Spring/spring-boot
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Revert default for CRSF enabled to false

Browse Source 
Fixes gh-12267
This commit is contained in:
Madhura Bhave
2018-02-28 08:54:43 -08:00
parent 452492183d
commit c2f7dd86dc
4 changed files with 9 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/security/SecurityProperties.java
View File

@@ -75,7 +75,7 @@ public class SecurityProperties implements SecurityPrerequisite {
/**
* Enable Cross Site Request Forgery support.
*/
private boolean enableCsrf = true;
private boolean enableCsrf = false;
private Basic basic = new Basic();

8
spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/security/SecurityPropertiesTests.java
View File

@@ -123,11 +123,11 @@ public class SecurityPropertiesTests {
}
@Test
public void testCSrf() {
assertThat(this.security.isEnableCsrf()).isEqualTo(true);
this.binder.bind(new MutablePropertyValues(
Collections.singletonMap("security.enable-csrf", false)));
public void testCsrf() {
assertThat(this.security.isEnableCsrf()).isEqualTo(false);
this.binder.bind(new MutablePropertyValues(
Collections.singletonMap("security.enable-csrf", true)));
assertThat(this.security.isEnableCsrf()).isEqualTo(true);
}
}

2
spring-boot-docs/src/main/asciidoc/appendix-application-properties.adoc
View File

@@ -447,7 +447,7 @@ content into your application; rather pick only the properties that you need.
security.basic.enabled=true # Enable basic authentication.
security.basic.path=/** # Comma-separated list of paths to secure.
security.basic.realm=Spring # HTTP basic realm name.
security.enable-csrf=true # Enable Cross Site Request Forgery support.
security.enable-csrf=false # Enable Cross Site Request Forgery support.
security.filter-order=0 # Security filter chain order.
security.filter-dispatcher-types=ASYNC, FORWARD, INCLUDE, REQUEST # Security filter chain dispatcher types.
security.headers.cache=true # Enable cache control HTTP headers.

4
spring-boot-docs/src/main/asciidoc/spring-boot-features.adoc
View File

@@ -2536,8 +2536,9 @@ The basic features you get out of the box in a web application are:
* HTTP Basic security for all other endpoints.
* Security events published to Spring's `ApplicationEventPublisher` (successful and
unsuccessful authentication and access denied).
* Common low-level features (HSTS, XSS, CSRF, caching) provided by Spring Security are
* Common low-level features (HSTS, XSS, caching) provided by Spring Security are
on by default.
* Cross Site Request Forgery (CSRF) checks are disabled by default.
All of the above can be switched on and off or modified using external properties
(`+security.*+`). To override the access rules without changing any other auto-configured
@@ -2790,6 +2791,7 @@ If the Actuator is also in use, you will find:
* Security events are transformed into `AuditEvent` instances and published to the
`AuditEventRepository`.
* The default user will have the `ACTUATOR` role as well as the `USER` role.
* Cross Site Request Forgery (CSRF) checks are disabled for actuator endpoints.
The Actuator security features can be modified using external properties
(`+management.security.*+`). To override the application access rules