{"action":"created","comment":{"url":"https://api.github.com/repos/gocd/gocd/pulls/comments/184426922","pull_request_review_id":115622067,"id":184426922,"diff_hunk":"@@ -34,6 +34,7 @@ public RememberLastRequestUrlFilterChain() {\n                 .addFilterChain(\"/plugin/*/login\")\n                 .addFilterChain(\"/assets/**\")\n                 .addFilterChain(\"/server/messages.json\")\n+                .addFilterChain(\"/pipelines.json\")","path":"server/src/main/java/com/thoughtworks/go/server/newsecurity/filterchains/RememberLastRequestUrlFilterChain.java","position":null,"original_position":4,"commit_id":"da9bc53e9340d7f2d1b41e7db886972646bffcc9","original_commit_id":"da9bc53e9340d7f2d1b41e7db886972646bffcc9","user":{"login":"ketan","id":10598,"avatar_url":"https://avatars3.githubusercontent.com/u/10598?v=4","gravatar_id":"","url":"https://api.github.com/users/ketan","html_url":"https://github.com/ketan","followers_url":"https://api.github.com/users/ketan/followers","following_url":"https://api.github.com/users/ketan/following{/other_user}","gists_url":"https://api.github.com/users/ketan/gists{/gist_id}","starred_url":"https://api.github.com/users/ketan/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ketan/subscriptions","organizations_url":"https://api.github.com/users/ketan/orgs","repos_url":"https://api.github.com/users/ketan/repos","events_url":"https://api.github.com/users/ketan/events{/privacy}","received_events_url":"https://api.github.com/users/ketan/received_events","type":"User","site_admin":false},"body":"Should we just add a `*.json` and `*.xml` here?","created_at":"2018-04-26T15:15:25Z","updated_at":"2018-04-26T15:15:25Z","html_url":"https://github.com/gocd/gocd/pull/4611#discussion_r184426922","pull_request_url":"https://api.github.com/repos/gocd/gocd/pulls/4611","author_association":"CONTRIBUTOR","_links":{"self":{"href":"https://api.github.com/repos/gocd/gocd/pulls/comments/184426922"},"html":{"href":"https://github.com/gocd/gocd/pull/4611#discussion_r184426922"},"pull_request":{"href":"https://api.github.com/repos/gocd/gocd/pulls/4611"}}},"pull_request":{"url":"https://api.github.com/repos/gocd/gocd/pulls/4611","id":179367746,"html_url":"https://github.com/gocd/gocd/pull/4611","diff_url":"https://github.com/gocd/gocd/pull/4611.diff","patch_url":"https://github.com/gocd/gocd/pull/4611.patch","issue_url":"https://api.github.com/repos/gocd/gocd/issues/4611","number":4611,"state":"open","locked":false,"title":"Remove dependency on spring-security","user":{"login":"bdpiparva","id":7871209,"avatar_url":"https://avatars3.githubusercontent.com/u/7871209?v=4","gravatar_id":"","url":"https://api.github.com/users/bdpiparva","html_url":"https://github.com/bdpiparva","followers_url":"https://api.github.com/users/bdpiparva/followers","following_url":"https://api.github.com/users/bdpiparva/following{/other_user}","gists_url":"https://api.github.com/users/bdpiparva/gists{/gist_id}","starred_url":"https://api.github.com/users/bdpiparva/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bdpiparva/subscriptions","organizations_url":"https://api.github.com/users/bdpiparva/orgs","repos_url":"https://api.github.com/users/bdpiparva/repos","events_url":"https://api.github.com/users/bdpiparva/events{/privacy}","received_events_url":"https://api.github.com/users/bdpiparva/received_events","type":"User","site_admin":false},"body":"# Summary\r\n\r\nThe new implementation of spring security is a collection of the filter chain. The entry point for this is defined in `web.xml`\r\n\r\n```xml\r\n<filter>\r\n    <filter-name>mainFilterChain</filter-name>\r\n    <filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>\r\n    <init-param>\r\n      <param-name>targetBeanName</param-name>\r\n      <param-value>mainFilterChain</param-value>\r\n    </init-param>\r\n</filter>\r\n...\r\n<filter-mapping>\r\n    <filter-name>mainFilterChain</filter-name>\r\n    <url-pattern>/*</url-pattern>\r\n</filter-mapping>\r\n```\r\n\r\n## MainFilterChain\r\nThe main filter chain is a collection of filter chain and global filters. \r\n\r\n1. **ModeAwareFilter:** This filter is to block incoming `POST`, `PUT`, `PATCH` or `DELETE` request when a server is running in passive mode\r\n2. **CreateSessionFilterChain:** This filter chain contains 2 filters -\r\n\r\n    | Name | Description |\r\n    | ------------------------------------ | ----------------------------------------------------------------------------------------------- |\r\n    | AlwaysCreateSessionFilter            | Filter will create a new session if one not exist                                               |\r\n    | ApiSessionReduceIdleTimeoutFilter    | This is to reduce `MaxInActiveInterval` on session for `/api/*`, `/cctray.xml`.                 |\r\n3. **LocaleResolver:** Setup the locale for the request\r\n4. **RememberLastRequestUrlFilterChain:** The filter remembers the last requested url(`GET` and `HEAD` only) except following URLs \r\n    - `/cctray.xml`\r\n    - `/api/*`\r\n    - `/remoting/**`\r\n    - `/agent-websocket/**`\r\n    - `/auth/**`\r\n    - `/plugin/*/authenticate`\r\n    - `/plugin/*/login`\r\n    - `/assets/**` \r\n    - `/server/messages.json` \r\n    \r\n5. **AuthenticationFilterChain:** The authentication filter chain contains a list of URLs and authentication filter for the URL.\r\nIt also contains some additional filters that applies before authentication filter such as - `InvalidateAuthenticationOnSecurityConfigChangeFilter` and `ReAuthenticationFilter`\r\n  * `X509AuthenticationFilter`: This is to perform authentication using X509 certificate provided by the agent. \r\n  * `InvalidateAuthenticationOnSecurityConfigChangeFilter`: Invalidates authentication token for all user's when security config is changed.\r\n  * `ReAuthenticationWithRedirectToLoginPage`: Performs re-authentication using existing `AuthenticationToken` when token is not valid or expired. On success, the filter will update the existing `AuthenticationToken` and continues to next filter in the chain. On failure, it will redirect the user to `/go/auth/login` page.\r\n  * `ReAuthenticationWithChallenge`: Performs re-authentication using existing `AuthenticationToken` when a token is not valid or expired. On success, the filter will update the existing `AuthenticationToken` and continues to next filter in the chain. On failure, it will prepare a response as follow -\r\n    \r\n    - Show challenge(`WWW-Authenticate`) when security is enabled and request is api request but not an Ajax request\r\n    - Set response status to `401`\r\n    - Set `Content-Type` based on request `Accept`  header\r\n    - Generate access denied message(`json or xml`) based on `Accept` header\r\n    \r\n  * `BasicAuthenticationWithChallengeFilter`: Performs the authentication if a request is not authenticated and `BASIC` auth credentials are provided in the request.\r\n  * `ReAuthenticationWithRedirectToLoginPage`: Performs the authentication if a request is not authenticated and `BASIC` auth credentials are provided in the request.\r\n\r\n\r\n\r\n| Ant url patter | Filters |\r\n| ---------------------------------------- | ------------------------------------------------------------------------------------------- |\r\n| `/remoting/**`                           | `X509AuthenticationFilter` |\r\n| `/agent-websocket/**`                    | `x509AuthenticationFilter` |\r\n| `/add-on/*/api/**`                       | `InvalidateAuthenticationOnSecurityConfigChangeFilter`, `ReAuthenticationWithRedirectToLoginPage` and`OauthAuthenticationFilter` |\r\n| `/api/config-repository.git/**`          | `InvalidateAuthenticationOnSecurityConfigChangeFilter`, `ReAuthenticationWithChallenge` and `BasicAuthenticationWithChallengeFilter` |\r\n| `/cctray.xml`                            | `InvalidateAuthenticationOnSecurityConfigChangeFilter`, `ReAuthenticationWithChallenge` and `BasicAuthenticationWithChallengeFilter` | \r\n| `/api/**`                                | `InvalidateAuthenticationOnSecurityConfigChangeFilter`, `ReAuthenticationWithChallenge` and `BasicAuthenticationWithChallengeFilter` |\r\n| `/api/version`                           | `InvalidateAuthenticationOnSecurityConfigChangeFilter`, `ReAuthenticationWithRedirectToLoginPage` and `BasicAuthenticationWithRedirectToLoginFilter` |\r\n| `auth/*`                                 | This url is open for all hence, `NoOpFilter` will applied to it. | \r\n| `/plugin/*/login`                        | This url is open for all hence, `NoOpFilter` will applied to it. |\r\n| `/plugin/*/authenticate`                 | This url is open for all hence, `NoOpFilter` will applied to it. |\r\n| `/**`                                    | `InvalidateAuthenticationOnSecurityConfigChangeFilter`, `ReAuthenticationWithRedirectToLoginPage` and `BasicAuthenticationWithRedirectToLoginFilter` |\r\n\r\n6. **AssumeAnonymousUserFilter:** When `AuthenticationFilterChain` fails to authenticate request the filter will authenticate using anonymous authentication token.\r\n7. **ThreadLocalUserFilter:** This will update the user in ThreadLocal for application use and at after serving request it will remove the user from ThreadLocal.\r\n8. **AuthorizeFilterChain:** The filter chain contains mappings of URLs to required authority to access the URL. \r\nIt also uses `ResponseHandler` to generate access denied message based on the request.\r\n9. **DenyGoCDAccessForArtifactsFilterChain:** It will block GoCD access from artifacts.  \r\n10. **ArtifactSizeEnforcementFilterChain:** The filter will check if enough disk space available while uploading artifact. The filter applies to `/files/**` and `/remoting/files/**`\r\n11. **FlashLoadingFilter:** Load the flash from the session and add it to thread local.\r\n","created_at":"2018-04-04T12:00:52Z","updated_at":"2018-04-26T15:15:25Z","closed_at":null,"merged_at":null,"merge_commit_sha":"7c296844144346f558b1cca0a0d2c0f513379e61","assignee":null,"assignees":[],"requested_reviewers":[],"requested_teams":[],"labels":[],"milestone":null,"commits_url":"https://api.github.com/repos/gocd/gocd/pulls/4611/commits","review_comments_url":"https://api.github.com/repos/gocd/gocd/pulls/4611/comments","review_comment_url":"https://api.github.com/repos/gocd/gocd/pulls/comments{/number}","comments_url":"https://api.github.com/repos/gocd/gocd/issues/4611/comments","statuses_url":"https://api.github.com/repos/gocd/gocd/statuses/da9bc53e9340d7f2d1b41e7db886972646bffcc9","head":{"label":"bdpiparva:agent-remoting-filter-chain","ref":"agent-remoting-filter-chain","sha":"da9bc53e9340d7f2d1b41e7db886972646bffcc9","user":{"login":"bdpiparva","id":7871209,"avatar_url":"https://avatars3.githubusercontent.com/u/7871209?v=4","gravatar_id":"","url":"https://api.github.com/users/bdpiparva","html_url":"https://github.com/bdpiparva","followers_url":"https://api.github.com/users/bdpiparva/followers","following_url":"https://api.github.com/users/bdpiparva/following{/other_user}","gists_url":"https://api.github.com/users/bdpiparva/gists{/gist_id}","starred_url":"https://api.github.com/users/bdpiparva/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bdpiparva/subscriptions","organizations_url":"https://api.github.com/users/bdpiparva/orgs","repos_url":"https://api.github.com/users/bdpiparva/repos","events_url":"https://api.github.com/users/bdpiparva/events{/privacy}","received_events_url":"https://api.github.com/users/bdpiparva/received_events","type":"User","site_admin":false},"repo":{"id":68169733,"name":"gocd","full_name":"bdpiparva/gocd","owner":{"login":"bdpiparva","id":7871209,"avatar_url":"https://avatars3.githubusercontent.com/u/7871209?v=4","gravatar_id":"","url":"https://api.github.com/users/bdpiparva","html_url":"https://github.com/bdpiparva","followers_url":"https://api.github.com/users/bdpiparva/followers","following_url":"https://api.github.com/users/bdpiparva/following{/other_user}","gists_url":"https://api.github.com/users/bdpiparva/gists{/gist_id}","starred_url":"https://api.github.com/users/bdpiparva/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bdpiparva/subscriptions","organizations_url":"https://api.github.com/users/bdpiparva/orgs","repos_url":"https://api.github.com/users/bdpiparva/repos","events_url":"https://api.github.com/users/bdpiparva/events{/privacy}","received_events_url":"https://api.github.com/users/bdpiparva/received_events","type":"User","site_admin":false},"private":false,"html_url":"https://github.com/bdpiparva/gocd","description":"Main repository for GoCD - Continuous Delivery server","fork":true,"url":"https://api.github.com/repos/bdpiparva/gocd","forks_url":"https://api.github.com/repos/bdpiparva/gocd/forks","keys_url":"https://api.github.com/repos/bdpiparva/gocd/keys{/key_id}","collaborators_url":"https://api.github.com/repos/bdpiparva/gocd/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/bdpiparva/gocd/teams","hooks_url":"https://api.github.com/repos/bdpiparva/gocd/hooks","issue_events_url":"https://api.github.com/repos/bdpiparva/gocd/issues/events{/number}","events_url":"https://api.github.com/repos/bdpiparva/gocd/events","assignees_url":"https://api.github.com/repos/bdpiparva/gocd/assignees{/user}","branches_url":"https://api.github.com/repos/bdpiparva/gocd/branches{/branch}","tags_url":"https://api.github.com/repos/bdpiparva/gocd/tags","blobs_url":"https://api.github.com/repos/bdpiparva/gocd/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/bdpiparva/gocd/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/bdpiparva/gocd/git/refs{/sha}","trees_url":"https://api.github.com/repos/bdpiparva/gocd/git/trees{/sha}","statuses_url":"https://api.github.com/repos/bdpiparva/gocd/statuses/{sha}","languages_url":"https://api.github.com/repos/bdpiparva/gocd/languages","stargazers_url":"https://api.github.com/repos/bdpiparva/gocd/stargazers","contributors_url":"https://api.github.com/repos/bdpiparva/gocd/contributors","subscribers_url":"https://api.github.com/repos/bdpiparva/gocd/subscribers","subscription_url":"https://api.github.com/repos/bdpiparva/gocd/subscription","commits_url":"https://api.github.com/repos/bdpiparva/gocd/commits{/sha}","git_commits_url":"https://api.github.com/repos/bdpiparva/gocd/git/commits{/sha}","comments_url":"https://api.github.com/repos/bdpiparva/gocd/comments{/number}","issue_comment_url":"https://api.github.com/repos/bdpiparva/gocd/issues/comments{/number}","contents_url":"https://api.github.com/repos/bdpiparva/gocd/contents/{+path}","compare_url":"https://api.github.com/repos/bdpiparva/gocd/compare/{base}...{head}","merges_url":"https://api.github.com/repos/bdpiparva/gocd/merges","archive_url":"https://api.github.com/repos/bdpiparva/gocd/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/bdpiparva/gocd/downloads","issues_url":"https://api.github.com/repos/bdpiparva/gocd/issues{/number}","pulls_url":"https://api.github.com/repos/bdpiparva/gocd/pulls{/number}","milestones_url":"https://api.github.com/repos/bdpiparva/gocd/milestones{/number}","notifications_url":"https://api.github.com/repos/bdpiparva/gocd/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/bdpiparva/gocd/labels{/name}","releases_url":"https://api.github.com/repos/bdpiparva/gocd/releases{/id}","deployments_url":"https://api.github.com/repos/bdpiparva/gocd/deployments","created_at":"2016-09-14T03:22:36Z","updated_at":"2018-04-26T12:27:18Z","pushed_at":"2018-04-26T13:51:56Z","git_url":"git://github.com/bdpiparva/gocd.git","ssh_url":"git@github.com:bdpiparva/gocd.git","clone_url":"https://github.com/bdpiparva/gocd.git","svn_url":"https://github.com/bdpiparva/gocd","homepage":"https://go.cd","size":263049,"stargazers_count":0,"watchers_count":0,"language":"Java","has_issues":false,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":0,"mirror_url":null,"archived":false,"open_issues_count":0,"license":{"key":"apache-2.0","name":"Apache License 2.0","spdx_id":"Apache-2.0","url":"https://api.github.com/licenses/apache-2.0"},"forks":0,"open_issues":0,"watchers":0,"default_branch":"master"}},"base":{"label":"gocd:master","ref":"master","sha":"c922b4be874d2e053bd56c315311cf2429cbc017","user":{"login":"gocd","id":6099846,"avatar_url":"https://avatars1.githubusercontent.com/u/6099846?v=4","gravatar_id":"","url":"https://api.github.com/users/gocd","html_url":"https://github.com/gocd","followers_url":"https://api.github.com/users/gocd/followers","following_url":"https://api.github.com/users/gocd/following{/other_user}","gists_url":"https://api.github.com/users/gocd/gists{/gist_id}","starred_url":"https://api.github.com/users/gocd/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/gocd/subscriptions","organizations_url":"https://api.github.com/users/gocd/orgs","repos_url":"https://api.github.com/users/gocd/repos","events_url":"https://api.github.com/users/gocd/events{/privacy}","received_events_url":"https://api.github.com/users/gocd/received_events","type":"Organization","site_admin":false},"repo":{"id":15155534,"name":"gocd","full_name":"gocd/gocd","owner":{"login":"gocd","id":6099846,"avatar_url":"https://avatars1.githubusercontent.com/u/6099846?v=4","gravatar_id":"","url":"https://api.github.com/users/gocd","html_url":"https://github.com/gocd","followers_url":"https://api.github.com/users/gocd/followers","following_url":"https://api.github.com/users/gocd/following{/other_user}","gists_url":"https://api.github.com/users/gocd/gists{/gist_id}","starred_url":"https://api.github.com/users/gocd/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/gocd/subscriptions","organizations_url":"https://api.github.com/users/gocd/orgs","repos_url":"https://api.github.com/users/gocd/repos","events_url":"https://api.github.com/users/gocd/events{/privacy}","received_events_url":"https://api.github.com/users/gocd/received_events","type":"Organization","site_admin":false},"private":false,"html_url":"https://github.com/gocd/gocd","description":"Main repository for GoCD - Continuous Delivery server","fork":false,"url":"https://api.github.com/repos/gocd/gocd","forks_url":"https://api.github.com/repos/gocd/gocd/forks","keys_url":"https://api.github.com/repos/gocd/gocd/keys{/key_id}","collaborators_url":"https://api.github.com/repos/gocd/gocd/collaborators{/collaborator}","teams_url":"https://api.github.com/repos/gocd/gocd/teams","hooks_url":"https://api.github.com/repos/gocd/gocd/hooks","issue_events_url":"https://api.github.com/repos/gocd/gocd/issues/events{/number}","events_url":"https://api.github.com/repos/gocd/gocd/events","assignees_url":"https://api.github.com/repos/gocd/gocd/assignees{/user}","branches_url":"https://api.github.com/repos/gocd/gocd/branches{/branch}","tags_url":"https://api.github.com/repos/gocd/gocd/tags","blobs_url":"https://api.github.com/repos/gocd/gocd/git/blobs{/sha}","git_tags_url":"https://api.github.com/repos/gocd/gocd/git/tags{/sha}","git_refs_url":"https://api.github.com/repos/gocd/gocd/git/refs{/sha}","trees_url":"https://api.github.com/repos/gocd/gocd/git/trees{/sha}","statuses_url":"https://api.github.com/repos/gocd/gocd/statuses/{sha}","languages_url":"https://api.github.com/repos/gocd/gocd/languages","stargazers_url":"https://api.github.com/repos/gocd/gocd/stargazers","contributors_url":"https://api.github.com/repos/gocd/gocd/contributors","subscribers_url":"https://api.github.com/repos/gocd/gocd/subscribers","subscription_url":"https://api.github.com/repos/gocd/gocd/subscription","commits_url":"https://api.github.com/repos/gocd/gocd/commits{/sha}","git_commits_url":"https://api.github.com/repos/gocd/gocd/git/commits{/sha}","comments_url":"https://api.github.com/repos/gocd/gocd/comments{/number}","issue_comment_url":"https://api.github.com/repos/gocd/gocd/issues/comments{/number}","contents_url":"https://api.github.com/repos/gocd/gocd/contents/{+path}","compare_url":"https://api.github.com/repos/gocd/gocd/compare/{base}...{head}","merges_url":"https://api.github.com/repos/gocd/gocd/merges","archive_url":"https://api.github.com/repos/gocd/gocd/{archive_format}{/ref}","downloads_url":"https://api.github.com/repos/gocd/gocd/downloads","issues_url":"https://api.github.com/repos/gocd/gocd/issues{/number}","pulls_url":"https://api.github.com/repos/gocd/gocd/pulls{/number}","milestones_url":"https://api.github.com/repos/gocd/gocd/milestones{/number}","notifications_url":"https://api.github.com/repos/gocd/gocd/notifications{?since,all,participating}","labels_url":"https://api.github.com/repos/gocd/gocd/labels{/name}","releases_url":"https://api.github.com/repos/gocd/gocd/releases{/id}","deployments_url":"https://api.github.com/repos/gocd/gocd/deployments","created_at":"2013-12-13T05:26:16Z","updated_at":"2018-04-26T13:51:44Z","pushed_at":"2018-04-26T13:51:58Z","git_url":"git://github.com/gocd/gocd.git","ssh_url":"git@github.com:gocd/gocd.git","clone_url":"https://github.com/gocd/gocd.git","svn_url":"https://github.com/gocd/gocd","homepage":"https://www.gocd.org","size":262696,"stargazers_count":4112,"watchers_count":4112,"language":"Java","has_issues":true,"has_projects":true,"has_downloads":true,"has_wiki":true,"has_pages":false,"forks_count":705,"mirror_url":null,"archived":false,"open_issues_count":847,"license":{"key":"apache-2.0","name":"Apache License 2.0","spdx_id":"Apache-2.0","url":"https://api.github.com/licenses/apache-2.0"},"forks":705,"open_issues":847,"watchers":4112,"default_branch":"master"}},"_links":{"self":{"href":"https://api.github.com/repos/gocd/gocd/pulls/4611"},"html":{"href":"https://github.com/gocd/gocd/pull/4611"},"issue":{"href":"https://api.github.com/repos/gocd/gocd/issues/4611"},"comments":{"href":"https://api.github.com/repos/gocd/gocd/issues/4611/comments"},"review_comments":{"href":"https://api.github.com/repos/gocd/gocd/pulls/4611/comments"},"review_comment":{"href":"https://api.github.com/repos/gocd/gocd/pulls/comments{/number}"},"commits":{"href":"https://api.github.com/repos/gocd/gocd/pulls/4611/commits"},"statuses":{"href":"https://api.github.com/repos/gocd/gocd/statuses/da9bc53e9340d7f2d1b41e7db886972646bffcc9"}},"author_association":"CONTRIBUTOR"}}
{"actor":{"display_login":"ketan"}}