Spring/spring-framework
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Polishing

Browse Source
This commit is contained in:
Juergen Hoeller
2023-11-20 21:01:40 +01:00
parent 695559879e
commit fff50657d2
6 changed files with 39 additions and 35 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
spring-webmvc/src/main/resources/org/springframework/web/servlet/config/spring-mvc.xsd
View File

@@ -1350,12 +1350,12 @@
set on the "Access-Control-Allow-Credentials" response header of
preflight requests.
NOTE: Be aware that this option establishes a high
level of trust with the configured domains and also increases the surface
attack of the web application by exposing sensitive user-specific
information such as cookies and CSRF tokens.
NOTE: Be aware that this option establishes a high level of trust with
the configured domains and also increases the surface attack of the web
application by exposing sensitive user-specific information such as
cookies and CSRF tokens.
By default this is not set in which case the
By default, this is not set in which case the
"Access-Control-Allow-Credentials" header is also not set and
credentials are therefore not allowed.
]]></xsd:documentation>