Spring/spring-security
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

SEC-2790: Deprecate @EnableWebMvcConfig

Browse Source
This commit is contained in:
Rob Winch
2014-12-09 16:17:58 -06:00
parent 62e127e978
commit 1677836d53
40 changed files with 237 additions and 83 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
docs/guides/src/asciidoc/_hello-includes/secure-the-application.asc
View File

@@ -67,7 +67,7 @@ public class SecurityConfig extends WebSecurityConfigurerAdapter {
}
----
NOTE: The name of the configureGlobal method is not important. However, it is important to only configure AuthenticationManagerBuilder in a class annotated with either `@EnableWebSecurity`, `@EnableWebMvcSecurity`, `@EnableGlobalMethodSecurity`, or `@EnableGlobalAuthentication`. Doing otherwise has unpredictable results.
NOTE: The name of the configureGlobal method is not important. However, it is important to only configure AuthenticationManagerBuilder in a class annotated with either `@EnableWebSecurity`, `@EnableGlobalMethodSecurity`, or `@EnableGlobalAuthentication`. Doing otherwise has unpredictable results.
[[servlet-api-integration]]
The <<security-config-java,SecurityConfig>> will:

6
docs/guides/src/asciidoc/form.asc
View File

@@ -54,7 +54,7 @@ We will want to ensure we compensate for overriding these defaults in our update
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
@EnableWebMvcSecurity
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {
@Override
@@ -100,7 +100,7 @@ To fix this we need to instruct Spring Security to allow anyone to access the */
----
// ...
@EnableWebMvcSecurity
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {
@Override
@@ -210,7 +210,7 @@ We need to update our configuration to allow anyone to access our resources and
----
// ...
@EnableWebMvcSecurity
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {
@Override

13
docs/guides/src/asciidoc/hellomvc.asc
View File

@@ -111,21 +111,10 @@ We can view the user name, but how are we able to log out? Below you can see how
</form>
----
If you try to log out right now the request will fail. The reason is that Spring Security is protecting against CSRF attakcks and there is no CSRF token include in our request. Update our configuration to use the `@EnableWebMvcSecurity` annotation which will do the same as `@EnableWebMvcSecurity` and provide integration with Spring MVC. Among other things, it will ensure our CSRF Token is included in our forms automatically when using Thymleaf 2.1+ or Spring MVC taglibs.
.src/main/java/org/springframework/security/samples/config/SecurityConfig.java
[source,java]
----
import org.springframework.security.config.annotation.web.servlet.configuration.*;
@EnableWebMvcSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {
----
In order to help protect against http://en.wikipedia.org/wiki/Cross-site_request_forgery[CSRF attacks], by default, Spring Security Java Configuration log out requires:
* the HTTP method must be a POST
* the CSRF token must be added to the request. Since we have used `@EnableWebMvcSecurity` and are using Thymeleaf, the CSRF token is automatically added as a hidden input for you (view the source to see it).
* the CSRF token must be added to the request. Since we have used `@EnableWebSecurity` and are using Thymeleaf, the CSRF token is automatically added as a hidden input for you (view the source to see it).
NOTE: If you were not using Spring MVC taglibs or Thymeleaf, you can access the CsrfToken on the ServletRequest using the attribute _csrf. You can find an example of including the CSRF token in a JSP within the link:helloworld.html[Hello Spring Security Java Config].

15
docs/manual/src/docs/asciidoc/index.adoc
View File

@@ -430,7 +430,7 @@ public class SecurityConfig extends WebSecurityConfigurerAdapter {
}
----
NOTE: The name of the configureGlobal method is not important. However, it is important to only configure AuthenticationManagerBuilder in a class annotated with either `@EnableWebSecurity`, `@EnableWebMvcSecurity`, `@EnableGlobalMethodSecurity`, or `@EnableGlobalAuthentication`. Doing otherwise has unpredictable results.
NOTE: The name of the configureGlobal method is not important. However, it is important to only configure AuthenticationManagerBuilder in a class annotated with either `@EnableWebSecurity`, `@EnableGlobalMethodSecurity`, or `@EnableGlobalAuthentication`. Doing otherwise has unpredictable results.
There really isn't much to this configuration, but it does a lot. You can find a summary of the features below:
@@ -3126,7 +3126,7 @@ An easier approach is to use <<the-csrfInput-tag,the csrfInput tag>> from the Sp
[NOTE]
====
If you are using Spring MVC `<form:form>` tag or http://www.thymeleaf.org/whatsnew21.html#reqdata[Thymeleaf 2.1+], and you replace `@EnableWebSecurity` with `@EnableWebMvcSecurity`, the `CsrfToken` is automatically included for you (using the `CsrfRequestDataValueProcessor`).
If you are using Spring MVC `<form:form>` tag or http://www.thymeleaf.org/whatsnew21.html#reqdata[Thymeleaf 2.1+] and are using `@EnableWebSecurity`, the `CsrfToken` is automatically included for you (using the `CsrfRequestDataValueProcessor`).
====
[[csrf-include-csrf-token-ajax]]
@@ -5947,15 +5947,10 @@ Spring Security provides a number of optional integrations with Spring MVC. This
[[mvc-enablewebmvcsecurity]]
=== @EnableWebMvcSecurity
To enable Spring Security integration with Spring MVC add the `@EnableWebMvcSecurity` annotation to your configuration. A typical example will look something like this:
WARN: As of Spring Security 4.0, `@EnableWebMvcSecurity` is deprecated. The replacement is `@EnableWebSecurity` which will determine adding the Spring MVC features based upon the classpath.
To enable Spring Security integration with Spring MVC add the `@EnableWebSecurity` annotation to your configuration. A typical example will look something like this:
[source,java]
----
@EnableWebMvcSecurity
public class SecurityConfig {
// ...
}
----
[[mvc-authentication-principal]]
=== @AuthenticationPrincipal