Spring/spring-boot
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Revert default for CRSF enabled to false

Browse Source 
Fixes gh-12267
This commit is contained in:
Madhura Bhave
2018-02-28 08:54:43 -08:00
parent 452492183d
commit c2f7dd86dc
4 changed files with 9 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
spring-boot-docs/src/main/asciidoc/appendix-application-properties.adoc
View File

@@ -447,7 +447,7 @@ content into your application; rather pick only the properties that you need.
security.basic.enabled=true # Enable basic authentication.
security.basic.path=/** # Comma-separated list of paths to secure.
security.basic.realm=Spring # HTTP basic realm name.
security.enable-csrf=true # Enable Cross Site Request Forgery support.
security.enable-csrf=false # Enable Cross Site Request Forgery support.
security.filter-order=0 # Security filter chain order.
security.filter-dispatcher-types=ASYNC, FORWARD, INCLUDE, REQUEST # Security filter chain dispatcher types.
security.headers.cache=true # Enable cache control HTTP headers.

4
spring-boot-docs/src/main/asciidoc/spring-boot-features.adoc
View File

@@ -2536,8 +2536,9 @@ The basic features you get out of the box in a web application are:
* HTTP Basic security for all other endpoints.
* Security events published to Spring's `ApplicationEventPublisher` (successful and
unsuccessful authentication and access denied).
* Common low-level features (HSTS, XSS, CSRF, caching) provided by Spring Security are
* Common low-level features (HSTS, XSS, caching) provided by Spring Security are
on by default.
* Cross Site Request Forgery (CSRF) checks are disabled by default.
All of the above can be switched on and off or modified using external properties
(`+security.*+`). To override the access rules without changing any other auto-configured
@@ -2790,6 +2791,7 @@ If the Actuator is also in use, you will find:
* Security events are transformed into `AuditEvent` instances and published to the
`AuditEventRepository`.
* The default user will have the `ACTUATOR` role as well as the `USER` role.
* Cross Site Request Forgery (CSRF) checks are disabled for actuator endpoints.
The Actuator security features can be modified using external properties
(`+management.security.*+`). To override the application access rules