Spring/spring-boot
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Formatting

Browse Source
This commit is contained in:
Phillip Webb
2018-02-12 16:23:33 -08:00
parent 3880bdb908
commit 3bec55e16c
5 changed files with 53 additions and 51 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
spring-boot-project/spring-boot-docs/src/main/asciidoc/spring-boot-features.adoc
View File

@@ -3023,21 +3023,23 @@ commonly used locations.
[[boot-features-security-webflux]]
=== WebFlux Security
Similar to Spring MVC applications, you can secure your WebFlux applications by adding the `spring-boot-starter-security` dependency.
The default security configuration is implemented in `ReactiveSecurityAutoConfiguration` and in
the classes imported from there (`WebFluxSecurityConfiguration` for web security
and `ReactiveAuthenticationManagerConfiguration` for authentication configuration, which is also
relevant in non-web applications). To switch off the default web application security
configuration completely, you can add a bean of type `WebFilterChainProxy` (doing
so does not disable the authentication manager configuration or Actuator's security).
Similar to Spring MVC applications, you can secure your WebFlux applications by adding
the `spring-boot-starter-security` dependency. The default security configuration is
implemented in `ReactiveSecurityAutoConfiguration` and in the classes imported from there
(`WebFluxSecurityConfiguration` for web security and
`ReactiveAuthenticationManagerConfiguration` for authentication configuration, which is
also relevant in non-web applications). To switch off the default web application security
configuration completely, you can add a bean of type `WebFilterChainProxy` (doing so does
not disable the authentication manager configuration or Actuator's security).
To also switch off the authentication manager configuration, you can add a bean of type
`ReactiveUserDetailsService` or `ReactiveAuthenticationManager`.
Access rules can be configured by adding a custom `SecurityWebFilterChain`. Spring
Boot provides convenience methods that can be used to override access rules for actuator
endpoints and static resources. `EndpointRequest` can be used to create a `ServerWebExchangeMatcher`
that is based on the `management.endpoints.web.base-path` property.
endpoints and static resources. `EndpointRequest` can be used to create a
`ServerWebExchangeMatcher` that is based on the `management.endpoints.web.base-path`
property.
`PathRequest` can be used to create a `ServerWebExchangeMatcher` for resources in
commonly used locations.
@@ -3046,10 +3048,11 @@ For example, you can customize your security configuration by adding something l
[source,java,indent=0]
----
include::{code-examples}/web/security/CustomWebFluxSecurityExample.java[tag=custom-webflux-security]
include::{code-examples}/web/security/CustomWebFluxSecurityExample.java[tag=configuration]
----
[[boot-features-security-oauth2]]
=== OAuth2
https://oauth.net/2/[OAuth2] is a widely used authorization framework that is supported by

5
spring-boot-project/spring-boot-docs/src/main/java/org/springframework/boot/docs/web/security/CustomWebFluxSecurityExample.java
View File

@@ -30,6 +30,8 @@ import org.springframework.security.web.server.SecurityWebFilterChain;
@EnableWebFluxSecurity
public class CustomWebFluxSecurityExample {
// @formatter:off
// tag::configuration[]
@Bean
public SecurityWebFilterChain springSecurityFilterChain(ServerHttpSecurity http) {
http
@@ -40,6 +42,7 @@ public class CustomWebFluxSecurityExample {
.formLogin();
return http.build();
}
// end::configuration[]
// @formatter:on
}