================
* Fixed sort order for "exact" pattern types:
http://sourceforge.net/tracker/index.php?func=detail&aid=661261&group_id=59484&atid=491164

* The default mapping / is now supported. This url-pattern will be tried last and will
match any request:
http://sourceforge.net/tracker/index.php?func=detail&aid=656697&group_id=59484&atid=491164

* Matching is now tighter for j_security_check. If the request URI ends in
"/j_security_check", that is a match:
http://sourceforge.net/tracker/index.php?func=detail&aid=650835&group_id=59484&atid=491164

* Requests for the login page and login error page are now allowed, even if the URL would
otherwise be restricted by a security constraint:
http://sourceforge.net/tracker/index.php?func=detail&aid=650833&group_id=59484&atid=491164

* Old session is now invalidated when a user re-authenticates. The session is saved through
an unauthenticated/authenticated transition, but is invalidated through an
authenticated/authenticated transition:
http://sourceforge.net/tracker/index.php?func=detail&aid=620772&group_id=59484&atid=491164

* SecurityFilter now encodes URLs on redirects:
https://sourceforge.net/tracker/index.php?func=detail&aid=655221&group_id=59484&atid=491164

* Fixed pattern matching thread safety issues:
http://sourceforge.net/tracker/index.php?func=detail&aid=650697&group_id=59484&atid=491164

* Fixed pattern matching issues, including resolving patterns to the root of the URI:
http://sourceforge.net/tracker/index.php?func=detail&aid=638556&group_id=59484&atid=491164

* Changed regular expression library from Jakarta-Regexp to Jakarta-ORO. A performance
simulation test indicated that Jakarta-ORO Perl5 expressions offer the best performance for
this application. The old implementation was verified to fail in multi-threaded environments,
and the new implementation technique has proven to be thread-safe.


Release 1.0-b4, 2002-Sep-14
===========================
* Added registration for local copy of the DTD. If the securityfilter-config.xml
file being parsed has the public identifier of the DTD specified properly, the
local copy of the DTD file (inside securityfilter.jar) will be used instead
of getting it from the internet. A version number was added to the public id in
this release, so please be sure to specify exactly to get the local loading
behavior:
"-//SecurityFilter.org//DTD Security Filter Configuration 1.0//EN"


Release 1.0-b3, 2002-Aug-26
===========================
* Fixed bug that would cause NullPointerException in SimpleSecurityRealmBase
class if isUserInRole() was called when the user was not authenticated.


Release 1.0-b2, 2002-Aug-15
===========================
* Added http-method support. Requests will be matched against a combination of a
url-pattern and the http-method elements to determine a match.

* Fixed bug that would restrict access to resources in a web-resource-collection
for which the security-constraint did not have an auth-constraint. Now you can
access resources with no auth-constraint, or include an empty auth-constraint to
restrict access.

* Users are now redirected to the loginForm when the authorization sequence is
invoked. Previously, this was a server-side forward.

* Renamed SecurityRealmBase to SimpleSecurityRealmBase to clarify its purpose.
This base class is intended to insulate implementors from having to deal with
Principal objects for simple realm implementations. For more complicated realms,
implementors will want to implement the SecurityRealmInterface directly.

* Created SimplePrincipal class and made SavedRequest class Serializable to
support deployment on a cluster.

* Implemented servlet-spec compliant matching order for url patterns.

* Fixed issues with error page display on WebLogic.


Release 1.0-b1, 2002-Aug-08
===========================
* Initial release.


