Spring/spring-boot
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Make security auto-configs back off when SecurityFilterChain present

Browse Source 
Closes gh-22739
This commit is contained in:
Madhura Bhave
2020-08-14 12:21:35 -07:00
parent c9b8a05321
commit bbbbe8e4d2
18 changed files with 264 additions and 90 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
spring-boot-project/spring-boot-docs/src/docs/asciidoc/howto.adoc
View File

@@ -2265,7 +2265,7 @@ For more about Spring Security, see the {spring-security}[Spring Security projec
[[howto-switch-off-spring-boot-security-configuration]]
=== Switch off the Spring Boot Security Configuration
If you define a `@Configuration` with a `WebSecurityConfigurerAdapter` in your application, it switches off the default webapp security settings in Spring Boot.
If you define a `@Configuration` with a `WebSecurityConfigurerAdapter` or a `SecurityFilterChain` bean in your application, it switches off the default webapp security settings in Spring Boot.
[[howto-change-the-user-details-service-and-add-user-accounts]]

4
spring-boot-project/spring-boot-docs/src/docs/asciidoc/spring-boot-features.adoc
View File

@@ -3656,8 +3656,8 @@ You can register multiple relying parties under the `spring.security.saml2.relyi
For security purposes, all actuators other than `/health` and `/info` are disabled by default.
The configprop:management.endpoints.web.exposure.include[] property can be used to enable the actuators.
If Spring Security is on the classpath and no other WebSecurityConfigurerAdapter is present, all actuators other than `/health` and `/info` are secured by Spring Boot auto-configuration.
If you define a custom `WebSecurityConfigurerAdapter`, Spring Boot auto-configuration will back off and you will be in full control of actuator access rules.
If Spring Security is on the classpath and no other `WebSecurityConfigurerAdapter` or `SecurityFilterChain` bean is present, all actuators other than `/health` and `/info` are secured by Spring Boot auto-configuration.
If you define a custom `WebSecurityConfigurerAdapter` or `SecurityFilterChain` bean, Spring Boot auto-configuration will back off and you will be in full control of actuator access rules.
NOTE: Before setting the `management.endpoints.web.exposure.include`, ensure that the exposed actuators do not contain sensitive information and/or are secured by placing them behind a firewall or by something like Spring Security.