From 620c96649d3301fdd674cf7614479ce57c265ba5 Mon Sep 17 00:00:00 2001 From: Devon Hillard Date: Thu, 23 Jul 2026 18:17:34 -0600 Subject: [PATCH] fix: whitelist /apple-touch-icon* wildcard so Safari icon probes don't hit protected-URL handling Safari/iOS auto-probes both /apple-touch-icon.png and /apple-touch-icon-precomposed.png (plus sized variants) at the site root on every page load. The unprotectedURIs lists only whitelisted the precomposed variant, so the plain /apple-touch-icon.png probe was a protected URL under defaultAction=deny. Swap the single precomposed token for the /apple-touch-icon* wildcard in application.yml, application-mfa.yml, and application-playwright-test.yml so the reference config models the correct pattern. Pairs with the library-level RequestCache hardening and auto-unprotect in SpringUserFramework PR #343 (which fixes the underlying post-login redirect hijack for all consumers). --- src/main/resources/application-mfa.yml | 2 +- src/main/resources/application-playwright-test.yml | 2 +- src/main/resources/application.yml | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/src/main/resources/application-mfa.yml b/src/main/resources/application-mfa.yml index 59f2eb2..ffe3c61 100644 --- a/src/main/resources/application-mfa.yml +++ b/src/main/resources/application-mfa.yml @@ -22,4 +22,4 @@ user: # Allow the passkey-only "set initial password" flow to run without a StepUpService (SUF-02); the demo has no # StepUpService bean, so without this the flow returns HTTP 403. In production, provide a StepUpService instead. allowInitialPasswordSetWithoutStepUp: true - unprotectedURIs: /,/index.html,/favicon.ico,/apple-touch-icon-precomposed.png,/css/*,/js/*,/js/user/*,/js/event/*,/js/utils/*,/img/**,/user/registration,/user/registration/passwordless,/user/resendRegistrationToken,/user/resetPassword,/user/registrationConfirm,/user/changePassword,/user/savePassword,/oauth2/authorization/*,/login,/user/login,/user/login.html,/swagger-ui.html,/swagger-ui/**,/v3/api-docs/**,/event/,/event/list.html,/event/**,/about.html,/error,/error.html,/webauthn/authenticate/**,/login/webauthn,/webauthn/register/options,/webauthn/register + unprotectedURIs: /,/index.html,/favicon.ico,/apple-touch-icon*,/css/*,/js/*,/js/user/*,/js/event/*,/js/utils/*,/img/**,/user/registration,/user/registration/passwordless,/user/resendRegistrationToken,/user/resetPassword,/user/registrationConfirm,/user/changePassword,/user/savePassword,/oauth2/authorization/*,/login,/user/login,/user/login.html,/swagger-ui.html,/swagger-ui/**,/v3/api-docs/**,/event/,/event/list.html,/event/**,/about.html,/error,/error.html,/webauthn/authenticate/**,/login/webauthn,/webauthn/register/options,/webauthn/register diff --git a/src/main/resources/application-playwright-test.yml b/src/main/resources/application-playwright-test.yml index c70ad64..128d20e 100644 --- a/src/main/resources/application-playwright-test.yml +++ b/src/main/resources/application-playwright-test.yml @@ -34,7 +34,7 @@ user: # StepUpService bean, so without this the flow returns HTTP 403. allowInitialPasswordSetWithoutStepUp: true # Test API endpoints are handled by TestApiSecurityConfig with IP whitelist restriction - unprotectedURIs: /,/index.html,/favicon.ico,/apple-touch-icon-precomposed.png,/css/*,/js/*,/js/user/*,/js/event/*,/js/utils/*,/img/**,/user/registration,/user/resendRegistrationToken,/user/resetPassword,/user/registrationConfirm,/user/changePassword,/user/savePassword,/oauth2/authorization/*,/login,/user/login,/user/login.html,/swagger-ui.html,/swagger-ui/**,/v3/api-docs/**,/event/,/event/list.html,/event/**,/about.html,/error,/error.html + unprotectedURIs: /,/index.html,/favicon.ico,/apple-touch-icon*,/css/*,/js/*,/js/user/*,/js/event/*,/js/utils/*,/img/**,/user/registration,/user/resendRegistrationToken,/user/resetPassword,/user/registrationConfirm,/user/changePassword,/user/savePassword,/oauth2/authorization/*,/login,/user/login,/user/login.html,/swagger-ui.html,/swagger-ui/**,/v3/api-docs/**,/event/,/event/list.html,/event/**,/about.html,/error,/error.html logging: level: diff --git a/src/main/resources/application.yml b/src/main/resources/application.yml index 93c5597..9fdeeca 100644 --- a/src/main/resources/application.yml +++ b/src/main/resources/application.yml @@ -140,7 +140,7 @@ user: bcryptStrength: 12 # The bcrypt strength to use for password hashing. The higher the number, the longer it takes to hash the password. The default is 12. The minimum is 4. The maximum is 31. testHashTime: true # If true, the test hash time will be logged to the console on startup. This is useful for determining the optimal bcryptStrength value. defaultAction: deny # The default action for all requests. This can be either deny or allow. - unprotectedURIs: /,/index.html,/favicon.ico,/apple-touch-icon-precomposed.png,/css/*,/js/*,/js/user/*,/js/event/*,/js/utils/*,/img/**,/user/registration,/user/registration/passwordless,/user/resendRegistrationToken,/user/resetPassword,/user/registrationConfirm,/user/changePassword,/user/savePassword,/oauth2/authorization/*,/login,/user/login,/user/login.html,/swagger-ui.html,/swagger-ui/**,/v3/api-docs/**,/event/,/event/list.html,/event/**,/about.html,/error,/error.html,/webauthn/authenticate/**,/login/webauthn # A comma delimited list of URIs that should not be protected by Spring Security if the defaultAction is deny. + unprotectedURIs: /,/index.html,/favicon.ico,/apple-touch-icon*,/css/*,/js/*,/js/user/*,/js/event/*,/js/utils/*,/img/**,/user/registration,/user/registration/passwordless,/user/resendRegistrationToken,/user/resetPassword,/user/registrationConfirm,/user/changePassword,/user/savePassword,/oauth2/authorization/*,/login,/user/login,/user/login.html,/swagger-ui.html,/swagger-ui/**,/v3/api-docs/**,/event/,/event/list.html,/event/**,/about.html,/error,/error.html,/webauthn/authenticate/**,/login/webauthn # A comma delimited list of URIs that should not be protected by Spring Security if the defaultAction is deny. protectedURIs: /protected.html # A comma delimited list of URIs that should be protected by Spring Security if the defaultAction is allow. disableCSRFdURIs: /no-csrf-test # A comma delimited list of URIs that should not be protected by CSRF protection. This may include API endpoints that need to be called without a CSRF token.