Use reference links from attributes
Signed-off-by: Tran Ngoc Nhan <ngocnhan.tran1996@gmail.com>
This commit is contained in:
Tran Ngoc Nhan
committed by
Josh Cummings
Josh Cummings
parent
a84b506196
commit
89260a3a9c
@@ -167,7 +167,7 @@ For production, you should <<authentication-password-storage-boot-cli,hash your
|
||||
[[authentication-password-storage-boot-cli]]
|
||||
=== Encode with Spring Boot CLI
|
||||
|
||||
The easiest way to properly encode your password is to use the https://docs.spring.io/spring-boot/docs/current/reference/html/spring-boot-cli.html[Spring Boot CLI].
|
||||
The easiest way to properly encode your password is to use the {spring-boot-reference-url}cli/index.html[Spring Boot CLI].
|
||||
|
||||
For example, the following example encodes the password of `password` for use with <<authentication-password-storage-dpe>>:
|
||||
|
||||
|
||||
@@ -175,7 +175,7 @@ A server can specify the `SameSite` attribute when setting a cookie to indicate
|
||||
====
|
||||
Spring Security does not directly control the creation of the session cookie, so it does not provide support for the SameSite attribute.
|
||||
https://spring.io/projects/spring-session[Spring Session] provides support for the `SameSite` attribute in servlet-based applications.
|
||||
Spring Framework's https://docs.spring.io/spring-framework/docs/current/javadoc-api/org/springframework/web/server/session/CookieWebSessionIdResolver.html[`CookieWebSessionIdResolver`] provides out of the box support for the `SameSite` attribute in WebFlux-based applications.
|
||||
Spring Framework's {spring-framework-api-url}org/springframework/web/server/session/CookieWebSessionIdResolver.html[`CookieWebSessionIdResolver`] provides out of the box support for the `SameSite` attribute in WebFlux-based applications.
|
||||
====
|
||||
|
||||
An example, of an HTTP response header with the `SameSite` attribute might look like:
|
||||
@@ -348,7 +348,7 @@ Each option has its trade-offs.
|
||||
[NOTE]
|
||||
====
|
||||
Before you integrate Spring Security's CSRF protection with multipart file upload, you should first ensure that you can upload without the CSRF protection.
|
||||
More information about using multipart forms with Spring, see the https://docs.spring.io/spring/docs/5.2.x/spring-framework-reference/web.html#mvc-multipart[1.1.11. Multipart Resolver] section of the Spring reference and the https://docs.spring.io/spring/docs/5.2.x/javadoc-api/org/springframework/web/multipart/support/MultipartFilter.html[`MultipartFilter` Javadoc].
|
||||
More information about using multipart forms with Spring, see the {spring-framework-reference-url}web/webmvc/mvc-servlet/multipart.html[Multipart Resolver] section of the Spring reference and the {spring-framework-api-url}org/springframework/web/multipart/support/MultipartFilter.html[`MultipartFilter` Javadoc].
|
||||
====
|
||||
|
||||
[[csrf-considerations-multipart-header]]
|
||||
|
||||
@@ -26,7 +26,7 @@ Without proper configuration, the application server can not know that the load
|
||||
To fix this, you can use https://tools.ietf.org/html/rfc7239[RFC 7239] to specify that a load balancer is being used.
|
||||
To make the application aware of this, you need to configure your application server to be aware of the X-Forwarded headers.
|
||||
For example, Tomcat uses https://tomcat.apache.org/tomcat-10.1-doc/api/org/apache/catalina/valves/RemoteIpValve.html[`RemoteIpValve`] and Jetty uses https://eclipse.dev/jetty/javadoc/jetty-11/org/eclipse/jetty/server/ForwardedRequestCustomizer.html[`ForwardedRequestCustomizer`].
|
||||
Alternatively, Spring users can use https://docs.spring.io/spring-framework/reference/web/webmvc/filters.html#filters-forwarded-headers[`ForwardedHeaderFilter`] with the Servlet stack or https://docs.spring.io/spring-framework/reference/web/webflux/reactive-spring.html#webflux-forwarded-headers[`ForwardedHeaderTransformer`] with the Reactive stack.
|
||||
Alternatively, Spring users can use {spring-framework-reference-url}web/webmvc/filters.html#filters-forwarded-headers[`ForwardedHeaderFilter`] with the Servlet stack or {spring-framework-reference-url}web/webflux/reactive-spring.html#webflux-forwarded-headers[`ForwardedHeaderTransformer`] with the Reactive stack.
|
||||
|
||||
Spring Boot users can use the `server.forward-headers-strategy` property to configure the application.
|
||||
See the https://docs.spring.io/spring-boot/docs/current/reference/htmlsingle/#howto.webserver.use-behind-a-proxy-server[Spring Boot documentation] for further details.
|
||||
See the {spring-boot-reference-url}how-to/webserver.html#howto.webserver.use-behind-a-proxy-server[Spring Boot documentation] for further details.
|
||||
|
||||
@@ -17,6 +17,6 @@ If you are ready to start securing an application see the Getting Started sectio
|
||||
If you want to understand how Spring Security works, you can refer to the xref:servlet/architecture.adoc[Architecture] section.
|
||||
// FIXME add link to reactive architecture
|
||||
|
||||
If you are already familiar with Spring Security or are upgrading, check out https://docs.spring.io/spring-security/reference/whats-new.html[what's new in the latest release].
|
||||
If you are already familiar with Spring Security or are upgrading, check out xref:whats-new.adoc[what's new in the latest release].
|
||||
|
||||
If you have any questions, there is a wonderful xref:community.adoc[community] that would love to help you!
|
||||
|
||||
@@ -1,8 +1,8 @@
|
||||
= GraalVM Native Image Support
|
||||
|
||||
Spring Boot 3.0 provides https://docs.spring.io/spring-boot/docs/current/reference/html/native-image.html#native-image.introducing-graalvm-native-images[support for generating native images with GraalVM].
|
||||
Spring Boot 3.0 provides {spring-boot-reference-url}reference/packaging/native-image/introducing-graalvm-native-images.html[support for generating native images with GraalVM].
|
||||
Spring Security integrates with that support and provides its features ready for native images.
|
||||
|
||||
However, as mentioned in the https://docs.spring.io/spring-boot/docs/current/reference/html/native-image.html#native-image.introducing-graalvm-native-images.understanding-aot-processing.hint-file-generation[Spring Boot documentation], there are some cases where we need to provide hints to be used by GraalVM.
|
||||
However, as mentioned in the {spring-boot-reference-url}reference/packaging/native-image/introducing-graalvm-native-images.html#packaging.native-image.introducing-graalvm-native-images.understanding-aot-processing[Spring Boot documentation], there are some cases where we need to provide hints to be used by GraalVM.
|
||||
|
||||
This section aims to provide guidance in some Spring Security features that likely need to have additional hints provided by the application.
|
||||
|
||||
@@ -44,7 +44,7 @@ public String hello() {
|
||||
Remember that you need to xref:servlet/authorization/method-security.adoc#jc-enable-method-security[add `@EnableMethodSecurity` annotation] to your configuration class to enable method security annotations.
|
||||
====
|
||||
|
||||
If you https://docs.spring.io/spring-boot/docs/current/reference/html/native-image.html#native-image.developing-your-first-application[run the native image] of your application with the above configuration, you will get an error similar to the following when trying to invoke the `hello()` method:
|
||||
If you {spring-boot-reference-url}how-to/native-image/developing-your-first-application.html[run the native image] of your application with the above configuration, you will get an error similar to the following when trying to invoke the `hello()` method:
|
||||
|
||||
[source]
|
||||
----
|
||||
@@ -56,8 +56,8 @@ Which means that the `isAdmin()` method cannot be found on the `CustomUserDetail
|
||||
This is because Spring Security uses reflection to invoke the `isAdmin()` method and GraalVM Native Image does not support reflection by default.
|
||||
|
||||
To fix this issue, you need to give hints to GraalVM Native Image to allow reflection on the `CustomUserDetails#isAdmin()` method.
|
||||
We can do that by providing a https://docs.spring.io/spring-boot/docs/current/reference/html/native-image.html#native-image.advanced.custom-hints[custom hint].
|
||||
In this example we are going to use {spring-framework-reference-url}core.html#core.aot.hints.register-reflection-for-binding[the `@RegisterReflectionForBinding` annotation].
|
||||
We can do that by providing a {spring-boot-reference-url}reference/packaging/native-image/advanced-topics.html#packaging.native-image.advanced.custom-hints[custom hint].
|
||||
In this example we are going to use {spring-framework-reference-url}core/aot.html#aot.hints.register-reflection[the `@RegisterReflectionForBinding` annotation].
|
||||
|
||||
[NOTE]
|
||||
====
|
||||
|
||||
@@ -288,8 +288,8 @@ include-code::./TopLevelCustomizerBeanConfiguration[tag=headersCustomizer,indent
|
||||
[[customizer-bean-ordering]]
|
||||
=== Customizer Bean Ordering
|
||||
|
||||
First each xref:#httpsecurity-customizer-bean[Customizer<HttpSecurity> Bean] is applied using https://docs.spring.io/spring-framework/docs/current/javadoc-api/org/springframework/beans/factory/ObjectProvider.html#orderedStream()[ObjectProvider#orderedStream()].
|
||||
This means that if there are multiple `Customizer<HttpSecurity>` Beans, the https://docs.spring.io/spring-framework/docs/current/javadoc-api/org/springframework/core/annotation/Order.html[@Order] annotation can be added to the Bean definitions to control the ordering.
|
||||
First each xref:#httpsecurity-customizer-bean[Customizer<HttpSecurity> Bean] is applied using {spring-framework-api-url}org/springframework/beans/factory/ObjectProvider.html#orderedStream()[ObjectProvider#orderedStream()].
|
||||
This means that if there are multiple `Customizer<HttpSecurity>` Beans, the {spring-framework-api-url}org/springframework/core/annotation/Order.html[@Order] annotation can be added to the Bean definitions to control the ordering.
|
||||
|
||||
Next every xref:#top-level-customizer-bean[Top Level HttpSecurity Customizer Beans] type is looked up and each is is applied using `ObjectProvider#orderedStream()`.
|
||||
If there is are two `Customizer<HeadersConfigurer<HttpSecurity>>` beans and two `Customizer<HttpsRedirectConfigurer<HttpSecurity>>` instances, the order that each `Customizer` type is invoked is undefined.
|
||||
|
||||
@@ -224,7 +224,7 @@ Next, we discuss various ways of including the CSRF token in a form as a hidden
|
||||
[[webflux-csrf-include-form-auto]]
|
||||
===== Automatic CSRF Token Inclusion
|
||||
|
||||
Spring Security's CSRF support provides integration with Spring's https://docs.spring.io/spring/docs/current/javadoc-api/org/springframework/web/reactive/result/view/RequestDataValueProcessor.html[`RequestDataValueProcessor`] through its javadoc:org.springframework.security.web.reactive.result.view.CsrfRequestDataValueProcessor[].
|
||||
Spring Security's CSRF support provides integration with Spring's {spring-framework-api-url}org/springframework/web/reactive/result/view/RequestDataValueProcessor.html[`RequestDataValueProcessor`] through its javadoc:org.springframework.security.web.reactive.result.view.CsrfRequestDataValueProcessor[].
|
||||
For `CsrfRequestDataValueProcessor` to work, the `Mono<CsrfToken>` must be subscribed to and the `CsrfToken` must be <<webflux-csrf-include-subscribe,exposed as an attribute>> that matches javadoc:org.springframework.security.web.reactive.result.view.CsrfRequestDataValueProcessor#DEFAULT_CSRF_ATTR_NAME[].
|
||||
|
||||
Fortunately, Thymeleaf https://www.thymeleaf.org/doc/tutorials/2.1/thymeleafspring.html#integration-with-requestdatavalueprocessor[takes care of all the boilerplate] for you by integrating with `RequestDataValueProcessor` to ensure that forms that have an unsafe HTTP method (POST) automatically include the actual CSRF token.
|
||||
@@ -396,7 +396,7 @@ If JavaScript is not available, this section discusses how to place the CSRF tok
|
||||
|
||||
[NOTE]
|
||||
====
|
||||
For more information about using multipart forms with Spring, see the https://docs.spring.io/spring/docs/5.2.x/spring-framework-reference/web-reactive.html#webflux-multipart[Multipart Data] section of the Spring reference.
|
||||
For more information about using multipart forms with Spring, see the {spring-framework-reference-url}web/webflux/reactive-spring.html#webflux-multipart[Multipart Data] section of the Spring reference.
|
||||
====
|
||||
|
||||
[[webflux-csrf-considerations-multipart-body]]
|
||||
@@ -457,4 +457,4 @@ An example with Thymeleaf is shown below:
|
||||
=== HiddenHttpMethodFilter
|
||||
We have xref:features/exploits/csrf.adoc#csrf-considerations-override-method[already discussed] overriding the HTTP method.
|
||||
|
||||
In a Spring WebFlux application, overriding the HTTP method is done by using https://docs.spring.io/spring-framework/docs/5.2.x/javadoc-api/org/springframework/web/filter/reactive/HiddenHttpMethodFilter.html[`HiddenHttpMethodFilter`].
|
||||
In a Spring WebFlux application, overriding the HTTP method is done by using {spring-framework-api-url}org/springframework/web/filter/reactive/HiddenHttpMethodFilter.html[`HiddenHttpMethodFilter`].
|
||||
|
||||
@@ -93,11 +93,11 @@ fun webFilterChain(http: ServerHttpSecurity): SecurityWebFilterChain {
|
||||
|
||||
Spring Security includes xref:features/exploits/headers.adoc#headers-cache-control[Cache Control] headers by default.
|
||||
|
||||
However, if you actually want to cache specific responses, your application can selectively add them to the https://docs.spring.io/spring-framework/docs/current/javadoc-api/org/springframework/http/server/reactive/ServerHttpResponse.html[`ServerHttpResponse`] to override the header set by Spring Security.
|
||||
However, if you actually want to cache specific responses, your application can selectively add them to the {spring-framework-api-url}org/springframework/http/server/reactive/ServerHttpResponse.html[`ServerHttpResponse`] to override the header set by Spring Security.
|
||||
This is useful to ensure that such things as CSS, JavaScript, and images are properly cached.
|
||||
|
||||
When using Spring WebFlux, you typically do so within your configuration.
|
||||
You can find details on how to do so in the https://docs.spring.io/spring/docs/5.0.0.RELEASE/spring-framework-reference/web-reactive.html#webflux-config-static-resources[Static Resources] portion of the Spring Reference documentation.
|
||||
You can find details on how to do so in the {spring-framework-reference-url}web/webflux/config.html#webflux-config-static-resources[Static Resources] portion of the Spring Reference documentation.
|
||||
|
||||
If necessary, you can also disable Spring Security's cache control HTTP response headers.
|
||||
|
||||
|
||||
@@ -38,7 +38,7 @@ Gradle::
|
||||
[[servlet-hello-starting]]
|
||||
== Starting Hello Spring Security Boot
|
||||
|
||||
You can now https://docs.spring.io/spring-boot/docs/current/reference/htmlsingle/#using-boot-running-with-the-maven-plugin[run the Spring Boot application] by using the Maven Plugin's `run` goal.
|
||||
You can now {spring-boot-reference-url}reference/using/running-your-application.html#using.running-your-application.with-the-maven-plugin[run the Spring Boot application] by using the Maven Plugin's `run` goal.
|
||||
The following example shows how to do so (and the beginning of the output from doing so):
|
||||
|
||||
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
[[webflux-cors]]
|
||||
= CORS
|
||||
|
||||
Spring Framework provides https://docs.spring.io/spring/docs/current/spring-framework-reference/web-reactive.html#webflux-cors-intro[first class support for CORS].
|
||||
Spring Framework provides {spring-framework-reference-url}web/webflux-cors.html#webflux-cors-intro[first class support for CORS].
|
||||
CORS must be processed before Spring Security because the pre-flight request will not contain any cookies (i.e. the `JSESSIONID`).
|
||||
If the request does not contain any cookies and Spring Security is first, the request will determine the user is not authenticated (since there are no cookies in the request) and reject it.
|
||||
|
||||
|
||||
@@ -275,7 +275,7 @@ You can find more about this online and in the reference manual.
|
||||
It doesn't work - I just end up back at the login page after authenticating.
|
||||
|
||||
This happens because sessions created under HTTPS, for which the session cookie is marked as "`secure`", cannot subsequently be used under HTTP. The browser does not send the cookie back to the server, and any session state (including the security context information) is lost. Starting a session in HTTP first should work, as the session cookie is not marked as secure.
|
||||
However, Spring Security's https://docs.spring.io/spring-security/site/docs/3.1.x/reference/springsecurity-single.html#ns-session-fixation[Session Fixation Protection] can interfere with this because it results in a new session ID cookie being sent back to the user's browser, usually with the secure flag.
|
||||
However, Spring Security's xref:servlet/authentication/session-management.adoc#ns-session-fixation[Session Fixation Protection] can interfere with this because it results in a new session ID cookie being sent back to the user's browser, usually with the secure flag.
|
||||
To get around this, you can disable session fixation protection. However, in newer Servlet containers, you can also configure session cookies to never use the secure flag.
|
||||
|
||||
|
||||
@@ -703,7 +703,7 @@ You should also consult the {security-api-url}[Javadoc] for the relevant classes
|
||||
|
||||
The namespace functionality is intentionally limited, so it does not cover everything that you can do with plain beans.
|
||||
If you want to do something simple, such as modifying a bean or injecting a different dependency, you can do so by adding a `BeanPostProcessor` to your configuration.
|
||||
You can find more information in the https://docs.spring.io/spring/docs/3.0.x/spring-framework-reference/htmlsingle/spring-framework-reference.html#beans-factory-extension-bpp[Spring Reference Manual]. To do so, you need to know a bit about which beans are created, so you should also read the blog article mentioned in the earlier question on <<appendix-faq-namespace-to-bean-mapping,how the namespace maps to Spring beans>>.
|
||||
You can find more information in the {spring-framework-reference-url}core/beans/factory-extension.html#beans-factory-extension-bpp[Spring Reference Manual]. To do so, you need to know a bit about which beans are created, so you should also read the blog article mentioned in the earlier question on <<appendix-faq-namespace-to-bean-mapping,how the namespace maps to Spring beans>>.
|
||||
|
||||
Normally, you would add the functionality you require to the `postProcessBeforeInitialization` method of `BeanPostProcessor`. Suppose that you want to customize the `AuthenticationDetailsSource` used by the `UsernamePasswordAuthenticationFilter` (created by the `form-login` element). You want to extract a particular header called `CUSTOM_HEADER` from the request and use it while authenticating the user.
|
||||
The processor class would look like the following listing:
|
||||
|
||||
@@ -11,4 +11,4 @@ For example Tomcat uses the https://tomcat.apache.org/tomcat-10.1-doc/api/org/ap
|
||||
Alternatively, Spring 4.3+ users can leverage https://github.com/spring-projects/spring-framework/blob/v4.3.3.RELEASE/spring-web/src/main/java/org/springframework/web/filter/ForwardedHeaderFilter.java[ForwardedHeaderFilter].
|
||||
|
||||
Spring Boot users may use the `server.use-forward-headers` property to configure the application.
|
||||
See the https://docs.spring.io/spring-boot/docs/current/reference/htmlsingle/#howto.webserver.use-behind-a-proxy-server[Spring Boot documentation] for further details.
|
||||
See the {spring-boot-reference-url}how-to/webserver.html#howto.webserver.use-behind-a-proxy-server[Spring Boot documentation] for further details.
|
||||
|
||||
@@ -99,7 +99,7 @@ If you do not need this functionality, though, you can stick with `ROLE_ANONYMOU
|
||||
[[anonymous-auth-mvc-controller]]
|
||||
== Getting Anonymous Authentications with Spring MVC
|
||||
|
||||
https://docs.spring.io/spring-framework/docs/current/reference/html/web.html#mvc-ann-arguments[Spring MVC resolves parameters of type `Principal`] using its own argument resolver.
|
||||
{spring-framework-reference-url}web/webmvc/mvc-controller/ann-methods/arguments.html[Spring MVC resolves parameters of type `Principal`] using its own argument resolver.
|
||||
|
||||
This means that a construct like this one:
|
||||
|
||||
|
||||
@@ -27,7 +27,7 @@ image:{icondir}/number_4.png[] The browser requests the login page to which it w
|
||||
image:{icondir}/number_5.png[] Something within the application, must <<servlet-authentication-form-custom,render the login page>>.
|
||||
|
||||
[[servlet-authentication-usernamepasswordauthenticationfilter]]
|
||||
When the username and password are submitted, the `UsernamePasswordAuthenticationFilter` creates a `UsernamePasswordAuthenticationToken` which is a type of https://docs.spring.io/spring-security/reference/servlet/authentication/architecture.html#servlet-authentication-authentication[Authentication], by extracting the username and password from the `HttpServletRequest` instance.
|
||||
When the username and password are submitted, the `UsernamePasswordAuthenticationFilter` creates a `UsernamePasswordAuthenticationToken` which is a type of xref:servlet/authentication/architecture.adoc#servlet-authentication-authentication[Authentication], by extracting the username and password from the `HttpServletRequest` instance.
|
||||
The `UsernamePasswordAuthenticationFilter` extends xref:servlet/authentication/architecture.adoc#servlet-authentication-abstractprocessingfilter[AbstractAuthenticationProcessingFilter], so the following diagram should look pretty similar:
|
||||
|
||||
.Authenticating Username and Password
|
||||
|
||||
@@ -96,7 +96,7 @@ create table group_members (
|
||||
== Setting up a DataSource
|
||||
|
||||
Before we configure `JdbcUserDetailsManager`, we must create a `DataSource`.
|
||||
In our example, we set up an https://docs.spring.io/spring-framework/docs/current/spring-framework-reference/data-access.html#jdbc-embedded-database-support[embedded DataSource] that is initialized with the <<servlet-authentication-jdbc-schema,default user schema>>.
|
||||
In our example, we set up an {spring-framework-reference-url}data-access/jdbc/embedded-database-support.html[embedded DataSource] that is initialized with the <<servlet-authentication-jdbc-schema,default user schema>>.
|
||||
|
||||
.Embedded Data Source
|
||||
[tabs]
|
||||
|
||||
@@ -707,8 +707,8 @@ include-code::./TopLevelCustomizerBeanConfiguration[tag=headersCustomizer,indent
|
||||
[[customizer-bean-ordering]]
|
||||
=== Customizer Bean Ordering
|
||||
|
||||
First each xref:#httpsecurity-customizer-bean[Customizer<HttpSecurity> Bean] is applied using https://docs.spring.io/spring-framework/docs/current/javadoc-api/org/springframework/beans/factory/ObjectProvider.html#orderedStream()[ObjectProvider#orderedStream()].
|
||||
This means that if there are multiple `Customizer<HttpSecurity>` Beans, the https://docs.spring.io/spring-framework/docs/current/javadoc-api/org/springframework/core/annotation/Order.html[@Order] annotation can be added to the Bean definitions to control the ordering.
|
||||
First each xref:#httpsecurity-customizer-bean[Customizer<HttpSecurity> Bean] is applied using {spring-framework-api-url}org/springframework/beans/factory/ObjectProvider.html#orderedStream()[ObjectProvider#orderedStream()].
|
||||
This means that if there are multiple `Customizer<HttpSecurity>` Beans, the {spring-framework-api-url}org/springframework/core/annotation/Order.html[@Order] annotation can be added to the Bean definitions to control the ordering.
|
||||
|
||||
Next every xref:#top-level-customizer-bean[Top Level HttpSecurity Customizer Beans] type is looked up and each is applied using `ObjectProvider#orderedStream()`.
|
||||
If there is are two `Customizer<HeadersConfigurer<HttpSecurity>>` beans and two `Customizer<HttpsRedirectConfigurer<HttpSecurity>>` instances, the order that each `Customizer` type is invoked is undefined.
|
||||
|
||||
@@ -395,8 +395,8 @@ include-code::./TopLevelDslBeanConfiguration[tag=headersSecurity,indent=0]
|
||||
|
||||
First, all xref:servlet/configuration/java.adoc#modular-httpsecurity-configuration[Modular HttpSecurity Configuration] is applied since the Kotlin Dsl uses an `HttpSecurity` Bean.
|
||||
|
||||
Second, each xref:#httpsecuritydsl-bean[HttpSecurityDsl.() -> Unit Beans] is applied using https://docs.spring.io/spring-framework/docs/current/javadoc-api/org/springframework/beans/factory/ObjectProvider.html#orderedStream()[ObjectProvider#orderedStream()].
|
||||
This means that if there are multiple `HttpSecurity.() -> Unit` Beans, the https://docs.spring.io/spring-framework/docs/current/javadoc-api/org/springframework/core/annotation/Order.html[@Order] annotation can be added to the Bean definitions to control the ordering.
|
||||
Second, each xref:#httpsecuritydsl-bean[HttpSecurityDsl.() -> Unit Beans] is applied using {spring-framework-api-url}org/springframework/beans/factory/ObjectProvider.html#orderedStream()[ObjectProvider#orderedStream()].
|
||||
This means that if there are multiple `HttpSecurity.() -> Unit` Beans, the {spring-framework-api-url}org/springframework/core/annotation/Order.html[@Order] annotation can be added to the Bean definitions to control the ordering.
|
||||
|
||||
Next, every xref:#top-level-dsl-bean[Top Level Security Dsl Beans] type is looked up and each is is applied using `ObjectProvider#orderedStream()`.
|
||||
If there is are different types of top level security Beans (e.g. `HeadersDsl.() -> Unit` and `HttpsRedirectDsl.() -> Unit`), then the order that each Dsl type is invoked is undefined.
|
||||
|
||||
@@ -5,7 +5,7 @@
|
||||
|
||||
Namespace configuration has been available since version 2.0 of the Spring Framework.
|
||||
It lets you supplement the traditional Spring beans application context syntax with elements from additional XML schema.
|
||||
You can find more information in the Spring https://docs.spring.io/spring/docs/current/spring-framework-reference/htmlsingle/[Reference Documentation].
|
||||
You can find more information in the Spring {spring-framework-reference-url}index.html[Reference Documentation].
|
||||
You can use a namespace element to more concisely configure an individual bean or, more powerfully, to define an alternative configuration syntax that more closely matches the problem domain and hides the underlying complexity from the user.
|
||||
A simple element can conceal the fact that multiple beans and processing steps are being added to the application context.
|
||||
For example, adding the following element from the `security` namespace to an application context starts up an embedded LDAP server for testing use within the application:
|
||||
|
||||
@@ -708,8 +708,8 @@ For example, the rendered HTML might look like:
|
||||
|
||||
The following view technologies automatically include the actual CSRF token in a form that has an unsafe HTTP method, such as a POST:
|
||||
|
||||
* https://docs.spring.io/spring/docs/current/spring-framework-reference/web.html#mvc-view-jsp-formtaglib[Spring’s form tag library]
|
||||
* https://www.thymeleaf.org/doc/tutorials/2.1/thymeleafspring.html#integration-with-requestdatavalueprocessor[Thymeleaf]
|
||||
* {spring-framework-reference-url}web/webmvc-view/mvc-jsp.html#mvc-view-jsp-formtaglib[Spring’s form tag library]
|
||||
* https://www.thymeleaf.org/doc/tutorials/3.1/thymeleafspring.html#integration-with-requestdatavalueprocessor[Thymeleaf]
|
||||
* Any other view technology that integrates with {spring-framework-api-url}org/springframework/web/servlet/support/RequestDataValueProcessor.html[`RequestDataValueProcessor`] (via javadoc:org.springframework.security.web.servlet.support.csrf.CsrfRequestDataValueProcessor[])
|
||||
* You can also include the token yourself via the xref:servlet/integrations/jsp-taglibs.adoc#taglibs-csrfinput[csrfInput] tag
|
||||
|
||||
@@ -1445,7 +1445,7 @@ If JavaScript is not available, the following sections discuss options for placi
|
||||
|
||||
[NOTE]
|
||||
====
|
||||
You can find more information about using multipart forms with Spring in the https://docs.spring.io/spring-framework/docs/current/reference/html/web.html#mvc-multipart[Multipart Resolver] section of the Spring reference and the {spring-framework-api-url}org/springframework/web/multipart/support/MultipartFilter.html[`MultipartFilter` javadoc].
|
||||
You can find more information about using multipart forms with Spring in the {spring-framework-reference-url}web/webmvc/mvc-servlet/multipart.html[Multipart Resolver] section of the Spring reference and the {spring-framework-api-url}org/springframework/web/multipart/support/MultipartFilter.html[`MultipartFilter` javadoc].
|
||||
====
|
||||
|
||||
[[csrf-considerations-multipart-body]]
|
||||
@@ -1535,7 +1535,7 @@ The following example does this with a JSP:
|
||||
We have xref:features/exploits/csrf.adoc#csrf-considerations-multipart-body[already discussed] the trade-offs of placing the CSRF token in the body.
|
||||
|
||||
In Spring's Servlet support, overriding the HTTP method is done by using {spring-framework-api-url}org/springframework/web/filter/reactive/HiddenHttpMethodFilter.html[`HiddenHttpMethodFilter`].
|
||||
You can find more information in the https://docs.spring.io/spring/docs/current/spring-framework-reference/web.html#mvc-rest-method-conversion[HTTP Method Conversion] section of the reference documentation.
|
||||
You can find more information in the {spring-framework-reference-url}web/webmvc-view/mvc-jsp.html#mvc-rest-method-conversion[HTTP Method Conversion] section of the reference documentation.
|
||||
|
||||
[[csrf-further-reading]]
|
||||
== Further Reading
|
||||
|
||||
@@ -207,7 +207,7 @@ However, if you actually want to cache specific responses, your application can
|
||||
You can use this to ensure that content (such as CSS, JavaScript, and images) is properly cached.
|
||||
|
||||
When you use Spring Web MVC, this is typically done within your configuration.
|
||||
You can find details on how to do this in the https://docs.spring.io/spring/docs/5.0.0.RELEASE/spring-framework-reference/web.html#mvc-config-static-resources[Static Resources] portion of the Spring Reference documentation
|
||||
You can find details on how to do this in the {spring-framework-reference-url}web/webmvc/mvc-config/static-resources.html[Static Resources] portion of the Spring Reference documentation
|
||||
|
||||
If necessary, you can also disable Spring Security's cache control HTTP response headers.
|
||||
|
||||
@@ -1157,7 +1157,7 @@ public class WebSecurityConfig {
|
||||
|
||||
XML::
|
||||
+
|
||||
[source,xml,role="secondary"]
|
||||
[source,xml,role="secondary",subs="+attributes"]
|
||||
----
|
||||
<http>
|
||||
<!-- ... -->
|
||||
@@ -1167,7 +1167,7 @@ XML::
|
||||
</headers>
|
||||
</http>
|
||||
<!-- Requires the c-namespace.
|
||||
See https://docs.spring.io/spring/docs/current/spring-framework-reference/htmlsingle/#beans-c-namespace
|
||||
See {spring-framework-reference-url}core/beans/dependencies/factory-properties-detailed.html#beans-c-namespace
|
||||
-->
|
||||
<beans:bean id="frameOptionsWriter"
|
||||
class="org.springframework.security.web.header.writers.frameoptions.XFrameOptionsHeaderWriter"
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
[[cors]]
|
||||
= CORS
|
||||
|
||||
Spring Framework provides https://docs.spring.io/spring/docs/current/spring-framework-reference/web.html#mvc-cors[first class support for CORS].
|
||||
Spring Framework provides {spring-framework-reference-url}web/webmvc-cors.html[first class support for CORS].
|
||||
CORS must be processed before Spring Security, because the pre-flight request does not contain any cookies (that is, the `JSESSIONID`).
|
||||
If the request does not contain any cookies and Spring Security is first, the request determines that the user is not authenticated (since there are no cookies in the request) and rejects it.
|
||||
|
||||
|
||||
@@ -12,7 +12,7 @@ To enable Spring Security integration with Spring MVC, add the `@EnableWebSecuri
|
||||
|
||||
[NOTE]
|
||||
====
|
||||
Spring Security provides the configuration by using Spring MVC's https://docs.spring.io/spring/docs/5.0.0.RELEASE/spring-framework-reference/web.html#mvc-config-customize[`WebMvcConfigurer`].
|
||||
Spring Security provides the configuration by using Spring MVC's {spring-framework-reference-url}web/webmvc/mvc-config/customize.html[`WebMvcConfigurer`].
|
||||
This means that, if you use more advanced options, such as integrating with `WebMvcConfigurationSupport` directly, you need to manually provide the Spring Security configuration.
|
||||
====
|
||||
|
||||
@@ -184,7 +184,7 @@ class CustomUserUserDetails(
|
||||
----
|
||||
======
|
||||
|
||||
We could then access the `CustomUser` by using a https://docs.spring.io/spring/docs/current/spring-framework-reference/html/expressions.html[SpEL expression] that uses `Authentication.getPrincipal()` as the root object:
|
||||
We could then access the `CustomUser` by using a {spring-framework-reference-url}core/expressions.html[SpEL expression] that uses `Authentication.getPrincipal()` as the root object:
|
||||
|
||||
[tabs]
|
||||
======
|
||||
@@ -517,7 +517,7 @@ fun me(@CurrentSecurityContext(expression = "authentication") authentication: Au
|
||||
[[mvc-async]]
|
||||
== Spring MVC Async Integration
|
||||
|
||||
Spring Web MVC 3.2+ has excellent support for https://docs.spring.io/spring/docs/3.2.x/spring-framework-reference/html/mvc.html#mvc-ann-async[Asynchronous Request Processing].
|
||||
Spring Web MVC 3.2+ has excellent support for {spring-framework-reference-url}web/webmvc/mvc-ann-async.html[Asynchronous Request Processing].
|
||||
With no additional configuration, Spring Security automatically sets up the `SecurityContext` to the `Thread` that invokes a `Callable` returned by your controllers.
|
||||
For example, the following method automatically has its `Callable` invoked with the `SecurityContext` that was available when the `Callable` was created:
|
||||
|
||||
@@ -572,7 +572,7 @@ Spring Security integrates with Spring MVC to add CSRF protection.
|
||||
|
||||
=== Automatic Token Inclusion
|
||||
|
||||
Spring Security automatically xref:servlet/exploits/csrf.adoc#csrf-integration-form[include the CSRF Token] within forms that use the https://docs.spring.io/spring/docs/3.2.x/spring-framework-reference/html/view.html#view-jsp-formtaglib-formtag[Spring MVC form tag].
|
||||
Spring Security automatically xref:servlet/exploits/csrf.adoc#csrf-integration-form[include the CSRF Token] within forms that use the {spring-framework-reference-url}web/webmvc-view/mvc-jsp.html#mvc-view-jsp-formtaglib-formtag[Spring MVC form tag].
|
||||
Consider the following JSP:
|
||||
|
||||
[source,xml]
|
||||
|
||||
@@ -1,14 +1,15 @@
|
||||
[[websocket]]
|
||||
= WebSocket Security
|
||||
|
||||
Spring Security 4 added support for securing https://docs.spring.io/spring/docs/current/spring-framework-reference/html/websocket.html[Spring's WebSocket support].
|
||||
Spring Security 4 added support for securing {spring-framework-reference-url}web/websocket.html[Spring's WebSocket support].
|
||||
This section describes how to use Spring Security's WebSocket support.
|
||||
|
||||
.Direct JSR-356 Support
|
||||
****
|
||||
Spring Security does not provide direct JSR-356 support, because doing so would provide little value.
|
||||
This is because the format is unknown, and there is https://docs.spring.io/spring/docs/current/spring-framework-reference/html/websocket.html#websocket-intro-sub-protocol[little Spring can do to secure an unknown format].
|
||||
Additionally, JSR-356 does not provide a way to intercept messages, so security would be invasive.
|
||||
|
||||
Spring Framework provides support for using STOMP — a simple, messaging protocol originally created for use in scripting languages with frames inspired by HTTP. STOMP is widely supported and well suited for use over WebSocket and over the web. For more details, see {spring-framework-reference-url}web/websocket/stomp.html[here].
|
||||
****
|
||||
|
||||
[[websocket-authentication]]
|
||||
@@ -295,7 +296,7 @@ Consider a chat application:
|
||||
While we want clients to be able to `SUBSCRIBE` to `/topic/system/notifications`, we do not want to enable them to send a `MESSAGE` to that destination.
|
||||
If we allowed sending a `MESSAGE` to `/topic/system/notifications`, clients could send a message directly to that endpoint and impersonate the system.
|
||||
|
||||
In general, it is common for applications to deny any `MESSAGE` sent to a destination that starts with the https://docs.spring.io/spring/docs/current/spring-framework-reference/html/websocket.html#websocket-stomp[broker prefix] (`/topic/` or `/queue/`).
|
||||
In general, it is common for applications to deny any `MESSAGE` sent to a destination that starts with the {spring-framework-reference-url}web/websocket/stomp.html[broker prefix] (`/topic/` or `/queue/`).
|
||||
|
||||
[[websocket-authorization-notes-destinations]]
|
||||
==== WebSocket Authorization on Destinations
|
||||
@@ -312,14 +313,14 @@ Consider a chat application:
|
||||
With this chat application, we want to let our client to listen `/user/queue`, which is transformed into `/queue/user/messages-<sessionid>`.
|
||||
However, we do not want the client to be able to listen to `/queue/*`, because that would let the client see messages for every user.
|
||||
|
||||
In general, it is common for applications to deny any `SUBSCRIBE` sent to a message that starts with the https://docs.spring.io/spring/docs/current/spring-framework-reference/html/websocket.html#websocket-stomp[broker prefix] (`/topic/` or `/queue/`).
|
||||
In general, it is common for applications to deny any `SUBSCRIBE` sent to a message that starts with the {spring-framework-reference-url}web/websocket/stomp.html[broker prefix] (`/topic/` or `/queue/`).
|
||||
We may provide exceptions to account for things like
|
||||
//FIXME: Like what?
|
||||
|
||||
[[websocket-authorization-notes-outbound]]
|
||||
=== Outbound Messages
|
||||
|
||||
The Spring Framework reference documentation contains a section titled https://docs.spring.io/spring/docs/current/spring-framework-reference/html/websocket.html#websocket-stomp-message-flow["`Flow of Messages`"] that describes how messages flow through the system.
|
||||
The Spring Framework reference documentation contains a section titled {spring-framework-reference-url}web/websocket/stomp/message-flow.html["`Flow of Messages`"] that describes how messages flow through the system.
|
||||
Note that Spring Security secures only the `clientInboundChannel`.
|
||||
Spring Security does not attempt to secure the `clientOutboundChannel`.
|
||||
|
||||
@@ -351,7 +352,7 @@ This means that developers need to explicitly protect their applications from ex
|
||||
[[websocket-sameorigin-spring]]
|
||||
=== Spring WebSocket Allowed Origin
|
||||
|
||||
Fortunately, since Spring 4.1.5 Spring's WebSocket and SockJS support restricts access to the https://docs.spring.io/spring/docs/current/spring-framework-reference/html/websocket.html#websocket-server-allowed-origins[current domain].
|
||||
Fortunately, since Spring 4.1.5 Spring's WebSocket and SockJS support restricts access to the {spring-framework-reference-url}web/websocket/server.html#websocket-server-allowed-origins[current domain].
|
||||
Spring Security adds an additional layer of protection to provide https://en.wikipedia.org/wiki/Defence_in_depth_(non-military)#Information_security[defense in depth].
|
||||
|
||||
[[websocket-sameorigin-csrf]]
|
||||
@@ -529,7 +530,7 @@ If you are migrating from a legacy usage of `websocket-message-broker` that impl
|
||||
[[websocket-sockjs]]
|
||||
== Working with SockJS
|
||||
|
||||
https://docs.spring.io/spring/docs/current/spring-framework-reference/html/websocket.html#websocket-fallback[SockJS] provides fallback transports to support older browsers.
|
||||
{spring-framework-reference-url}web/websocket/fallback.html[SockJS] provides fallback transports to support older browsers.
|
||||
When using the fallback options, we need to relax a few security constraints to allow SockJS to work with Spring Security.
|
||||
|
||||
[[websocket-sockjs-sameorigin]]
|
||||
|
||||
@@ -38,7 +38,7 @@ implementation "org.springframework.boot:spring-boot-starter-oauth2-authorizatio
|
||||
----
|
||||
======
|
||||
|
||||
TIP: See https://docs.spring.io/spring-boot/docs/current/reference/html/getting-started.html#getting-started.installing[Installing Spring Boot] for more information on using Spring Boot with Maven or Gradle.
|
||||
TIP: See {spring-boot-reference-url}installing.html[Installing Spring Boot] for more information on using Spring Boot with Maven or Gradle.
|
||||
|
||||
Alternatively, you can add Spring Security Authorization Server without Spring Boot using the following example:
|
||||
|
||||
|
||||
@@ -1,6 +1,5 @@
|
||||
[[oauth2-client-authorization-grants]]
|
||||
= [[oauth2Client-auth-grant-support]]Authorization Grant Support
|
||||
:spring-security-reference-base-url: https://docs.spring.io/spring-security/reference
|
||||
|
||||
This section describes Spring Security's support for authorization grants.
|
||||
|
||||
|
||||
Reference in New Issue
Block a user