ignored = SpringBootWebSecurityConfiguration.getIgnored(this.security);
ignored.addAll(Arrays.asList(getEndpointPaths(this.endpointHandlerMapping,
false)));
if (!this.management.getSecurity().isEnabled()) {
@@ -185,7 +186,7 @@ public class ManagementSecurityAutoConfiguration {
http.sessionManagement().sessionCreationPolicy(
this.management.getSecurity().getSessions());
- SecurityAutoConfiguration.configureHeaders(http.headers(),
+ SpringBootWebSecurityConfiguration.configureHeaders(http.headers(),
this.security.getHeaders());
}
diff --git a/spring-boot-actuator/src/test/java/org/springframework/boot/actuate/autoconfigure/ManagementSecurityAutoConfigurationTests.java b/spring-boot-actuator/src/test/java/org/springframework/boot/actuate/autoconfigure/ManagementSecurityAutoConfigurationTests.java
index 9666e235db..7ce357e4e4 100644
--- a/spring-boot-actuator/src/test/java/org/springframework/boot/actuate/autoconfigure/ManagementSecurityAutoConfigurationTests.java
+++ b/spring-boot-actuator/src/test/java/org/springframework/boot/actuate/autoconfigure/ManagementSecurityAutoConfigurationTests.java
@@ -128,11 +128,11 @@ public class ManagementSecurityAutoConfigurationTests {
public void testDisableBasicAuthOnApplicationPaths() throws Exception {
this.context = new AnnotationConfigWebApplicationContext();
this.context.setServletContext(new MockServletContext());
- this.context.register(SecurityAutoConfiguration.class,
- ManagementSecurityAutoConfiguration.class,
- HttpMessageConvertersAutoConfiguration.class,
+ this.context.register(HttpMessageConvertersAutoConfiguration.class,
EndpointAutoConfiguration.class, EndpointWebMvcAutoConfiguration.class,
ManagementServerPropertiesAutoConfiguration.class,
+ SecurityAutoConfiguration.class,
+ ManagementSecurityAutoConfiguration.class,
PropertyPlaceholderAutoConfiguration.class);
EnvironmentTestUtils.addEnvironment(this.context, "security.basic.enabled:false");
this.context.refresh();
diff --git a/spring-boot-actuator/src/test/java/org/springframework/boot/actuate/autoconfigure/SpringApplicationHierarchyTests.java b/spring-boot-actuator/src/test/java/org/springframework/boot/actuate/autoconfigure/SpringApplicationHierarchyTests.java
index 43eedfe21d..6f7c8452ce 100644
--- a/spring-boot-actuator/src/test/java/org/springframework/boot/actuate/autoconfigure/SpringApplicationHierarchyTests.java
+++ b/spring-boot-actuator/src/test/java/org/springframework/boot/actuate/autoconfigure/SpringApplicationHierarchyTests.java
@@ -19,6 +19,7 @@ package org.springframework.boot.actuate.autoconfigure;
import org.junit.After;
import org.junit.Test;
import org.springframework.boot.autoconfigure.EnableAutoConfiguration;
+import org.springframework.boot.autoconfigure.security.SecurityAutoConfiguration;
import org.springframework.boot.autoconfigure.web.ServerPropertiesAutoConfiguration;
import org.springframework.boot.builder.SpringApplicationBuilder;
import org.springframework.context.ApplicationContext;
@@ -61,7 +62,8 @@ public class SpringApplicationHierarchyTests {
}
@EnableAutoConfiguration(exclude = { ServerPropertiesAutoConfiguration.class,
- JolokiaAutoConfiguration.class, EndpointMBeanExportAutoConfiguration.class })
+ JolokiaAutoConfiguration.class, EndpointMBeanExportAutoConfiguration.class,
+ SecurityAutoConfiguration.class })
public static class Parent {
}
diff --git a/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/security/AuthenticationManagerConfiguration.java b/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/security/AuthenticationManagerConfiguration.java
index e4459388a6..0bdf7d8377 100644
--- a/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/security/AuthenticationManagerConfiguration.java
+++ b/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/security/AuthenticationManagerConfiguration.java
@@ -23,6 +23,8 @@ import java.util.Set;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.boot.autoconfigure.condition.ConditionalOnBean;
+import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean;
import org.springframework.boot.autoconfigure.security.SecurityProperties.User;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
@@ -32,6 +34,8 @@ import org.springframework.security.config.annotation.authentication.builders.Au
import org.springframework.security.config.annotation.authentication.configurers.provisioning.InMemoryUserDetailsManagerConfigurer;
@Configuration
+@ConditionalOnBean(ObjectPostProcessor.class)
+@ConditionalOnMissingBean(AuthenticationManager.class)
public class AuthenticationManagerConfiguration {
private static Log logger = LogFactory
diff --git a/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/security/SecurityAutoConfiguration.java b/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/security/SecurityAutoConfiguration.java
index 3d8688f4d6..b5b6bbbc91 100644
--- a/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/security/SecurityAutoConfiguration.java
+++ b/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/security/SecurityAutoConfiguration.java
@@ -16,254 +16,24 @@
package org.springframework.boot.autoconfigure.security;
-import java.util.ArrayList;
-import java.util.Arrays;
-import java.util.List;
-
-import javax.servlet.Filter;
-
-import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.boot.autoconfigure.EnableAutoConfiguration;
-import org.springframework.boot.autoconfigure.condition.ConditionalOnBean;
import org.springframework.boot.autoconfigure.condition.ConditionalOnClass;
-import org.springframework.boot.autoconfigure.condition.ConditionalOnExpression;
import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean;
-import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingClass;
-import org.springframework.boot.autoconfigure.security.SecurityProperties.Headers;
import org.springframework.boot.context.properties.EnableConfigurationProperties;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
-import org.springframework.core.Ordered;
-import org.springframework.core.annotation.Order;
-import org.springframework.security.authentication.AuthenticationEventPublisher;
+import org.springframework.context.annotation.Import;
import org.springframework.security.authentication.AuthenticationManager;
-import org.springframework.security.authentication.DefaultAuthenticationEventPublisher;
-import org.springframework.security.authentication.ProviderManager;
-import org.springframework.security.config.annotation.SecurityConfigurer;
-import org.springframework.security.config.annotation.web.builders.HttpSecurity;
-import org.springframework.security.config.annotation.web.builders.WebSecurity;
-import org.springframework.security.config.annotation.web.builders.WebSecurity.IgnoredRequestConfigurer;
-import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
-import org.springframework.security.config.annotation.web.configuration.WebSecurityConfiguration;
-import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
-import org.springframework.security.config.annotation.web.configurers.HeadersConfigurer;
-import org.springframework.security.config.annotation.web.servlet.configuration.EnableWebMvcSecurity;
-import org.springframework.security.web.AuthenticationEntryPoint;
-import org.springframework.security.web.authentication.www.BasicAuthenticationEntryPoint;
-import org.springframework.security.web.header.writers.HstsHeaderWriter;
-import org.springframework.security.web.util.matcher.AnyRequestMatcher;
-import org.springframework.web.servlet.support.RequestDataValueProcessor;
-/**
- * {@link EnableAutoConfiguration Auto-configuration} for security of a web application or
- * service. By default everything is secured with HTTP Basic authentication except the
- * {@link SecurityProperties#getIgnored() explicitly ignored} paths (defaults to
- * /css/**, /js/**, /images/**, /**/favicon.ico
- * ). Many aspects of the behavior can be controller with {@link SecurityProperties} via
- * externalized application properties (or via an bean definition of that type to set the
- * defaults). The user details for authentication are just placeholders
- * (username=user,
- * password=password) but can easily be customized by providing a bean definition
- * of type {@link AuthenticationManager}. Also provides audit logging of authentication
- * events.
- *
- *
- * Some common simple customizations:
- *
- * - Switch off security completely and permanently: remove Spring Security from the
- * classpath or {@link EnableAutoConfiguration#exclude() exclude} this configuration.
- * - Switch off security temporarily (e.g. for a dev environment): set
- *
security.basic.enabled: false
- * - Customize the user details: add an AuthenticationManager bean
- * - Add form login for user facing resources: add a
- * {@link WebSecurityConfigurerAdapter} and use {@link HttpSecurity#formLogin()}
- *
- *
- * @author Dave Syer
- */
@Configuration
+@ConditionalOnClass(AuthenticationManager.class)
@EnableConfigurationProperties
-@ConditionalOnClass({ EnableWebSecurity.class })
-@ConditionalOnMissingBean(WebSecurityConfiguration.class)
-// @ConditionalOnMissingBean(annotation = EnableWebSecurity.class)
+@Import({ SpringBootWebSecurityConfiguration.class, AuthenticationManagerConfiguration.class })
public class SecurityAutoConfiguration {
- private static List DEFAULT_IGNORED = Arrays.asList("/css/**", "/js/**",
- "/images/**", "/**/favicon.ico");
-
@Bean(name = "org.springframework.autoconfigure.security.SecurityProperties")
@ConditionalOnMissingBean
public SecurityProperties securityProperties() {
return new SecurityProperties();
}
- @Bean
- @ConditionalOnMissingBean
- public AuthenticationEventPublisher authenticationEventPublisher() {
- return new DefaultAuthenticationEventPublisher();
- }
-
- @Bean
- @ConditionalOnMissingBean({ IgnoredPathsWebSecurityConfigurerAdapter.class })
- // @ConditionalOnBean(annotation = EnableWebSecurity.class)
- @ConditionalOnBean(WebSecurityConfiguration.class)
- public SecurityConfigurer ignoredPathsWebSecurityConfigurerAdapter() {
- return new IgnoredPathsWebSecurityConfigurerAdapter();
- }
-
- // Get the ignored paths in early
- @Order(Ordered.HIGHEST_PRECEDENCE)
- private static class IgnoredPathsWebSecurityConfigurerAdapter implements
- SecurityConfigurer {
-
- @Autowired
- private SecurityProperties security;
-
- @Override
- public void configure(WebSecurity builder) throws Exception {
- }
-
- @Override
- public void init(WebSecurity builder) throws Exception {
- IgnoredRequestConfigurer ignoring = builder.ignoring();
- List ignored = getIgnored(this.security);
- ignoring.antMatchers(ignored.toArray(new String[0]));
- }
-
- }
-
- // Pull in @EnableWebMvcSecurity if Spring MVC is available and no-one defined a
- // RequestDataValueProcessor
- @ConditionalOnClass(RequestDataValueProcessor.class)
- @ConditionalOnMissingBean(RequestDataValueProcessor.class)
- @ConditionalOnExpression("${security.basic.enabled:true}")
- @Configuration
- protected static class WebMvcSecurityConfigurationConditions {
- @Configuration
- @EnableWebMvcSecurity
- protected static class DefaultWebMvcSecurityConfiguration {
- }
- }
-
- // Pull in a plain @EnableWebSecurity if Spring MVC is not available
- @ConditionalOnMissingBean(WebMvcSecurityConfigurationConditions.class)
- @ConditionalOnMissingClass(name = "org.springframework.web.servlet.support.RequestDataValueProcessor")
- @ConditionalOnExpression("${security.basic.enabled:true}")
- @Configuration
- @EnableWebSecurity
- protected static class DefaultWebSecurityConfiguration {
- }
-
- @ConditionalOnExpression("${security.basic.enabled:true}")
- @Configuration
- @Order(Ordered.LOWEST_PRECEDENCE - 5)
- protected static class ApplicationWebSecurityConfigurerAdapter extends
- WebSecurityConfigurerAdapter {
-
- @Autowired
- private SecurityProperties security;
-
- @Autowired
- private AuthenticationEventPublisher authenticationEventPublisher;
-
- @Override
- protected void configure(HttpSecurity http) throws Exception {
-
- if (this.security.isRequireSsl()) {
- http.requiresChannel().anyRequest().requiresSecure();
- }
-
- String[] paths = getSecureApplicationPaths();
- if (this.security.getBasic().isEnabled() && paths.length > 0) {
- http.exceptionHandling().authenticationEntryPoint(entryPoint());
- http.requestMatchers().antMatchers(paths);
- http.authorizeRequests()
- .anyRequest()
- .hasAnyRole(
- this.security.getUser().getRole().toArray(new String[0])) //
- .and().httpBasic() //
- .and().anonymous().disable();
- }
- if (!this.security.isEnableCsrf()) {
- http.csrf().disable();
- }
- // No cookies for application endpoints by default
- http.sessionManagement().sessionCreationPolicy(this.security.getSessions());
-
- SecurityAutoConfiguration.configureHeaders(http.headers(),
- this.security.getHeaders());
-
- }
-
- private String[] getSecureApplicationPaths() {
- List list = new ArrayList();
- for (String path : this.security.getBasic().getPath()) {
- path = (path == null ? "" : path.trim());
- if (path.equals("/**")) {
- return new String[] { path };
- }
- if (!path.equals("")) {
- list.add(path);
- }
- }
- return list.toArray(new String[list.size()]);
- }
-
- private AuthenticationEntryPoint entryPoint() {
- BasicAuthenticationEntryPoint entryPoint = new BasicAuthenticationEntryPoint();
- entryPoint.setRealmName(this.security.getBasic().getRealm());
- return entryPoint;
- }
-
- @Override
- protected AuthenticationManager authenticationManager() throws Exception {
- AuthenticationManager manager = super.authenticationManager();
- if (manager instanceof ProviderManager) {
- ((ProviderManager) manager)
- .setAuthenticationEventPublisher(this.authenticationEventPublisher);
- }
- return manager;
- }
-
- @Configuration
- @ConditionalOnMissingBean(AuthenticationManager.class)
- protected static class ApplicationAuthenticationManagerConfiguration extends
- AuthenticationManagerConfiguration {
- }
-
- }
-
- public static void configureHeaders(HeadersConfigurer configurer,
- SecurityProperties.Headers headers) throws Exception {
- if (headers.getHsts() != Headers.HSTS.none) {
- boolean includeSubdomains = headers.getHsts() == Headers.HSTS.all;
- HstsHeaderWriter writer = new HstsHeaderWriter(includeSubdomains);
- writer.setRequestMatcher(AnyRequestMatcher.INSTANCE);
- configurer.addHeaderWriter(writer);
- }
- if (headers.isContentType()) {
- configurer.contentTypeOptions();
- }
- if (headers.isXss()) {
- configurer.xssProtection();
- }
- if (headers.isCache()) {
- configurer.cacheControl();
- }
- if (headers.isFrame()) {
- configurer.frameOptions();
- }
- }
-
- public static List getIgnored(SecurityProperties security) {
- List ignored = new ArrayList(security.getIgnored());
- if (ignored.isEmpty()) {
- ignored.addAll(DEFAULT_IGNORED);
- }
- else if (ignored.contains("none")) {
- ignored.remove("none");
- }
- return ignored;
- }
-
-}
+}
\ No newline at end of file
diff --git a/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/security/SpringBootWebSecurityConfiguration.java b/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/security/SpringBootWebSecurityConfiguration.java
new file mode 100644
index 0000000000..349af7dd27
--- /dev/null
+++ b/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/security/SpringBootWebSecurityConfiguration.java
@@ -0,0 +1,259 @@
+/*
+ * Copyright 2012-2013 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.boot.autoconfigure.security;
+
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.List;
+
+import javax.servlet.Filter;
+
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.boot.autoconfigure.EnableAutoConfiguration;
+import org.springframework.boot.autoconfigure.condition.ConditionalOnBean;
+import org.springframework.boot.autoconfigure.condition.ConditionalOnClass;
+import org.springframework.boot.autoconfigure.condition.ConditionalOnExpression;
+import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean;
+import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingClass;
+import org.springframework.boot.autoconfigure.condition.ConditionalOnWebApplication;
+import org.springframework.boot.autoconfigure.security.SecurityProperties.Headers;
+import org.springframework.boot.context.properties.EnableConfigurationProperties;
+import org.springframework.context.annotation.Bean;
+import org.springframework.context.annotation.Configuration;
+import org.springframework.core.Ordered;
+import org.springframework.core.annotation.Order;
+import org.springframework.security.authentication.AuthenticationEventPublisher;
+import org.springframework.security.authentication.AuthenticationManager;
+import org.springframework.security.authentication.DefaultAuthenticationEventPublisher;
+import org.springframework.security.authentication.ProviderManager;
+import org.springframework.security.config.annotation.SecurityConfigurer;
+import org.springframework.security.config.annotation.web.builders.HttpSecurity;
+import org.springframework.security.config.annotation.web.builders.WebSecurity;
+import org.springframework.security.config.annotation.web.builders.WebSecurity.IgnoredRequestConfigurer;
+import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
+import org.springframework.security.config.annotation.web.configuration.WebSecurityConfiguration;
+import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
+import org.springframework.security.config.annotation.web.configurers.HeadersConfigurer;
+import org.springframework.security.config.annotation.web.servlet.configuration.EnableWebMvcSecurity;
+import org.springframework.security.web.AuthenticationEntryPoint;
+import org.springframework.security.web.authentication.www.BasicAuthenticationEntryPoint;
+import org.springframework.security.web.header.writers.HstsHeaderWriter;
+import org.springframework.security.web.util.matcher.AnyRequestMatcher;
+import org.springframework.web.servlet.support.RequestDataValueProcessor;
+
+/**
+ * {@link EnableAutoConfiguration Auto-configuration} for security of a web application or
+ * service. By default everything is secured with HTTP Basic authentication except the
+ * {@link SecurityProperties#getIgnored() explicitly ignored} paths (defaults to
+ * /css/**, /js/**, /images/**, /**/favicon.ico
+ * ). Many aspects of the behavior can be controller with {@link SecurityProperties} via
+ * externalized application properties (or via an bean definition of that type to set the
+ * defaults). The user details for authentication are just placeholders
+ * (username=user,
+ * password=password) but can easily be customized by providing a bean definition
+ * of type {@link AuthenticationManager}. Also provides audit logging of authentication
+ * events.
+ *
+ *
+ * Some common simple customizations:
+ *
+ * - Switch off security completely and permanently: remove Spring Security from the
+ * classpath or {@link EnableAutoConfiguration#exclude() exclude} this configuration.
+ * - Switch off security temporarily (e.g. for a dev environment): set
+ *
security.basic.enabled: false
+ * - Customize the user details: add an AuthenticationManager bean
+ * - Add form login for user facing resources: add a
+ * {@link WebSecurityConfigurerAdapter} and use {@link HttpSecurity#formLogin()}
+ *
+ *
+ * @author Dave Syer
+ */
+@Configuration
+@EnableConfigurationProperties
+@ConditionalOnClass({ EnableWebSecurity.class })
+@ConditionalOnMissingBean(WebSecurityConfiguration.class)
+@ConditionalOnWebApplication
+// @ConditionalOnMissingBean(annotation = EnableWebSecurity.class)
+public class SpringBootWebSecurityConfiguration {
+
+ private static List DEFAULT_IGNORED = Arrays.asList("/css/**", "/js/**",
+ "/images/**", "/**/favicon.ico");
+
+ @Bean
+ @ConditionalOnMissingBean
+ public AuthenticationEventPublisher authenticationEventPublisher() {
+ return new DefaultAuthenticationEventPublisher();
+ }
+
+ @Bean
+ @ConditionalOnMissingBean({ IgnoredPathsWebSecurityConfigurerAdapter.class })
+ // @ConditionalOnBean(annotation = EnableWebSecurity.class)
+ @ConditionalOnBean(SpringBootWebSecurityConfiguration.class)
+ public SecurityConfigurer ignoredPathsWebSecurityConfigurerAdapter() {
+ return new IgnoredPathsWebSecurityConfigurerAdapter();
+ }
+
+ // Get the ignored paths in early
+ @Order(Ordered.HIGHEST_PRECEDENCE)
+ private static class IgnoredPathsWebSecurityConfigurerAdapter implements
+ SecurityConfigurer {
+
+ @Autowired
+ private SecurityProperties security;
+
+ @Override
+ public void configure(WebSecurity builder) throws Exception {
+ }
+
+ @Override
+ public void init(WebSecurity builder) throws Exception {
+ IgnoredRequestConfigurer ignoring = builder.ignoring();
+ List ignored = getIgnored(this.security);
+ ignoring.antMatchers(ignored.toArray(new String[0]));
+ }
+
+ }
+
+ // Pull in @EnableWebMvcSecurity if Spring MVC is available and no-one defined a
+ // RequestDataValueProcessor
+ @ConditionalOnClass(RequestDataValueProcessor.class)
+ @ConditionalOnMissingBean(RequestDataValueProcessor.class)
+ @ConditionalOnExpression("${security.basic.enabled:true}")
+ @Configuration
+ protected static class WebMvcSecurityConfigurationConditions {
+ @Configuration
+ @EnableWebMvcSecurity
+ protected static class DefaultWebMvcSecurityConfiguration {
+ }
+ }
+
+ // Pull in a plain @EnableWebSecurity if Spring MVC is not available
+ @ConditionalOnMissingBean(WebMvcSecurityConfigurationConditions.class)
+ @ConditionalOnMissingClass(name = "org.springframework.web.servlet.support.RequestDataValueProcessor")
+ @ConditionalOnExpression("${security.basic.enabled:true}")
+ @Configuration
+ @EnableWebSecurity
+ protected static class DefaultWebSecurityConfiguration {
+ }
+
+ @ConditionalOnExpression("${security.basic.enabled:true}")
+ @Configuration
+ @Order(Ordered.LOWEST_PRECEDENCE - 5)
+ protected static class ApplicationWebSecurityConfigurerAdapter extends
+ WebSecurityConfigurerAdapter {
+
+ @Autowired
+ private SecurityProperties security;
+
+ @Autowired
+ private AuthenticationEventPublisher authenticationEventPublisher;
+
+ @Override
+ protected void configure(HttpSecurity http) throws Exception {
+
+ if (this.security.isRequireSsl()) {
+ http.requiresChannel().anyRequest().requiresSecure();
+ }
+
+ String[] paths = getSecureApplicationPaths();
+ if (this.security.getBasic().isEnabled() && paths.length > 0) {
+ http.exceptionHandling().authenticationEntryPoint(entryPoint());
+ http.requestMatchers().antMatchers(paths);
+ http.authorizeRequests()
+ .anyRequest()
+ .hasAnyRole(
+ this.security.getUser().getRole().toArray(new String[0])) //
+ .and().httpBasic() //
+ .and().anonymous().disable();
+ }
+ if (!this.security.isEnableCsrf()) {
+ http.csrf().disable();
+ }
+ // No cookies for application endpoints by default
+ http.sessionManagement().sessionCreationPolicy(this.security.getSessions());
+
+ SpringBootWebSecurityConfiguration.configureHeaders(http.headers(),
+ this.security.getHeaders());
+
+ }
+
+ private String[] getSecureApplicationPaths() {
+ List list = new ArrayList();
+ for (String path : this.security.getBasic().getPath()) {
+ path = (path == null ? "" : path.trim());
+ if (path.equals("/**")) {
+ return new String[] { path };
+ }
+ if (!path.equals("")) {
+ list.add(path);
+ }
+ }
+ return list.toArray(new String[list.size()]);
+ }
+
+ private AuthenticationEntryPoint entryPoint() {
+ BasicAuthenticationEntryPoint entryPoint = new BasicAuthenticationEntryPoint();
+ entryPoint.setRealmName(this.security.getBasic().getRealm());
+ return entryPoint;
+ }
+
+ @Override
+ protected AuthenticationManager authenticationManager() throws Exception {
+ AuthenticationManager manager = super.authenticationManager();
+ if (manager instanceof ProviderManager) {
+ ((ProviderManager) manager)
+ .setAuthenticationEventPublisher(this.authenticationEventPublisher);
+ }
+ return manager;
+ }
+
+ }
+
+ public static void configureHeaders(HeadersConfigurer configurer,
+ SecurityProperties.Headers headers) throws Exception {
+ if (headers.getHsts() != Headers.HSTS.none) {
+ boolean includeSubdomains = headers.getHsts() == Headers.HSTS.all;
+ HstsHeaderWriter writer = new HstsHeaderWriter(includeSubdomains);
+ writer.setRequestMatcher(AnyRequestMatcher.INSTANCE);
+ configurer.addHeaderWriter(writer);
+ }
+ if (headers.isContentType()) {
+ configurer.contentTypeOptions();
+ }
+ if (headers.isXss()) {
+ configurer.xssProtection();
+ }
+ if (headers.isCache()) {
+ configurer.cacheControl();
+ }
+ if (headers.isFrame()) {
+ configurer.frameOptions();
+ }
+ }
+
+ public static List getIgnored(SecurityProperties security) {
+ List ignored = new ArrayList(security.getIgnored());
+ if (ignored.isEmpty()) {
+ ignored.addAll(DEFAULT_IGNORED);
+ }
+ else if (ignored.contains("none")) {
+ ignored.remove("none");
+ }
+ return ignored;
+ }
+
+}
diff --git a/spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/security/SecurityAutoConfigurationTests.java b/spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/security/SecurityAutoConfigurationTests.java
index be8ede25e8..9fa40f7efd 100644
--- a/spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/security/SecurityAutoConfigurationTests.java
+++ b/spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/security/SecurityAutoConfigurationTests.java
@@ -106,12 +106,12 @@ public class SecurityAutoConfigurationTests {
public void testJpaCoexistsHappily() throws Exception {
this.context = new AnnotationConfigWebApplicationContext();
this.context.setServletContext(new MockServletContext());
- this.context.register(EntityConfiguration.class, TestConfiguration.class,
+ this.context.register(EntityConfiguration.class,
PropertyPlaceholderAutoConfiguration.class,
DataSourceAutoConfiguration.class, HibernateJpaAutoConfiguration.class,
SecurityAutoConfiguration.class);
// This can fail if security @Conditionals force early instantiation of the
- // HibernateJpaAutoConfiguration
+ // HibernateJpaAutoConfiguration (e.g. the EntityManagerFactory is not found)
this.context.refresh();
assertNotNull(this.context.getBean(JpaTransactionManager.class));
}
diff --git a/spring-boot-samples/pom.xml b/spring-boot-samples/pom.xml
index c16cec7ccb..a10fd482fe 100644
--- a/spring-boot-samples/pom.xml
+++ b/spring-boot-samples/pom.xml
@@ -32,6 +32,7 @@
spring-boot-sample-simple
spring-boot-sample-tomcat
spring-boot-sample-traditional
+ spring-boot-sample-web-secure
spring-boot-sample-web-static
spring-boot-sample-web-jsp
spring-boot-sample-web-ui
diff --git a/spring-boot-samples/spring-boot-sample-secure/pom.xml b/spring-boot-samples/spring-boot-sample-secure/pom.xml
index 9b0ba1bfad..6780b3a896 100644
--- a/spring-boot-samples/spring-boot-sample-secure/pom.xml
+++ b/spring-boot-samples/spring-boot-sample-secure/pom.xml
@@ -19,15 +19,6 @@
spring-boot-starter-security
${project.version}