Spring/spring-boot
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Polish

Browse Source
This commit is contained in:
Phillip Webb
2014-04-06 21:44:20 -07:00
parent 8295e82ea0
commit 2bb0f744e0
10 changed files with 143 additions and 143 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
spring-boot-docs/src/main/asciidoc/howto.adoc
View File

@@ -935,14 +935,14 @@ and {sc-spring-boot-autoconfigure}/orm/jpa/JpaBaseConfiguration.{sc-ext}[`JpaBas
for more details.
[[howto-use-custom-entity-manager]]
=== Use a custom EntityManagerFactory
To take full control of the configuration of the
`EntityManagerFactory`, you need to add a `@Bean` named
"entityManagerFactory". To avoid eager initialization of JPA
infrastructure Spring Boot autoconfiguration does not switch on its
entity manager based on the presence of a bean of that type. Instead
it has to do it by name.
To take full control of the configuration of the `EntityManagerFactory`, you need to add
a `@Bean` named "entityManagerFactory". To avoid eager initialization of JPA
infrastructure, Spring Boot auto-configuration does not switch on its entity manager
based on the presence of a bean of that type. Instead it has to do it by name.
[[howto-use-traditional-persistence-xml]]
@@ -1140,9 +1140,12 @@ use this in a webapp is to inject it into a void method in a
}
----
You will get the best results if you put this in a nested class, or a standalone class (i.e.
not mixed in with a lot of other `@Beans` that might be allowed to influence the order of
instantiation). The https://github.com/spring-projects/spring-boot/tree/master/spring-boot-samples/spring-boot-sample-web-secure[secure web sample] is a useful template to follow.
You will get the best results if you put this in a nested class, or a standalone class
(i.e. not mixed in with a lot of other `@Beans` that might be allowed to influence the
order of instantiation). The {github-code}/spring-boot-samples/spring-boot-sample-web-secure[secure web sample]
is a useful template to follow.
[[howto-enable-https]]
=== Enable HTTPS

15
spring-boot-docs/src/main/asciidoc/production-ready-features.adoc
View File

@@ -251,8 +251,8 @@ all non-sensitive endpoints to be exposed over HTTP. The default convention is t
[[production-ready-sensitive-endpoints]]
=== Exposing sensitive endpoints
If you use ``Spring Security'' sensitive endpoints will be exposed over HTTP, but also
protected. By default ``basic'' authentication will be used with the username `user`
If you use ``Spring Security'' sensitive endpoints will be exposed over HTTP, but also
protected. By default ``basic'' authentication will be used with the username `user`
and a generated password (which is printed on the console when the application starts).
TIP: Generated passwords are logged as the application starts. Search for ``Using default
@@ -300,11 +300,10 @@ The `management.port` property can be used to change the HTTP port.
management.port=8081
----
Since your management
port is often protected by a firewall, and not exposed to the public you might not need
security on the management endpoints, even if your main application is secure. In that
case you will have Spring
Security on the classpath, and you can disable management security like this:
Since your management port is often protected by a firewall, and not exposed to the public
you might not need security on the management endpoints, even if your main application is
secure. In that case you will have Spring Security on the classpath, and you can disable
management security like this:
[source,properties,indent=0]
----
@@ -314,6 +313,8 @@ Security on the classpath, and you can disable management security like this:
(If you don't have Spring Security on the classpath then there is no need to explicitly
disable the management security in this way, and it might even break the application.)
[[production-ready-customizing-management-server-address]]
=== Customizing the management server address
You can customize the address that the management endpoints are available on by

81
spring-boot-docs/src/main/asciidoc/spring-boot-features.adoc
View File

@@ -993,6 +993,8 @@ packaged as an executable archive), there are some limitations in the JSP suppor
There is a {github-code}/spring-boot-samples/spring-boot-sample-web-jsp[JSP sample] so
you can see how to set things up.
[[boot-features-security]]
== Security
If Spring Security is on the classpath then web applications will be secure by default
@@ -1001,58 +1003,47 @@ application you can also add `@EnableGlobalMethodSecurity` with your desired set
Additional information can be found in the {spring-security-reference}#jc-method[Spring
Security Reference].
The default `AuthenticationManager` has a single user (username
``user'' and password random, printed at INFO level when the
application starts up). You can change the password by providing a
`security.user.password`. This and other useful properties are
externalized via
{sc-spring-boot-autoconfigure}/security/SecurityProperties.{sc-ext}[`SecurityProperties`]
The default `AuthenticationManager` has a single user (username ``user'' and password
random, printed at INFO level when the application starts up). You can change the
password by providing a `security.user.password`. This and other useful properties are
externalized via {sc-spring-boot-autoconfigure}/security/SecurityProperties.{sc-ext}[`SecurityProperties`]
(properties prefix "security").
The default security configuration is implemented in
`SecurityAutoConfiguration` and in the classes imported from there
(`SpringBootWebSecurityConfiguration` for web security and
`AuthenticationManagerConfiguration` for authentication configuration
which is also relevant in non-web applications). To switch off the
Boot default configuration completely in a web application you can add
a bean with `@EnableWebSecurity`. To customize it you normally use
external properties and beans of type `WebConfigurerAdapter` (e.g. to
The default security configuration is implemented in `SecurityAutoConfiguration` and in
the classes imported from there (`SpringBootWebSecurityConfiguration` for web security
and `AuthenticationManagerConfiguration` for authentication configuration which is also
relevant in non-web applications). To switch off the Boot default configuration
completely in a web application you can add a bean with `@EnableWebSecurity`. To customize
it you normally use external properties and beans of type `WebConfigurerAdapter` (e.g. to
add form-based login). There are several secure applications in the
{github-code}/spring-boot-samples/[Spring Boot samples] to get you
started with common use cases.
{github-code}/spring-boot-samples/[Spring Boot samples] to get you started with common
use cases.
The basic features you get out of the box in a web application are
* An `AuthenticationManager` bean with in-memory store and a single
user (see `SecurityProperties.User` for the properties of the user).
* Ignored (unsecure) paths for common static resource locations
(`/css/**`, `/js/**`, `/images/**` and `**/favicon.ico`).
The basic features you get out of the box in a web application are:
* An `AuthenticationManager` bean with in-memory store and a single user (see
`SecurityProperties.User` for the properties of the user).
* Ignored (unsecure) paths for common static resource locations (`/css/**`, `/js/**`,
`/images/**` and `**/favicon.ico`).
* HTTP Basic security for all other endpoints.
* Security events published to Spring's `ApplicationEventPublisher` (successful and
unsuccessful authentication and access denied).
* Common low-level features (HSTS, XSS, CSRF, caching) provided by Spring Security are
on by default.
* Security events published to Spring's `ApplicationEventPublisher`
(successful and unsuccessful authentication and access denied).
* Common low-level features (HSTS, XSS, CSRF, caching) provided by Spring
Security are on by default.
All of the above can be switched on and off or modified using external
properties (`security.*`).
All of the above can be switched on and off or modified using external properties
(`security.*`).
If the Actuator is also in use, you will find:
* The management endpoints are secure even if the application
endpoints are unsecure.
* The management endpoints are secure even if the application endpoints are unsecure.
* Security events are transformed into `AuditEvents` and published to the `AuditService`.
* The default user will have the "ADMIN" role as well as the "USER" role.
* Security events are transformed into `AuditEvents` and published to
the `AuditService`.
The Actuator security features can be modified using external properties
(`management.security.*`).
* The default user will have the "ADMIN" role as well as the "USER"
role.
The Actuator security features can be modified using external
properties (`management.security.*`).
[[boot-features-sql]]
== Working with SQL databases
@@ -1299,12 +1290,12 @@ following to your `application.properties`.
spring.jpa.hibernate.ddl-auto=create-drop
----
Note that Hibernate's own internal property name for this (if you
happen to remember it better) is `hibernate.hbm2ddl.auto`. You can set
it, along with other Hibernate native properties, using
`spring.jpa.properties.*` (the prefix is stripped before adding them
to the entity manager). Also relevant:
`spring.jpa.generate-ddl=false` switches off all DDL generation.
NOTE: Hibernate's own internal property name for this (if you happen to remember it
better) is `hibernate.hbm2ddl.auto`. You can set it, along with other Hibernate native
properties, using `spring.jpa.properties.*` (the prefix is stripped before adding them
to the entity manager). Alternatively, `spring.jpa.generate-ddl=false` switches off all
DDL generation.
[[boot-features-nosql]]