diff --git a/spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/security/servlet/UserDetailsServiceAutoConfiguration.java b/spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/security/servlet/UserDetailsServiceAutoConfiguration.java index f84c0ff3a4..92570aee64 100644 --- a/spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/security/servlet/UserDetailsServiceAutoConfiguration.java +++ b/spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/security/servlet/UserDetailsServiceAutoConfiguration.java @@ -40,10 +40,11 @@ import org.springframework.security.provisioning.InMemoryUserDetailsManager; import org.springframework.util.StringUtils; /** - * {@link EnableAutoConfiguration Auto-configuration} for a Spring Security in-memory {@link AuthenticationManager}. Adds an - * {@link InMemoryUserDetailsManager} with a default user and generated password. This can - * be disabled by providing a bean of type {@link AuthenticationManager}, - * {@link AuthenticationProvider} or {@link UserDetailsService}. + * {@link EnableAutoConfiguration Auto-configuration} for a Spring Security in-memory + * {@link AuthenticationManager}. Adds an {@link InMemoryUserDetailsManager} with a + * default user and generated password. This can be disabled by providing a bean of type + * {@link AuthenticationManager}, {@link AuthenticationProvider} or + * {@link UserDetailsService}. * * @author Dave Syer * @author Rob Winch diff --git a/spring-boot-project/spring-boot-docs/src/main/asciidoc/production-ready-features.adoc b/spring-boot-project/spring-boot-docs/src/main/asciidoc/production-ready-features.adoc index f6ed3fd13a..8051b11921 100644 --- a/spring-boot-project/spring-boot-docs/src/main/asciidoc/production-ready-features.adoc +++ b/spring-boot-project/spring-boot-docs/src/main/asciidoc/production-ready-features.adoc @@ -643,8 +643,8 @@ NOTE: Range requests are not supported when using Jersey. An operation on a web endpoint or a web-specific endpoint extension can receive the current `java.security.Principal` or `org.springframework.boot.actuate.endpoint.SecurityContext` as a method parameter. The -former is typically used in conjunction with `@Nullable` to provide different behaviour for -authenticated and unauthenticated users. The latter is typically used to perform +former is typically used in conjunction with `@Nullable` to provide different behaviour +for authenticated and unauthenticated users. The latter is typically used to perform authorization checks using its `isUserInRole(String)` method. diff --git a/spring-boot-project/spring-boot-docs/src/main/asciidoc/spring-boot-features.adoc b/spring-boot-project/spring-boot-docs/src/main/asciidoc/spring-boot-features.adoc index f0a4f97974..8a0bc3a64f 100644 --- a/spring-boot-project/spring-boot-docs/src/main/asciidoc/spring-boot-features.adoc +++ b/spring-boot-project/spring-boot-docs/src/main/asciidoc/spring-boot-features.adoc @@ -3012,11 +3012,11 @@ that you can see how to set things up. [[boot-features-security]] == Security If {spring-security}[Spring Security] is on the classpath, then web applications are -secured by default. Spring Boot relies on Spring Security’s content-negotiation strategy to -determine whether to use `httpBasic` or `formLogin`. To add method-level security to a web -application, you can also add `@EnableGlobalMethodSecurity` with your desired settings. -Additional information can be found in the {spring-security-reference}#jc-method[Spring -Security Reference Guide]. +secured by default. Spring Boot relies on Spring Security’s content-negotiation strategy +to determine whether to use `httpBasic` or `formLogin`. To add method-level security to a +web application, you can also add `@EnableGlobalMethodSecurity` with your desired +settings. Additional information can be found in the +{spring-security-reference}#jc-method[Spring Security Reference Guide]. The default `UserDetailsService` has a single user. The user name is `user`, and the password is random and is printed at INFO level when the application starts, as shown in