Spring/spring-security
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

SEC-1574: Add CSRF Support

Browse Source
This commit is contained in:
Rob Winch
2013-08-15 14:49:21 -05:00
parent 5f35d9e3ec
commit e9bb9e766e
93 changed files with 2895 additions and 348 deletions
Download Patch File Download Diff File Expand all files Collapse all files

25
docs/manual/src/docbook/appendix-namespace.xml
View File

@@ -211,6 +211,7 @@
<itemizedlist>
<listitem><link xlink:href="#nsa-access-denied-handler">access-denied-handler</link></listitem>
<listitem><link xlink:href="#nsa-anonymous">anonymous</link></listitem>
<listitem><link xlink:href="#nsa-csrf">csrf</link></listitem>
<listitem><link xlink:href="#nsa-custom-filter">custom-filter</link></listitem>
<listitem><link xlink:href="#nsa-expression-handler">expression-handler</link></listitem>
<listitem><link xlink:href="#nsa-form-login">form-login</link></listitem>
@@ -518,6 +519,30 @@
</section>
</section>
</section>
<section xml:id="nsa-csrf">
<title><literal>&lt;csrf&gt;</literal></title>
<para>This element will add <a href="">CSRF</a> to the application. It also updates the default RequestCache
to only replay "GET" requests upon successful authentication.</para>
<section xml:id="nsa-csrf-parents">
<title>Parent Elements of <literal>&lt;csrf&gt;</literal></title>
<itemizedlist>
<listitem><link xlink:href="#nsa-http">http</link></listitem>
</itemizedlist>
</section>
<section xml:id="nsa-csrf-attributes">
<title><literal>&lt;csrf&gt;</literal> Attributes</title>
<section xml:id="nsa-csrf-token-repository-ref">
<title><literal>token-repository-ref</literal></title>
<para>The CsrfTokenRepository to use. The default is
<classname>HttpSessionCsrfTokenRepository</classname>.</para>
</section>
<section xml:id="nsa-csrf-request-matcher-ref">
<title><literal>request-matcher-ref</literal></title>
<para>The RequestMatcher instance to be used to determine if CSRF should be applied. Default is any
HTTP method except "GET", "TRACE", "HEAD", "OPTIONS".</para>
</section>
</section>
</section>
<section xml:id="nsa-custom-filter">
<title><literal>&lt;custom-filter&gt;</literal></title>
<para>This element is used to add a filter to the filter chain. It doesn't create any

7
docs/manual/src/docbook/namespace-config.xml
View File

@@ -716,9 +716,14 @@ List&lt;OpenIDAttribute> attributes = token.getAttributes();</programlisting>The
</row>
<row>
<entry>HEADERS_FILTER</entry>
<entry><literal>HeadersFilter</literal> </entry>
<entry><literal>HeaderWriterFilter</literal> </entry>
<entry><literal>http/headers</literal></entry>
</row>
<row>
<entry>CSRF_FILTER</entry>
<entry><literal>CsrfFilter</literal> </entry>
<entry><literal>http/csrf</literal></entry>
</row>
<row>
<entry> LOGOUT_FILTER </entry>
<entry><literal>LogoutFilter</literal></entry>