@ -2335,8 +2335,8 @@ If you define a `@Configuration` with a `WebSecurityConfigurerAdapter` in your a
@@ -2335,8 +2335,8 @@ If you define a `@Configuration` with a `WebSecurityConfigurerAdapter` in your a
it switches off the default webapp security settings in Spring Boot.
@ -643,7 +643,7 @@ NOTE: Range requests are not supported when using Jersey.
@@ -643,7 +643,7 @@ NOTE: Range requests are not supported when using Jersey.
An operation on a web endpoint or a web-specific endpoint extension can receive the
current `java.security.Principal` or
`org.springframework.boot.actuate.endpoint.SecurityContext` as a method parameter. The
former is typically used in conjuction with `@Nullable` to provide different behaviour for
former is typically used in conjunction with `@Nullable` to provide different behaviour for
authenticated and unauthenticated users. The latter is typically used to perform
authorization checks using its `isUserInRole(String)` method.
@ -2034,8 +2034,8 @@ for Webjars.
@@ -2034,8 +2034,8 @@ for Webjars.
To use version agnostic URLs for Webjars, add the `webjars-locator-core` dependency.
Then declare your Webjar. Using jQuery as an example, adding
`"/webjars/jquery/dist/jquery.min.js"` results in
`"/webjars/jquery/x.y.z/dist/jquery.min.js"`. where `x.y.z` is the Webjar version.
`"/webjars/jquery/jquery.min.js"` results in
`"/webjars/jquery/x.y.z/jquery.min.js"`. where `x.y.z` is the Webjar version.
NOTE: If you use JBoss, you need to declare the `webjars-locator-jboss-vfs`
dependency instead of the `webjars-locator-core`. Otherwise, all Webjars resolve as a
@ -3012,13 +3012,13 @@ that you can see how to set things up.
@@ -3012,13 +3012,13 @@ that you can see how to set things up.
[[boot-features-security]]
== Security
If {spring-security}[Spring Security] is on the classpath, then web applications are
secure by default. Spring Boot relies on Spring Security’s content-negotiation strategy to
secured by default. Spring Boot relies on Spring Security’s content-negotiation strategy to
determine whether to use `httpBasic` or `formLogin`. To add method-level security to a web
application, you can also add `@EnableGlobalMethodSecurity` with your desired settings.
Additional information can be found in the {spring-security-reference}#jc-method[Spring
Security Reference Guide].
The default `AuthenticationManager` has a single user. The user name is `user`, and the
The default `UserDetailsService` has a single user. The user name is `user`, and the
password is random and is printed at INFO level when the application starts, as shown in
the following example:
@ -3049,14 +3049,15 @@ You can provide a different `AuthenticationEventPublisher` by adding a bean for
@@ -3049,14 +3049,15 @@ You can provide a different `AuthenticationEventPublisher` by adding a bean for
[[boot-features-security-mvc]]
=== MVC Security
The default security configuration is implemented in `SecurityAutoConfiguration` and in
the classes imported from there (`SpringBootWebSecurityConfiguration` for web security
and `AuthenticationManagerConfiguration` for authentication configuration, which is also
relevant in non-web applications). To switch off the default web application security
The default security configuration is implemented in `SecurityAutoConfiguration` and