From 080710e023d7c0e114269b79d2a0f591335caa73 Mon Sep 17 00:00:00 2001 From: Luke Taylor <luke.taylor@springsource.com> Date: Tue, 6 Jul 2010 13:29:11 +0100 Subject: [PATCH] Minor doc updates on default filters created by namespace. --- docs/manual/src/docbook/namespace-config.xml | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/docs/manual/src/docbook/namespace-config.xml b/docs/manual/src/docbook/namespace-config.xml index 07ff230320..70230a78f0 100644 --- a/docs/manual/src/docbook/namespace-config.xml +++ b/docs/manual/src/docbook/namespace-config.xml @@ -605,7 +605,7 @@ List<OpenIDAttribute> attributes = token.getAttributes();</programlisting>The filters to the stack at particular locations or use a Spring Security filter for which there isn't currently a namespace configuration option (CAS, for example). Or you might want to use a customized version of a standard namespace filter, such as - the <literal>UsernamePasswordAuthenticationFilter</literal> which is created by the + the <classname>UsernamePasswordAuthenticationFilter</classname> which is created by the <literal><form-login></literal> element, taking advantage of some of the extra configuration options which are available by using the bean explicitly. How can you do this with namespace configuration, since the filter chain is not directly @@ -745,7 +745,13 @@ List<OpenIDAttribute> attributes = token.getAttributes();</programlisting>The <literal><http></literal> element itself - <classname>SecurityContextPersistenceFilter</classname>, <classname>ExceptionTranslationFilter</classname> or - <classname>FilterSecurityInterceptor</classname>. </para> + <classname>FilterSecurityInterceptor</classname>. Some other filters are added + by default, but you can disable them. An <classname>AnonymousAuthenticationFilter</classname> + is added by default and unless you have + <link xlink:href="#ns-session-fixation">session-fixation protection</link> + disabled, a <classname>SessionManagementFilter</classname> will also be added + to the filter chain. + </para> </tip> <para> If you're replacing a namespace filter which requires an authentication entry point (i.e. where the authentication process is triggered by an attempt by an