Cwikius-Spring/spring-security
1
0
Fork 0
mirror of https://github.com/spring-projects/spring-security.git synced 2025-06-01 09:42:13 +00:00
Code Issues Packages Projects Releases Wiki Activity

SEC-2285: Polish Security Headers Documentation

Browse Source 
Explain why (passivity) XML Namespace doesn't enable security headers by
default.
This commit is contained in:
Rob Winch 2013-09-27 16:13:18 -05:00
parent 9bb283044f
commit 06a0ec1a9f
1 changed files with 7 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
docs/manual/src/docbook/headers.xml
View File

@ -26,9 +26,13 @@
</listitem> </listitem>
</itemizedlist></para> </itemizedlist></para>
<para>While each of these headers are considered best practice, it should be noted that not all clients <para>While each of these headers are considered best practice, it should be noted that not all clients
utilize the headers, so additional testing is encouraged. If you are using Spring Security's XML namespace support, utilize the headers, so additional testing is encouraged. For passivity reasons, if you are using Spring Security's
you can easily add all of the default headers with the XML namespace support, you must explicitly enable the security headers. All of the default headers can be easily added
<link linkend="nsa-headers">&lt;headers&gt;</link> element with no child elements:</para> using the <link linkend="nsa-headers">&lt;headers&gt;</link> element with no child elements:</para>
<note>
<para><link xlink:href="https://jira.springsource.org/browse/SEC-2348">SEC-2348</link> is logged to ensure Spring
Security 4.x's XML namespace configuration will enable Security headers by default.</para>
</note>
<programlisting language="xml"><![CDATA[<http> <programlisting language="xml"><![CDATA[<http>
<!-- ... --> <!-- ... -->