Add Hello World Xml guide

Issue gh-3850

docs/guides/src/docs/asciidoc/_hello-includes/exploring-the-secured-application-xml.asc

@@ -0,0 +1,19 @@
+=== Exploring the secured application
+
+Start the server as we did in <<running-the-{starter-appname}-application>> Now when you visit http://localhost:8080/sample/ you will be prompted with a login page that is automatically generated by Spring Security.
+
+==== Authenticating to the secured application
+
+Try entering an invalid username and password:
+
+* *Username* _invalid_
+* *Password* _invalid_
+
+You should see an error message stating that authentication failed. Now try entering a valid username and password:
+
+* *Username* _user_
+* *Password* _password_
+
+You should now see the page that we wanted to secure.
+
+NOTE: The reason we can successfully authenticate with *Username* _user_ and *Password* _password_ is because that is what we configured in our <<security-config-xml,security-config-xml>>.

docs/guides/src/docs/asciidoc/_hello-includes/secure-the-application-javaconfig.asc

@@ -29,7 +29,7 @@ In order to use Spring Security you must add the necessary dependencies. For the
 
 After you have completed this, you need to ensure that STS knows about the updated dependencies by:
 
-* Right click on the _spring-security-samples-{starter-appname}_ application
+* Right click on the _spring-security-samples-{starter-config-type}-{starter-appname}_ application
 * Select *Maven->Update project...*
 * Ensure the project is selected, and click *OK*
 
@@ -37,7 +37,7 @@ After you have completed this, you need to ensure that STS knows about the updat
 
 The next step is to create a Spring Security configuration.
 
-* Right click the _spring-security-samples-{starter-appname}_ project the Package Explorer view
+* Right click the _spring-security-samples-{starter-config-type}-{starter-appname}_ project in the Package Explorer view
 * Select *New->Class*
 * Enter _org.springframework.security.samples.config_ for the *Package*
 * Enter _SecurityConfig_ for the *Name*

docs/guides/src/docs/asciidoc/_hello-includes/secure-the-application-xml.asc

@@ -0,0 +1,89 @@
+== Securing the application
+
+Before securing your application, it is important to ensure that the existing application works as we did in <<running-the-{starter-appname}-application>>. Now that the application runs without security, we are ready to add security to our application. This section demonstrates the minimal steps to add Spring Security to our application.
+
+=== Updating your dependencies
+
+include::../{include-maven-repository}[]
+
+In order to use Spring Security you must add the necessary dependencies. For the sample we will add the following Spring Security dependencies:
+
+.pom.xml
+[source,xml]
+[subs="verbatim,attributes"]
+----
+<dependencies>
+  <!-- ... other dependency elements ... -->
+  <dependency>
+    <groupId>org.springframework.security</groupId>
+    <artifactId>spring-security-web</artifactId>
+    <version>{spring-security-version}</version>
+  </dependency>
+  <dependency>
+    <groupId>org.springframework.security</groupId>
+    <artifactId>spring-security-config</artifactId>
+    <version>{spring-security-version}</version>
+  </dependency>
+</dependencies>
+----
+
+After you have completed this, you need to ensure that STS knows about the updated dependencies by:
+
+* Right click on the _spring-security-samples-{starter-config-type}-{starter-appname}_ application
+* Select *Maven->Update project...*
+* Ensure the project is selected, and click *OK*
+
+=== Creating your Spring Security configuration
+
+The next step is to create a Spring Security configuration.
+
+* In the Package Explorer view, right click on the folder _src/main/webapp_
+* Select *New->Folder*
+* Enter _WEB-INF/spring_ for the *Folder name*
+* Then right click on the new folder _WEB-INF/spring_
+* Select *New->File*
+* Enter _security.xml_ for the *File name*
+* Click *Finish*
+* Replace the contents of the file with the following:
+
+[[security-config-xml]]
+.src/main/webapp/WEB-INF/spring/security.xml
+[source,xml]
+----
+<b:beans xmlns="http://www.springframework.org/schema/security"
+		 xmlns:b="http://www.springframework.org/schema/beans"
+		 xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+		 xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
+						http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security.xsd">
+
+	<http />
+
+	<user-service>
+		<user name="user" password="password" authorities="ROLE_USER" />
+	</user-service>
+
+</b:beans>
+----
+
+[[servlet-api-integration]]
+The <<security-config-xml,security-config-xml>> will:
+
+* Require authentication to every URL in your application
+* Generate a login form for you
+* Allow the user with the *Username* _user_ and the *Password* _password_ to authenticate with form based authentication
+* Allow the user to logout
+* http://en.wikipedia.org/wiki/Cross-site_request_forgery[CSRF attack] prevention
+* http://en.wikipedia.org/wiki/Session_fixation[Session Fixation] protection
+* Security Header integration
+** http://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security[HTTP Strict Transport Security] for secure requests
+** http://msdn.microsoft.com/en-us/library/ie/gg622941(v=vs.85).aspx[X-Content-Type-Options] integration
+** Cache Control (can be overridden later by your application to allow caching of your static resources)
+** http://msdn.microsoft.com/en-us/library/dd565647(v=vs.85).aspx[X-XSS-Protection] integration
+** X-Frame-Options integration to help prevent http://en.wikipedia.org/wiki/Clickjacking[Clickjacking]
+* Integrate with the following Servlet API methods
+** http://docs.oracle.com/javaee/6/api/javax/servlet/http/HttpServletRequest.html#getRemoteUser()[HttpServletRequest#getRemoteUser()]
+** http://docs.oracle.com/javaee/6/api/javax/servlet/http/HttpServletRequest.html#getUserPrincipal()[HttpServletRequest.html#getUserPrincipal()]
+** http://docs.oracle.com/javaee/6/api/javax/servlet/http/HttpServletRequest.html#isUserInRole(java.lang.String)[HttpServletRequest.html#isUserInRole(java.lang.String)]
+** http://docs.oracle.com/javaee/6/api/javax/servlet/http/HttpServletRequest.html#login(java.lang.String,%20java.lang.String)[HttpServletRequest.html#login(java.lang.String, java.lang.String)]
+** http://docs.oracle.com/javaee/6/api/javax/servlet/http/HttpServletRequest.html#logout()[HttpServletRequest.html#logout()]
+