From 48ea0a62496851291ed916a6a3c0c934c2a4f0c0 Mon Sep 17 00:00:00 2001
From: Luke Taylor <luke.taylor@springsource.com>
Date: Fri, 17 Dec 2010 17:34:08 +0000
Subject: [PATCH] SEC-1638: Added paragraph to docs explaining that for
 complete security, an app should not switch out of HTTPS at all.

---
 docs/manual/src/docbook/namespace-config.xml | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/docs/manual/src/docbook/namespace-config.xml b/docs/manual/src/docbook/namespace-config.xml
index c232a93b22..89108a3f23 100644
--- a/docs/manual/src/docbook/namespace-config.xml
+++ b/docs/manual/src/docbook/namespace-config.xml
@@ -468,8 +468,11 @@
       <port-mapping http="9080" https="9443"/>
     </port-mappings>
   </http>]]>
-        </programlisting><!--You can find a more in-depth discussion of channel security
-        in <xref xlink:href="#channel-security"/--></para>
+                </programlisting>
+                Note that in order to be truly secure, an application should not use HTTP at all or switch
+                between HTTP and HTTPS. It should start in HTTPS (with the user entering an HTTPS URL) and
+                use a secure connection throughout to avoid any possibility of man-in-the-middle attacks.
+            </para>
         </section>
         <section xml:id="ns-session-mgmt">
             <title>Session Management</title>