From c0426179368f9069e5b77194de22a540a771983e Mon Sep 17 00:00:00 2001
From: Robert Kohanyi <robert.kohanyi@metapack.com>
Date: Sat, 16 Apr 2016 14:20:12 +0100
Subject: [PATCH] Add (commented out) config for Spring Channel Security

---
 .../main/java/org/baeldung/spring/SecSecurityConfig.java | 8 ++++++++
 .../src/main/resources/webSecurityConfig.xml             | 9 +++++++++
 2 files changed, 17 insertions(+)

diff --git a/spring-security-mvc-login/src/main/java/org/baeldung/spring/SecSecurityConfig.java b/spring-security-mvc-login/src/main/java/org/baeldung/spring/SecSecurityConfig.java
index 08cb09384b..0cc6df19ae 100644
--- a/spring-security-mvc-login/src/main/java/org/baeldung/spring/SecSecurityConfig.java
+++ b/spring-security-mvc-login/src/main/java/org/baeldung/spring/SecSecurityConfig.java
@@ -38,6 +38,14 @@ public class SecSecurityConfig extends WebSecurityConfigurerAdapter {
         .antMatchers("/login*").permitAll()
         .anyRequest().authenticated()
         .and()
+        //.requiresChannel()
+        //.antMatchers("/login*", "/perform_log*").requiresSecure()
+        //.anyRequest().requiresInsecure()
+        //.and()
+        //.sessionManagement()
+        //.sessionFixation()
+        //.none()
+        //.and()
         .formLogin()
         .loginPage("/login.html")
         .loginProcessingUrl("/perform_login")
diff --git a/spring-security-mvc-login/src/main/resources/webSecurityConfig.xml b/spring-security-mvc-login/src/main/resources/webSecurityConfig.xml
index ec4cf60eb5..0b77e64c74 100644
--- a/spring-security-mvc-login/src/main/resources/webSecurityConfig.xml
+++ b/spring-security-mvc-login/src/main/resources/webSecurityConfig.xml
@@ -11,6 +11,12 @@
         <intercept-url pattern="/anonymous*" access="isAnonymous()"/>
         <intercept-url pattern="/login*" access="permitAll"/>
         <intercept-url pattern="/**" access="isAuthenticated()"/>
+        <!--
+        <intercept-url pattern="/anonymous*" access="isAnonymous()" requires-channel="http"/>
+        <intercept-url pattern="/login*" access="permitAll" requires-channel="https"/>
+        <intercept-url pattern="/perform_log*" access="permitAll" requires-channel="https"/>
+        <intercept-url pattern="/**" access="isAuthenticated()" requires-channel="http"/>
+        -->
 
         <csrf disabled="true"/>
         
@@ -19,6 +25,9 @@
 
         <logout logout-url="/perform_logout" delete-cookies="JSESSIONID" success-handler-ref="customLogoutSuccessHandler"/>
 
+        <!--
+        <session-management session-fixation-protection="none"/>
+        -->
     </http>
 
     <beans:bean name="customLogoutSuccessHandler" class="org.baeldung.security.CustomLogoutSuccessHandler"/>