From f311f2d83306f8d2878274732f5e58510650541b Mon Sep 17 00:00:00 2001 From: Rossen Stoyanchev Date: Thu, 27 Feb 2014 11:29:11 -0500 Subject: [PATCH] Add reference to Spring Security issue w/ Java config --- .../samples/booking/config/SecurityConfig.java | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/booking-faces/src/main/java/org/springframework/webflow/samples/booking/config/SecurityConfig.java b/booking-faces/src/main/java/org/springframework/webflow/samples/booking/config/SecurityConfig.java index 03d2007..8898767 100644 --- a/booking-faces/src/main/java/org/springframework/webflow/samples/booking/config/SecurityConfig.java +++ b/booking-faces/src/main/java/org/springframework/webflow/samples/booking/config/SecurityConfig.java @@ -14,6 +14,7 @@ public class SecurityConfig extends WebSecurityConfigurerAdapter { @Override protected void configure(HttpSecurity http) throws Exception { + http .formLogin() .loginPage("/spring/login") @@ -25,10 +26,14 @@ public class SecurityConfig extends WebSecurityConfigurerAdapter { .logoutUrl("/spring/logout") .logoutSuccessUrl("/spring/logoutSuccess") .and() + + // Disable CSRF (won't work with JSF) but ensure last HTTP POST request is saved + // See https://jira.springsource.org/browse/SEC-2498 + + .csrf().disable() .requestCache() - .requestCache(new HttpSessionRequestCache()) - .and() - .csrf().disable(); + .requestCache(new HttpSessionRequestCache()); + } @Override