From 89260a3a9c6149c0acaa878c21d0d4f02e05aa1e Mon Sep 17 00:00:00 2001 From: Tran Ngoc Nhan Date: Sun, 22 Feb 2026 21:38:17 +0700 Subject: [PATCH] Use reference links from attributes Signed-off-by: Tran Ngoc Nhan --- .../features/authentication/password-storage.adoc | 2 +- .../ROOT/pages/features/exploits/csrf.adoc | 4 ++-- .../ROOT/pages/features/exploits/http.adoc | 4 ++-- docs/modules/ROOT/pages/index.adoc | 2 +- docs/modules/ROOT/pages/native-image/index.adoc | 4 ++-- .../ROOT/pages/native-image/method-security.adoc | 6 +++--- .../pages/reactive/configuration/webflux.adoc | 4 ++-- .../ROOT/pages/reactive/exploits/csrf.adoc | 6 +++--- .../ROOT/pages/reactive/exploits/headers.adoc | 4 ++-- .../ROOT/pages/reactive/getting-started.adoc | 2 +- .../ROOT/pages/reactive/integrations/cors.adoc | 2 +- docs/modules/ROOT/pages/servlet/appendix/faq.adoc | 4 ++-- .../ROOT/pages/servlet/appendix/proxy-server.adoc | 2 +- .../pages/servlet/authentication/anonymous.adoc | 2 +- .../servlet/authentication/passwords/form.adoc | 2 +- .../servlet/authentication/passwords/jdbc.adoc | 2 +- .../ROOT/pages/servlet/configuration/java.adoc | 4 ++-- .../ROOT/pages/servlet/configuration/kotlin.adoc | 4 ++-- .../servlet/configuration/xml-namespace.adoc | 2 +- .../modules/ROOT/pages/servlet/exploits/csrf.adoc | 8 ++++---- .../ROOT/pages/servlet/exploits/headers.adoc | 6 +++--- .../ROOT/pages/servlet/integrations/cors.adoc | 2 +- .../ROOT/pages/servlet/integrations/mvc.adoc | 8 ++++---- .../pages/servlet/integrations/websocket.adoc | 15 ++++++++------- .../authorization-server/getting-started.adoc | 2 +- .../oauth2/client/authorization-grants.adoc | 1 - 26 files changed, 52 insertions(+), 52 deletions(-) diff --git a/docs/modules/ROOT/pages/features/authentication/password-storage.adoc b/docs/modules/ROOT/pages/features/authentication/password-storage.adoc index 9bcf4ad398..fb04835e83 100644 --- a/docs/modules/ROOT/pages/features/authentication/password-storage.adoc +++ b/docs/modules/ROOT/pages/features/authentication/password-storage.adoc @@ -167,7 +167,7 @@ For production, you should <>: diff --git a/docs/modules/ROOT/pages/features/exploits/csrf.adoc b/docs/modules/ROOT/pages/features/exploits/csrf.adoc index 553719407b..046df793a3 100644 --- a/docs/modules/ROOT/pages/features/exploits/csrf.adoc +++ b/docs/modules/ROOT/pages/features/exploits/csrf.adoc @@ -175,7 +175,7 @@ A server can specify the `SameSite` attribute when setting a cookie to indicate ==== Spring Security does not directly control the creation of the session cookie, so it does not provide support for the SameSite attribute. https://spring.io/projects/spring-session[Spring Session] provides support for the `SameSite` attribute in servlet-based applications. -Spring Framework's https://docs.spring.io/spring-framework/docs/current/javadoc-api/org/springframework/web/server/session/CookieWebSessionIdResolver.html[`CookieWebSessionIdResolver`] provides out of the box support for the `SameSite` attribute in WebFlux-based applications. +Spring Framework's {spring-framework-api-url}org/springframework/web/server/session/CookieWebSessionIdResolver.html[`CookieWebSessionIdResolver`] provides out of the box support for the `SameSite` attribute in WebFlux-based applications. ==== An example, of an HTTP response header with the `SameSite` attribute might look like: @@ -348,7 +348,7 @@ Each option has its trade-offs. [NOTE] ==== Before you integrate Spring Security's CSRF protection with multipart file upload, you should first ensure that you can upload without the CSRF protection. -More information about using multipart forms with Spring, see the https://docs.spring.io/spring/docs/5.2.x/spring-framework-reference/web.html#mvc-multipart[1.1.11. Multipart Resolver] section of the Spring reference and the https://docs.spring.io/spring/docs/5.2.x/javadoc-api/org/springframework/web/multipart/support/MultipartFilter.html[`MultipartFilter` Javadoc]. +More information about using multipart forms with Spring, see the {spring-framework-reference-url}web/webmvc/mvc-servlet/multipart.html[Multipart Resolver] section of the Spring reference and the {spring-framework-api-url}org/springframework/web/multipart/support/MultipartFilter.html[`MultipartFilter` Javadoc]. ==== [[csrf-considerations-multipart-header]] diff --git a/docs/modules/ROOT/pages/features/exploits/http.adoc b/docs/modules/ROOT/pages/features/exploits/http.adoc index 0c38dee72b..c091c6e05b 100644 --- a/docs/modules/ROOT/pages/features/exploits/http.adoc +++ b/docs/modules/ROOT/pages/features/exploits/http.adoc @@ -26,7 +26,7 @@ Without proper configuration, the application server can not know that the load To fix this, you can use https://tools.ietf.org/html/rfc7239[RFC 7239] to specify that a load balancer is being used. To make the application aware of this, you need to configure your application server to be aware of the X-Forwarded headers. For example, Tomcat uses https://tomcat.apache.org/tomcat-10.1-doc/api/org/apache/catalina/valves/RemoteIpValve.html[`RemoteIpValve`] and Jetty uses https://eclipse.dev/jetty/javadoc/jetty-11/org/eclipse/jetty/server/ForwardedRequestCustomizer.html[`ForwardedRequestCustomizer`]. -Alternatively, Spring users can use https://docs.spring.io/spring-framework/reference/web/webmvc/filters.html#filters-forwarded-headers[`ForwardedHeaderFilter`] with the Servlet stack or https://docs.spring.io/spring-framework/reference/web/webflux/reactive-spring.html#webflux-forwarded-headers[`ForwardedHeaderTransformer`] with the Reactive stack. +Alternatively, Spring users can use {spring-framework-reference-url}web/webmvc/filters.html#filters-forwarded-headers[`ForwardedHeaderFilter`] with the Servlet stack or {spring-framework-reference-url}web/webflux/reactive-spring.html#webflux-forwarded-headers[`ForwardedHeaderTransformer`] with the Reactive stack. Spring Boot users can use the `server.forward-headers-strategy` property to configure the application. -See the https://docs.spring.io/spring-boot/docs/current/reference/htmlsingle/#howto.webserver.use-behind-a-proxy-server[Spring Boot documentation] for further details. +See the {spring-boot-reference-url}how-to/webserver.html#howto.webserver.use-behind-a-proxy-server[Spring Boot documentation] for further details. diff --git a/docs/modules/ROOT/pages/index.adoc b/docs/modules/ROOT/pages/index.adoc index 0210ebdc81..f5f4a631ed 100644 --- a/docs/modules/ROOT/pages/index.adoc +++ b/docs/modules/ROOT/pages/index.adoc @@ -17,6 +17,6 @@ If you are ready to start securing an application see the Getting Started sectio If you want to understand how Spring Security works, you can refer to the xref:servlet/architecture.adoc[Architecture] section. // FIXME add link to reactive architecture -If you are already familiar with Spring Security or are upgrading, check out https://docs.spring.io/spring-security/reference/whats-new.html[what's new in the latest release]. +If you are already familiar with Spring Security or are upgrading, check out xref:whats-new.adoc[what's new in the latest release]. If you have any questions, there is a wonderful xref:community.adoc[community] that would love to help you! diff --git a/docs/modules/ROOT/pages/native-image/index.adoc b/docs/modules/ROOT/pages/native-image/index.adoc index 953c6e55eb..ac246a7675 100644 --- a/docs/modules/ROOT/pages/native-image/index.adoc +++ b/docs/modules/ROOT/pages/native-image/index.adoc @@ -1,8 +1,8 @@ = GraalVM Native Image Support -Spring Boot 3.0 provides https://docs.spring.io/spring-boot/docs/current/reference/html/native-image.html#native-image.introducing-graalvm-native-images[support for generating native images with GraalVM]. +Spring Boot 3.0 provides {spring-boot-reference-url}reference/packaging/native-image/introducing-graalvm-native-images.html[support for generating native images with GraalVM]. Spring Security integrates with that support and provides its features ready for native images. -However, as mentioned in the https://docs.spring.io/spring-boot/docs/current/reference/html/native-image.html#native-image.introducing-graalvm-native-images.understanding-aot-processing.hint-file-generation[Spring Boot documentation], there are some cases where we need to provide hints to be used by GraalVM. +However, as mentioned in the {spring-boot-reference-url}reference/packaging/native-image/introducing-graalvm-native-images.html#packaging.native-image.introducing-graalvm-native-images.understanding-aot-processing[Spring Boot documentation], there are some cases where we need to provide hints to be used by GraalVM. This section aims to provide guidance in some Spring Security features that likely need to have additional hints provided by the application. diff --git a/docs/modules/ROOT/pages/native-image/method-security.adoc b/docs/modules/ROOT/pages/native-image/method-security.adoc index 59062bae25..313fa4fad4 100644 --- a/docs/modules/ROOT/pages/native-image/method-security.adoc +++ b/docs/modules/ROOT/pages/native-image/method-security.adoc @@ -44,7 +44,7 @@ public String hello() { Remember that you need to xref:servlet/authorization/method-security.adoc#jc-enable-method-security[add `@EnableMethodSecurity` annotation] to your configuration class to enable method security annotations. ==== -If you https://docs.spring.io/spring-boot/docs/current/reference/html/native-image.html#native-image.developing-your-first-application[run the native image] of your application with the above configuration, you will get an error similar to the following when trying to invoke the `hello()` method: +If you {spring-boot-reference-url}how-to/native-image/developing-your-first-application.html[run the native image] of your application with the above configuration, you will get an error similar to the following when trying to invoke the `hello()` method: [source] ---- @@ -56,8 +56,8 @@ Which means that the `isAdmin()` method cannot be found on the `CustomUserDetail This is because Spring Security uses reflection to invoke the `isAdmin()` method and GraalVM Native Image does not support reflection by default. To fix this issue, you need to give hints to GraalVM Native Image to allow reflection on the `CustomUserDetails#isAdmin()` method. -We can do that by providing a https://docs.spring.io/spring-boot/docs/current/reference/html/native-image.html#native-image.advanced.custom-hints[custom hint]. -In this example we are going to use {spring-framework-reference-url}core.html#core.aot.hints.register-reflection-for-binding[the `@RegisterReflectionForBinding` annotation]. +We can do that by providing a {spring-boot-reference-url}reference/packaging/native-image/advanced-topics.html#packaging.native-image.advanced.custom-hints[custom hint]. +In this example we are going to use {spring-framework-reference-url}core/aot.html#aot.hints.register-reflection[the `@RegisterReflectionForBinding` annotation]. [NOTE] ==== diff --git a/docs/modules/ROOT/pages/reactive/configuration/webflux.adoc b/docs/modules/ROOT/pages/reactive/configuration/webflux.adoc index 7383a1cddb..d150a9340b 100644 --- a/docs/modules/ROOT/pages/reactive/configuration/webflux.adoc +++ b/docs/modules/ROOT/pages/reactive/configuration/webflux.adoc @@ -288,8 +288,8 @@ include-code::./TopLevelCustomizerBeanConfiguration[tag=headersCustomizer,indent [[customizer-bean-ordering]] === Customizer Bean Ordering -First each xref:#httpsecurity-customizer-bean[Customizer Bean] is applied using https://docs.spring.io/spring-framework/docs/current/javadoc-api/org/springframework/beans/factory/ObjectProvider.html#orderedStream()[ObjectProvider#orderedStream()]. -This means that if there are multiple `Customizer` Beans, the https://docs.spring.io/spring-framework/docs/current/javadoc-api/org/springframework/core/annotation/Order.html[@Order] annotation can be added to the Bean definitions to control the ordering. +First each xref:#httpsecurity-customizer-bean[Customizer Bean] is applied using {spring-framework-api-url}org/springframework/beans/factory/ObjectProvider.html#orderedStream()[ObjectProvider#orderedStream()]. +This means that if there are multiple `Customizer` Beans, the {spring-framework-api-url}org/springframework/core/annotation/Order.html[@Order] annotation can be added to the Bean definitions to control the ordering. Next every xref:#top-level-customizer-bean[Top Level HttpSecurity Customizer Beans] type is looked up and each is is applied using `ObjectProvider#orderedStream()`. If there is are two `Customizer>` beans and two `Customizer>` instances, the order that each `Customizer` type is invoked is undefined. diff --git a/docs/modules/ROOT/pages/reactive/exploits/csrf.adoc b/docs/modules/ROOT/pages/reactive/exploits/csrf.adoc index 121ae713d9..2ee48a1c61 100644 --- a/docs/modules/ROOT/pages/reactive/exploits/csrf.adoc +++ b/docs/modules/ROOT/pages/reactive/exploits/csrf.adoc @@ -224,7 +224,7 @@ Next, we discuss various ways of including the CSRF token in a form as a hidden [[webflux-csrf-include-form-auto]] ===== Automatic CSRF Token Inclusion -Spring Security's CSRF support provides integration with Spring's https://docs.spring.io/spring/docs/current/javadoc-api/org/springframework/web/reactive/result/view/RequestDataValueProcessor.html[`RequestDataValueProcessor`] through its javadoc:org.springframework.security.web.reactive.result.view.CsrfRequestDataValueProcessor[]. +Spring Security's CSRF support provides integration with Spring's {spring-framework-api-url}org/springframework/web/reactive/result/view/RequestDataValueProcessor.html[`RequestDataValueProcessor`] through its javadoc:org.springframework.security.web.reactive.result.view.CsrfRequestDataValueProcessor[]. For `CsrfRequestDataValueProcessor` to work, the `Mono` must be subscribed to and the `CsrfToken` must be <> that matches javadoc:org.springframework.security.web.reactive.result.view.CsrfRequestDataValueProcessor#DEFAULT_CSRF_ATTR_NAME[]. Fortunately, Thymeleaf https://www.thymeleaf.org/doc/tutorials/2.1/thymeleafspring.html#integration-with-requestdatavalueprocessor[takes care of all the boilerplate] for you by integrating with `RequestDataValueProcessor` to ensure that forms that have an unsafe HTTP method (POST) automatically include the actual CSRF token. @@ -396,7 +396,7 @@ If JavaScript is not available, this section discusses how to place the CSRF tok [NOTE] ==== -For more information about using multipart forms with Spring, see the https://docs.spring.io/spring/docs/5.2.x/spring-framework-reference/web-reactive.html#webflux-multipart[Multipart Data] section of the Spring reference. +For more information about using multipart forms with Spring, see the {spring-framework-reference-url}web/webflux/reactive-spring.html#webflux-multipart[Multipart Data] section of the Spring reference. ==== [[webflux-csrf-considerations-multipart-body]] @@ -457,4 +457,4 @@ An example with Thymeleaf is shown below: === HiddenHttpMethodFilter We have xref:features/exploits/csrf.adoc#csrf-considerations-override-method[already discussed] overriding the HTTP method. -In a Spring WebFlux application, overriding the HTTP method is done by using https://docs.spring.io/spring-framework/docs/5.2.x/javadoc-api/org/springframework/web/filter/reactive/HiddenHttpMethodFilter.html[`HiddenHttpMethodFilter`]. +In a Spring WebFlux application, overriding the HTTP method is done by using {spring-framework-api-url}org/springframework/web/filter/reactive/HiddenHttpMethodFilter.html[`HiddenHttpMethodFilter`]. diff --git a/docs/modules/ROOT/pages/reactive/exploits/headers.adoc b/docs/modules/ROOT/pages/reactive/exploits/headers.adoc index aed6658032..49827562df 100644 --- a/docs/modules/ROOT/pages/reactive/exploits/headers.adoc +++ b/docs/modules/ROOT/pages/reactive/exploits/headers.adoc @@ -93,11 +93,11 @@ fun webFilterChain(http: ServerHttpSecurity): SecurityWebFilterChain { Spring Security includes xref:features/exploits/headers.adoc#headers-cache-control[Cache Control] headers by default. -However, if you actually want to cache specific responses, your application can selectively add them to the https://docs.spring.io/spring-framework/docs/current/javadoc-api/org/springframework/http/server/reactive/ServerHttpResponse.html[`ServerHttpResponse`] to override the header set by Spring Security. +However, if you actually want to cache specific responses, your application can selectively add them to the {spring-framework-api-url}org/springframework/http/server/reactive/ServerHttpResponse.html[`ServerHttpResponse`] to override the header set by Spring Security. This is useful to ensure that such things as CSS, JavaScript, and images are properly cached. When using Spring WebFlux, you typically do so within your configuration. -You can find details on how to do so in the https://docs.spring.io/spring/docs/5.0.0.RELEASE/spring-framework-reference/web-reactive.html#webflux-config-static-resources[Static Resources] portion of the Spring Reference documentation. +You can find details on how to do so in the {spring-framework-reference-url}web/webflux/config.html#webflux-config-static-resources[Static Resources] portion of the Spring Reference documentation. If necessary, you can also disable Spring Security's cache control HTTP response headers. diff --git a/docs/modules/ROOT/pages/reactive/getting-started.adoc b/docs/modules/ROOT/pages/reactive/getting-started.adoc index be6a4c3d3c..4a83751e10 100644 --- a/docs/modules/ROOT/pages/reactive/getting-started.adoc +++ b/docs/modules/ROOT/pages/reactive/getting-started.adoc @@ -38,7 +38,7 @@ Gradle:: [[servlet-hello-starting]] == Starting Hello Spring Security Boot -You can now https://docs.spring.io/spring-boot/docs/current/reference/htmlsingle/#using-boot-running-with-the-maven-plugin[run the Spring Boot application] by using the Maven Plugin's `run` goal. +You can now {spring-boot-reference-url}reference/using/running-your-application.html#using.running-your-application.with-the-maven-plugin[run the Spring Boot application] by using the Maven Plugin's `run` goal. The following example shows how to do so (and the beginning of the output from doing so): diff --git a/docs/modules/ROOT/pages/reactive/integrations/cors.adoc b/docs/modules/ROOT/pages/reactive/integrations/cors.adoc index 7efedc2dc6..c524a9fc91 100644 --- a/docs/modules/ROOT/pages/reactive/integrations/cors.adoc +++ b/docs/modules/ROOT/pages/reactive/integrations/cors.adoc @@ -1,7 +1,7 @@ [[webflux-cors]] = CORS -Spring Framework provides https://docs.spring.io/spring/docs/current/spring-framework-reference/web-reactive.html#webflux-cors-intro[first class support for CORS]. +Spring Framework provides {spring-framework-reference-url}web/webflux-cors.html#webflux-cors-intro[first class support for CORS]. CORS must be processed before Spring Security because the pre-flight request will not contain any cookies (i.e. the `JSESSIONID`). If the request does not contain any cookies and Spring Security is first, the request will determine the user is not authenticated (since there are no cookies in the request) and reject it. diff --git a/docs/modules/ROOT/pages/servlet/appendix/faq.adoc b/docs/modules/ROOT/pages/servlet/appendix/faq.adoc index 438082ac14..4ea4773148 100644 --- a/docs/modules/ROOT/pages/servlet/appendix/faq.adoc +++ b/docs/modules/ROOT/pages/servlet/appendix/faq.adoc @@ -275,7 +275,7 @@ You can find more about this online and in the reference manual. It doesn't work - I just end up back at the login page after authenticating. This happens because sessions created under HTTPS, for which the session cookie is marked as "`secure`", cannot subsequently be used under HTTP. The browser does not send the cookie back to the server, and any session state (including the security context information) is lost. Starting a session in HTTP first should work, as the session cookie is not marked as secure. -However, Spring Security's https://docs.spring.io/spring-security/site/docs/3.1.x/reference/springsecurity-single.html#ns-session-fixation[Session Fixation Protection] can interfere with this because it results in a new session ID cookie being sent back to the user's browser, usually with the secure flag. +However, Spring Security's xref:servlet/authentication/session-management.adoc#ns-session-fixation[Session Fixation Protection] can interfere with this because it results in a new session ID cookie being sent back to the user's browser, usually with the secure flag. To get around this, you can disable session fixation protection. However, in newer Servlet containers, you can also configure session cookies to never use the secure flag. @@ -703,7 +703,7 @@ You should also consult the {security-api-url}[Javadoc] for the relevant classes The namespace functionality is intentionally limited, so it does not cover everything that you can do with plain beans. If you want to do something simple, such as modifying a bean or injecting a different dependency, you can do so by adding a `BeanPostProcessor` to your configuration. -You can find more information in the https://docs.spring.io/spring/docs/3.0.x/spring-framework-reference/htmlsingle/spring-framework-reference.html#beans-factory-extension-bpp[Spring Reference Manual]. To do so, you need to know a bit about which beans are created, so you should also read the blog article mentioned in the earlier question on <>. +You can find more information in the {spring-framework-reference-url}core/beans/factory-extension.html#beans-factory-extension-bpp[Spring Reference Manual]. To do so, you need to know a bit about which beans are created, so you should also read the blog article mentioned in the earlier question on <>. Normally, you would add the functionality you require to the `postProcessBeforeInitialization` method of `BeanPostProcessor`. Suppose that you want to customize the `AuthenticationDetailsSource` used by the `UsernamePasswordAuthenticationFilter` (created by the `form-login` element). You want to extract a particular header called `CUSTOM_HEADER` from the request and use it while authenticating the user. The processor class would look like the following listing: diff --git a/docs/modules/ROOT/pages/servlet/appendix/proxy-server.adoc b/docs/modules/ROOT/pages/servlet/appendix/proxy-server.adoc index 5e1f6b489e..777afae2eb 100644 --- a/docs/modules/ROOT/pages/servlet/appendix/proxy-server.adoc +++ b/docs/modules/ROOT/pages/servlet/appendix/proxy-server.adoc @@ -11,4 +11,4 @@ For example Tomcat uses the https://tomcat.apache.org/tomcat-10.1-doc/api/org/ap Alternatively, Spring 4.3+ users can leverage https://github.com/spring-projects/spring-framework/blob/v4.3.3.RELEASE/spring-web/src/main/java/org/springframework/web/filter/ForwardedHeaderFilter.java[ForwardedHeaderFilter]. Spring Boot users may use the `server.use-forward-headers` property to configure the application. -See the https://docs.spring.io/spring-boot/docs/current/reference/htmlsingle/#howto.webserver.use-behind-a-proxy-server[Spring Boot documentation] for further details. +See the {spring-boot-reference-url}how-to/webserver.html#howto.webserver.use-behind-a-proxy-server[Spring Boot documentation] for further details. diff --git a/docs/modules/ROOT/pages/servlet/authentication/anonymous.adoc b/docs/modules/ROOT/pages/servlet/authentication/anonymous.adoc index 197b32f77c..b1b02c26b3 100644 --- a/docs/modules/ROOT/pages/servlet/authentication/anonymous.adoc +++ b/docs/modules/ROOT/pages/servlet/authentication/anonymous.adoc @@ -99,7 +99,7 @@ If you do not need this functionality, though, you can stick with `ROLE_ANONYMOU [[anonymous-auth-mvc-controller]] == Getting Anonymous Authentications with Spring MVC -https://docs.spring.io/spring-framework/docs/current/reference/html/web.html#mvc-ann-arguments[Spring MVC resolves parameters of type `Principal`] using its own argument resolver. +{spring-framework-reference-url}web/webmvc/mvc-controller/ann-methods/arguments.html[Spring MVC resolves parameters of type `Principal`] using its own argument resolver. This means that a construct like this one: diff --git a/docs/modules/ROOT/pages/servlet/authentication/passwords/form.adoc b/docs/modules/ROOT/pages/servlet/authentication/passwords/form.adoc index afb1c30046..6b096c38fd 100644 --- a/docs/modules/ROOT/pages/servlet/authentication/passwords/form.adoc +++ b/docs/modules/ROOT/pages/servlet/authentication/passwords/form.adoc @@ -27,7 +27,7 @@ image:{icondir}/number_4.png[] The browser requests the login page to which it w image:{icondir}/number_5.png[] Something within the application, must <>. [[servlet-authentication-usernamepasswordauthenticationfilter]] -When the username and password are submitted, the `UsernamePasswordAuthenticationFilter` creates a `UsernamePasswordAuthenticationToken` which is a type of https://docs.spring.io/spring-security/reference/servlet/authentication/architecture.html#servlet-authentication-authentication[Authentication], by extracting the username and password from the `HttpServletRequest` instance. +When the username and password are submitted, the `UsernamePasswordAuthenticationFilter` creates a `UsernamePasswordAuthenticationToken` which is a type of xref:servlet/authentication/architecture.adoc#servlet-authentication-authentication[Authentication], by extracting the username and password from the `HttpServletRequest` instance. The `UsernamePasswordAuthenticationFilter` extends xref:servlet/authentication/architecture.adoc#servlet-authentication-abstractprocessingfilter[AbstractAuthenticationProcessingFilter], so the following diagram should look pretty similar: .Authenticating Username and Password diff --git a/docs/modules/ROOT/pages/servlet/authentication/passwords/jdbc.adoc b/docs/modules/ROOT/pages/servlet/authentication/passwords/jdbc.adoc index 2a2d4dfa1e..537d3dcfde 100644 --- a/docs/modules/ROOT/pages/servlet/authentication/passwords/jdbc.adoc +++ b/docs/modules/ROOT/pages/servlet/authentication/passwords/jdbc.adoc @@ -96,7 +96,7 @@ create table group_members ( == Setting up a DataSource Before we configure `JdbcUserDetailsManager`, we must create a `DataSource`. -In our example, we set up an https://docs.spring.io/spring-framework/docs/current/spring-framework-reference/data-access.html#jdbc-embedded-database-support[embedded DataSource] that is initialized with the <>. +In our example, we set up an {spring-framework-reference-url}data-access/jdbc/embedded-database-support.html[embedded DataSource] that is initialized with the <>. .Embedded Data Source [tabs] diff --git a/docs/modules/ROOT/pages/servlet/configuration/java.adoc b/docs/modules/ROOT/pages/servlet/configuration/java.adoc index 33097f681d..292ba0a1ae 100644 --- a/docs/modules/ROOT/pages/servlet/configuration/java.adoc +++ b/docs/modules/ROOT/pages/servlet/configuration/java.adoc @@ -707,8 +707,8 @@ include-code::./TopLevelCustomizerBeanConfiguration[tag=headersCustomizer,indent [[customizer-bean-ordering]] === Customizer Bean Ordering -First each xref:#httpsecurity-customizer-bean[Customizer Bean] is applied using https://docs.spring.io/spring-framework/docs/current/javadoc-api/org/springframework/beans/factory/ObjectProvider.html#orderedStream()[ObjectProvider#orderedStream()]. -This means that if there are multiple `Customizer` Beans, the https://docs.spring.io/spring-framework/docs/current/javadoc-api/org/springframework/core/annotation/Order.html[@Order] annotation can be added to the Bean definitions to control the ordering. +First each xref:#httpsecurity-customizer-bean[Customizer Bean] is applied using {spring-framework-api-url}org/springframework/beans/factory/ObjectProvider.html#orderedStream()[ObjectProvider#orderedStream()]. +This means that if there are multiple `Customizer` Beans, the {spring-framework-api-url}org/springframework/core/annotation/Order.html[@Order] annotation can be added to the Bean definitions to control the ordering. Next every xref:#top-level-customizer-bean[Top Level HttpSecurity Customizer Beans] type is looked up and each is applied using `ObjectProvider#orderedStream()`. If there is are two `Customizer>` beans and two `Customizer>` instances, the order that each `Customizer` type is invoked is undefined. diff --git a/docs/modules/ROOT/pages/servlet/configuration/kotlin.adoc b/docs/modules/ROOT/pages/servlet/configuration/kotlin.adoc index 4c038fd0ba..011f014021 100644 --- a/docs/modules/ROOT/pages/servlet/configuration/kotlin.adoc +++ b/docs/modules/ROOT/pages/servlet/configuration/kotlin.adoc @@ -395,8 +395,8 @@ include-code::./TopLevelDslBeanConfiguration[tag=headersSecurity,indent=0] First, all xref:servlet/configuration/java.adoc#modular-httpsecurity-configuration[Modular HttpSecurity Configuration] is applied since the Kotlin Dsl uses an `HttpSecurity` Bean. -Second, each xref:#httpsecuritydsl-bean[HttpSecurityDsl.() -> Unit Beans] is applied using https://docs.spring.io/spring-framework/docs/current/javadoc-api/org/springframework/beans/factory/ObjectProvider.html#orderedStream()[ObjectProvider#orderedStream()]. -This means that if there are multiple `HttpSecurity.() -> Unit` Beans, the https://docs.spring.io/spring-framework/docs/current/javadoc-api/org/springframework/core/annotation/Order.html[@Order] annotation can be added to the Bean definitions to control the ordering. +Second, each xref:#httpsecuritydsl-bean[HttpSecurityDsl.() -> Unit Beans] is applied using {spring-framework-api-url}org/springframework/beans/factory/ObjectProvider.html#orderedStream()[ObjectProvider#orderedStream()]. +This means that if there are multiple `HttpSecurity.() -> Unit` Beans, the {spring-framework-api-url}org/springframework/core/annotation/Order.html[@Order] annotation can be added to the Bean definitions to control the ordering. Next, every xref:#top-level-dsl-bean[Top Level Security Dsl Beans] type is looked up and each is is applied using `ObjectProvider#orderedStream()`. If there is are different types of top level security Beans (e.g. `HeadersDsl.() -> Unit` and `HttpsRedirectDsl.() -> Unit`), then the order that each Dsl type is invoked is undefined. diff --git a/docs/modules/ROOT/pages/servlet/configuration/xml-namespace.adoc b/docs/modules/ROOT/pages/servlet/configuration/xml-namespace.adoc index ddf652799c..f13585130a 100644 --- a/docs/modules/ROOT/pages/servlet/configuration/xml-namespace.adoc +++ b/docs/modules/ROOT/pages/servlet/configuration/xml-namespace.adoc @@ -5,7 +5,7 @@ Namespace configuration has been available since version 2.0 of the Spring Framework. It lets you supplement the traditional Spring beans application context syntax with elements from additional XML schema. -You can find more information in the Spring https://docs.spring.io/spring/docs/current/spring-framework-reference/htmlsingle/[Reference Documentation]. +You can find more information in the Spring {spring-framework-reference-url}index.html[Reference Documentation]. You can use a namespace element to more concisely configure an individual bean or, more powerfully, to define an alternative configuration syntax that more closely matches the problem domain and hides the underlying complexity from the user. A simple element can conceal the fact that multiple beans and processing steps are being added to the application context. For example, adding the following element from the `security` namespace to an application context starts up an embedded LDAP server for testing use within the application: diff --git a/docs/modules/ROOT/pages/servlet/exploits/csrf.adoc b/docs/modules/ROOT/pages/servlet/exploits/csrf.adoc index 9d7c06ea63..842a766d3d 100644 --- a/docs/modules/ROOT/pages/servlet/exploits/csrf.adoc +++ b/docs/modules/ROOT/pages/servlet/exploits/csrf.adoc @@ -708,8 +708,8 @@ For example, the rendered HTML might look like: The following view technologies automatically include the actual CSRF token in a form that has an unsafe HTTP method, such as a POST: -* https://docs.spring.io/spring/docs/current/spring-framework-reference/web.html#mvc-view-jsp-formtaglib[Spring’s form tag library] -* https://www.thymeleaf.org/doc/tutorials/2.1/thymeleafspring.html#integration-with-requestdatavalueprocessor[Thymeleaf] +* {spring-framework-reference-url}web/webmvc-view/mvc-jsp.html#mvc-view-jsp-formtaglib[Spring’s form tag library] +* https://www.thymeleaf.org/doc/tutorials/3.1/thymeleafspring.html#integration-with-requestdatavalueprocessor[Thymeleaf] * Any other view technology that integrates with {spring-framework-api-url}org/springframework/web/servlet/support/RequestDataValueProcessor.html[`RequestDataValueProcessor`] (via javadoc:org.springframework.security.web.servlet.support.csrf.CsrfRequestDataValueProcessor[]) * You can also include the token yourself via the xref:servlet/integrations/jsp-taglibs.adoc#taglibs-csrfinput[csrfInput] tag @@ -1445,7 +1445,7 @@ If JavaScript is not available, the following sections discuss options for placi [NOTE] ==== -You can find more information about using multipart forms with Spring in the https://docs.spring.io/spring-framework/docs/current/reference/html/web.html#mvc-multipart[Multipart Resolver] section of the Spring reference and the {spring-framework-api-url}org/springframework/web/multipart/support/MultipartFilter.html[`MultipartFilter` javadoc]. +You can find more information about using multipart forms with Spring in the {spring-framework-reference-url}web/webmvc/mvc-servlet/multipart.html[Multipart Resolver] section of the Spring reference and the {spring-framework-api-url}org/springframework/web/multipart/support/MultipartFilter.html[`MultipartFilter` javadoc]. ==== [[csrf-considerations-multipart-body]] @@ -1535,7 +1535,7 @@ The following example does this with a JSP: We have xref:features/exploits/csrf.adoc#csrf-considerations-multipart-body[already discussed] the trade-offs of placing the CSRF token in the body. In Spring's Servlet support, overriding the HTTP method is done by using {spring-framework-api-url}org/springframework/web/filter/reactive/HiddenHttpMethodFilter.html[`HiddenHttpMethodFilter`]. -You can find more information in the https://docs.spring.io/spring/docs/current/spring-framework-reference/web.html#mvc-rest-method-conversion[HTTP Method Conversion] section of the reference documentation. +You can find more information in the {spring-framework-reference-url}web/webmvc-view/mvc-jsp.html#mvc-rest-method-conversion[HTTP Method Conversion] section of the reference documentation. [[csrf-further-reading]] == Further Reading diff --git a/docs/modules/ROOT/pages/servlet/exploits/headers.adoc b/docs/modules/ROOT/pages/servlet/exploits/headers.adoc index a36dd804cc..a19050f8bd 100644 --- a/docs/modules/ROOT/pages/servlet/exploits/headers.adoc +++ b/docs/modules/ROOT/pages/servlet/exploits/headers.adoc @@ -207,7 +207,7 @@ However, if you actually want to cache specific responses, your application can You can use this to ensure that content (such as CSS, JavaScript, and images) is properly cached. When you use Spring Web MVC, this is typically done within your configuration. -You can find details on how to do this in the https://docs.spring.io/spring/docs/5.0.0.RELEASE/spring-framework-reference/web.html#mvc-config-static-resources[Static Resources] portion of the Spring Reference documentation +You can find details on how to do this in the {spring-framework-reference-url}web/webmvc/mvc-config/static-resources.html[Static Resources] portion of the Spring Reference documentation If necessary, you can also disable Spring Security's cache control HTTP response headers. @@ -1157,7 +1157,7 @@ public class WebSecurityConfig { XML:: + -[source,xml,role="secondary"] +[source,xml,role="secondary",subs="+attributes"] ---- @@ -1167,7 +1167,7 @@ XML:: `. However, we do not want the client to be able to listen to `/queue/*`, because that would let the client see messages for every user. -In general, it is common for applications to deny any `SUBSCRIBE` sent to a message that starts with the https://docs.spring.io/spring/docs/current/spring-framework-reference/html/websocket.html#websocket-stomp[broker prefix] (`/topic/` or `/queue/`). +In general, it is common for applications to deny any `SUBSCRIBE` sent to a message that starts with the {spring-framework-reference-url}web/websocket/stomp.html[broker prefix] (`/topic/` or `/queue/`). We may provide exceptions to account for things like //FIXME: Like what? [[websocket-authorization-notes-outbound]] === Outbound Messages -The Spring Framework reference documentation contains a section titled https://docs.spring.io/spring/docs/current/spring-framework-reference/html/websocket.html#websocket-stomp-message-flow["`Flow of Messages`"] that describes how messages flow through the system. +The Spring Framework reference documentation contains a section titled {spring-framework-reference-url}web/websocket/stomp/message-flow.html["`Flow of Messages`"] that describes how messages flow through the system. Note that Spring Security secures only the `clientInboundChannel`. Spring Security does not attempt to secure the `clientOutboundChannel`. @@ -351,7 +352,7 @@ This means that developers need to explicitly protect their applications from ex [[websocket-sameorigin-spring]] === Spring WebSocket Allowed Origin -Fortunately, since Spring 4.1.5 Spring's WebSocket and SockJS support restricts access to the https://docs.spring.io/spring/docs/current/spring-framework-reference/html/websocket.html#websocket-server-allowed-origins[current domain]. +Fortunately, since Spring 4.1.5 Spring's WebSocket and SockJS support restricts access to the {spring-framework-reference-url}web/websocket/server.html#websocket-server-allowed-origins[current domain]. Spring Security adds an additional layer of protection to provide https://en.wikipedia.org/wiki/Defence_in_depth_(non-military)#Information_security[defense in depth]. [[websocket-sameorigin-csrf]] @@ -529,7 +530,7 @@ If you are migrating from a legacy usage of `websocket-message-broker` that impl [[websocket-sockjs]] == Working with SockJS -https://docs.spring.io/spring/docs/current/spring-framework-reference/html/websocket.html#websocket-fallback[SockJS] provides fallback transports to support older browsers. +{spring-framework-reference-url}web/websocket/fallback.html[SockJS] provides fallback transports to support older browsers. When using the fallback options, we need to relax a few security constraints to allow SockJS to work with Spring Security. [[websocket-sockjs-sameorigin]] diff --git a/docs/modules/ROOT/pages/servlet/oauth2/authorization-server/getting-started.adoc b/docs/modules/ROOT/pages/servlet/oauth2/authorization-server/getting-started.adoc index 8a3a88c8a3..37e9919abf 100644 --- a/docs/modules/ROOT/pages/servlet/oauth2/authorization-server/getting-started.adoc +++ b/docs/modules/ROOT/pages/servlet/oauth2/authorization-server/getting-started.adoc @@ -38,7 +38,7 @@ implementation "org.springframework.boot:spring-boot-starter-oauth2-authorizatio ---- ====== -TIP: See https://docs.spring.io/spring-boot/docs/current/reference/html/getting-started.html#getting-started.installing[Installing Spring Boot] for more information on using Spring Boot with Maven or Gradle. +TIP: See {spring-boot-reference-url}installing.html[Installing Spring Boot] for more information on using Spring Boot with Maven or Gradle. Alternatively, you can add Spring Security Authorization Server without Spring Boot using the following example: diff --git a/docs/modules/ROOT/pages/servlet/oauth2/client/authorization-grants.adoc b/docs/modules/ROOT/pages/servlet/oauth2/client/authorization-grants.adoc index d47cd93a7d..3926fefe91 100644 --- a/docs/modules/ROOT/pages/servlet/oauth2/client/authorization-grants.adoc +++ b/docs/modules/ROOT/pages/servlet/oauth2/client/authorization-grants.adoc @@ -1,6 +1,5 @@ [[oauth2-client-authorization-grants]] = [[oauth2Client-auth-grant-support]]Authorization Grant Support -:spring-security-reference-base-url: https://docs.spring.io/spring-security/reference This section describes Spring Security's support for authorization grants.