spring-boot

Spring Boot

Tree: 37121e69e6

Dave Syer 0ccfba939e Switch to a matches-none filter for security.basic.enabled=false There were some residual issues to do with the changes to the implementation of security.basic.enabled=false. It was a good idea to have a filetr chain triggered by the flag being off because it smooths the way for user-defined filter chains to use the Boot AuthenticationManager (as a first step at least), but it wasn't a goog idea to add any actual secuity features to that filter. E.g. if it has HSTS then even an app like Sagan that has some secure endpoints that it manages itself and the rest is unsecured has issues because it can't accept connections over HTTP even on unsecure endpoints. TODO: find a way for security.ssl_enabled=true to apply to only the user- defined security filter (maybe not possible or worth the effort, since they can inject a SecurityProperties if they need it?). See gh-928	12 years ago
..
main	Switch to a matches-none filter for security.basic.enabled=false	12 years ago
test/java/sample/ui/secure	Man up and deal with CSRF in integration test	12 years ago

Dave Syer 0ccfba939e Switch to a matches-none filter for security.basic.enabled=false

There were some residual issues to do with the changes to the implementation
of security.basic.enabled=false. It was a good idea to have a filetr chain
triggered by the flag being off because it smooths the way for user-defined
filter chains to use the Boot AuthenticationManager (as a first step at least),
but it wasn't a goog idea to add any actual secuity features to that filter.
E.g. if it has HSTS then even an app like Sagan that has some secure endpoints
that it manages itself and the rest is unsecured has issues because it can't
accept connections over HTTP even on unsecure endpoints.

TODO: find a way for security.ssl_enabled=true to apply to only the user-
defined security filter (maybe not possible or worth the effort, since they
can inject a SecurityProperties if they need it?).

See gh-928

12 years ago

main

Switch to a matches-none filter for security.basic.enabled=false

12 years ago

test/java/sample/ui/secure

Man up and deal with CSRF in integration test

12 years ago