From f398c85ac089c1d968175dddfea499cf4c612b9c Mon Sep 17 00:00:00 2001 From: Chris Bono Date: Tue, 11 Feb 2025 21:42:22 -0600 Subject: [PATCH] Rename security csrf property to include 'server' This renames the `spring.grpc.security.csrf.enabled` property to `spring.grpc.server.security.csrf.enabled` to signal that it is a server configuration property. Signed-off-by: Chris Bono --- .../src/main/antora/modules/ROOT/pages/server.adoc | 6 +++--- .../antora/modules/ROOT/partials/_configprops.adoc | 2 +- .../security/GrpcDisableCsrfHttpConfigurer.java | 7 ++++--- .../additional-spring-configuration-metadata.json | 12 ++++++------ 4 files changed, 14 insertions(+), 13 deletions(-) diff --git a/spring-grpc-docs/src/main/antora/modules/ROOT/pages/server.adoc b/spring-grpc-docs/src/main/antora/modules/ROOT/pages/server.adoc index 06bf773..7e0cc3f 100644 --- a/spring-grpc-docs/src/main/antora/modules/ROOT/pages/server.adoc +++ b/spring-grpc-docs/src/main/antora/modules/ROOT/pages/server.adoc @@ -266,8 +266,8 @@ public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Excepti } ---- -By default CSRF protection is automatically disabled for gRPC requests because it is incompatible with the protocol. -You can switch off that behaviour and configure your own CSRF protection if you want to by explicitly setting `spring.grpc.security.csrf.enabled=true`. +By default, CSRF protection is automatically disabled for gRPC requests because it is incompatible with the protocol. +You can switch off that behaviour and configure your own CSRF protection if you want to by explicitly setting `spring.grpc.server.security.csrf.enabled=true`. A servlet application that exposes gRPC endpoints on a different port (with `spring.grpc.server.servlet.enabled=false`) will also not have CSRF protection disabled by default. === Securing Individual Methods @@ -289,4 +289,4 @@ public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Excepti } ---- -Here we allow access to the `Simple/SayHello` method to users with the `USER` role, and to the `Simple/StreamHello` method to users with the `ADMIN` role, and allow access to all gRPC-provided services (like reflection and health indicators), while disallowing access to all other methods unless authenticated. \ No newline at end of file +Here we allow access to the `Simple/SayHello` method to users with the `USER` role, and to the `Simple/StreamHello` method to users with the `ADMIN` role, and allow access to all gRPC-provided services (like reflection and health indicators), while disallowing access to all other methods unless authenticated. diff --git a/spring-grpc-docs/src/main/antora/modules/ROOT/partials/_configprops.adoc b/spring-grpc-docs/src/main/antora/modules/ROOT/partials/_configprops.adoc index 38d3b24..5cdde9f 100644 --- a/spring-grpc-docs/src/main/antora/modules/ROOT/partials/_configprops.adoc +++ b/spring-grpc-docs/src/main/antora/modules/ROOT/partials/_configprops.adoc @@ -19,7 +19,6 @@ |spring.grpc.client.default-channel.ssl.enabled | | Whether to enable SSL support. Enabled automatically if "bundle" is provided unless specified otherwise. |spring.grpc.client.default-channel.user-agent | | The custom User-Agent for the channel. |spring.grpc.client.observations.enabled | `+++true+++` | Whether to enable Observations on the client. -|spring.grpc.security.csrf.enabled | `+++false+++` | Whether to enable CSRF protection on gRPC requests. |spring.grpc.server.address | | The address to bind to. could be a host:port combination or a pseudo URL like static://host:port. Can not be set if host or port are set independently. |spring.grpc.server.exception-handling.enabled | `+++true+++` | Whether to enable user-defined global exception handling on the gRPC server. |spring.grpc.server.health.actuator.enabled | `+++true+++` | Whether to adapt Actuator health indicators into gRPC health checks. @@ -41,6 +40,7 @@ |spring.grpc.server.observations.enabled | `+++true+++` | Whether to enable Observations on the server. |spring.grpc.server.port | `+++9090+++` | Server port to listen on. When the value is 0, a random available port is selected. The default is 9090. |spring.grpc.server.reflection.enabled | `+++true+++` | Whether to enable Reflection on the gRPC server. +|spring.grpc.server.security.csrf.enabled | `+++false+++` | Whether to enable CSRF protection on gRPC requests. |spring.grpc.server.servlet.enabled | `+++true+++` | Whether to use a servlet server in a servlet-based web application (set to false to force a native gRPC server). |spring.grpc.server.shutdown-grace-period | `+++30s+++` | Maximum time to wait for the server to gracefully shutdown. When the value is negative, the server waits forever. When the value is 0, the server will force shutdown immediately. The default is 30 seconds. |spring.grpc.server.ssl.bundle | | SSL bundle name. diff --git a/spring-grpc-spring-boot-autoconfigure/src/main/java/org/springframework/grpc/autoconfigure/server/security/GrpcDisableCsrfHttpConfigurer.java b/spring-grpc-spring-boot-autoconfigure/src/main/java/org/springframework/grpc/autoconfigure/server/security/GrpcDisableCsrfHttpConfigurer.java index d1dd79c..5571950 100644 --- a/spring-grpc-spring-boot-autoconfigure/src/main/java/org/springframework/grpc/autoconfigure/server/security/GrpcDisableCsrfHttpConfigurer.java +++ b/spring-grpc-spring-boot-autoconfigure/src/main/java/org/springframework/grpc/autoconfigure/server/security/GrpcDisableCsrfHttpConfigurer.java @@ -25,8 +25,8 @@ import org.springframework.security.config.annotation.web.configurers.AbstractHt *

* This configurer checks the application context to determine if CSRF protection should * be disabled for gRPC requests based on the property - * {@code spring.grpc.security.csrf.enabled}. By default, CSRF protection is disabled - * unless explicitly enabled in the application properties. + * {@code spring.grpc.server.security.csrf.enabled}. By default, CSRF protection is + * disabled unless explicitly enabled in the application properties. *

* * @see AbstractHttpConfigurer @@ -45,7 +45,8 @@ public class GrpcDisableCsrfHttpConfigurer extends AbstractHttpConfigurer