SEC-2325: Polish CSRF Tag support
- Rename csrfField to csrfInput - Make AbstractCsrfTag package scope - rename FormFieldTag to CsrfInputTag - rename MetaTagsTag to CsrfMetaTagsTag - removed whitespace from tag output so output is minimized & improving browser performance - Update @since - changed test names to be more meaningful
This commit is contained in:
@@ -3139,7 +3139,7 @@ The last step is to ensure that you include the CSRF token in all PATCH, POST, P
|
||||
</form>
|
||||
----
|
||||
|
||||
An easier approach is to use <<the-csrffield-tag,the csrfField tag>> from the Spring Security JSP tag library.
|
||||
An easier approach is to use <<the-csrfInput-tag,the csrfInput tag>> from the Spring Security JSP tag library.
|
||||
|
||||
[NOTE]
|
||||
====
|
||||
@@ -5037,17 +5037,17 @@ The permissions are passed to the `PermissionFactory` defined in the application
|
||||
This tag also supports the `var` attribute, in the same way as the `authorize` tag.
|
||||
|
||||
|
||||
=== The csrfField Tag
|
||||
=== The csrfInput Tag
|
||||
If CSRF protection is enabled, this tag inserts a hidden form field with the correct name and value for the CSRF protection token. If CSRF protection is not enabled, this tag outputs nothing.
|
||||
|
||||
Normally Spring Security automatically inserts a CSRF form field for any `<form:form>` tags you use, but if for some reason you cannot use `<form:form>`, `csrfField` is a handy replacement.
|
||||
Normally Spring Security automatically inserts a CSRF form field for any `<form:form>` tags you use, but if for some reason you cannot use `<form:form>`, `csrfInput` is a handy replacement.
|
||||
|
||||
You should place this tag within an HTML `<form></form>` block, where you would normally place other input fields. Do NOT place this tag within a Spring `<form:form></form:form>` block—Spring Security handles Spring forms automatically.
|
||||
|
||||
[source,xml]
|
||||
----
|
||||
<form method="post" action="/do/something">
|
||||
<sec:csrfField />
|
||||
<sec:csrfInput />
|
||||
Name:<br />
|
||||
<input type="text" name="name" />
|
||||
...
|
||||
|
||||
Reference in New Issue
Block a user