Spring/spring-boot
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Document WebSecurityCustomizer for H2 Console

Browse Source 
See gh-29932
This commit is contained in:
Henning Poettker
2022-02-22 00:56:40 +01:00
committed by Stephane Nicoll
parent 82c0582665
commit 9d46a18406
2 changed files with 66 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

22
spring-boot-project/spring-boot-docs/src/docs/asciidoc/features/sql.adoc
View File

@@ -322,6 +322,28 @@ You can customize the console's path by using the configprop:spring.h2.console.p
[[features.sql.h2-web-console.spring-security]]
==== Configuring Spring Security for H2 Console
H2 Console uses frames and, as it's intended for development only, does not implement CSRF protection measures. If your application uses Spring Security, you need to configure it to
* disable CSRF protection for requests against the console,
* set the header `X-Frame-Options` to `SAMEORIGIN` on responses from the console.
More information on {spring-security-docs}#csrf[CSRF] and the header {spring-security-docs}#headers-frame-options[X-Frame-Options] can be found in the Spring Security Reference Guide.
In simple setups, a `SecurityFilterChain` like the following can be used:
[source,java,indent=0,subs="verbatim"]
----
include::{docs-java}/features/sql/h2webconsole/springsecurity/DevProfileSecurityConfiguration.java[]
----
WARNING: The H2 console is only intended for use during development. In production, disabling CSRF protection or allowing frames for a website may create severe security risks.
TIP: `PathRequest.toH2Console()` returns the correct request matcher also when the console's path has been customized.
[[features.sql.jooq]]
=== Using jOOQ
jOOQ Object Oriented Querying (https://www.jooq.org/[jOOQ]) is a popular product from https://www.datageekery.com/[Data Geekery] which generates Java code from your database and lets you build type-safe SQL queries through its fluent API.