Fix invalid ids

Issue gh-2567
This commit is contained in:
Rob Winch 2019-10-24 14:06:23 -05:00
parent 55a98b9969
commit 08fb9c960b
8 changed files with 10 additions and 9 deletions

View File

@ -77,6 +77,7 @@ You can do so by adding a Maven property, as the following example shows:
If you use additional features (such as LDAP, OpenID, and others), you need to also include the appropriate <<modules>>.
[[getting-maven-no-boot]]
=== Maven Without Spring Boot
When you use Spring Security without Spring Boot, the preferred way is to use Spring Security's BOM to ensure a consistent version of Spring Security is used throughout the entire project. The following example shows how to do so:

View File

@ -44,7 +44,7 @@ Below are the highlights of the release.
=== Core
* Introducing <<rsoket,RSocket>> support
* Introducing <<rsocket,RSocket>> support
* Introducing https://github.com/spring-projects/spring-security/issues/6019[SAML Service Provider] support
* Introducing https://github.com/spring-projects/spring-security/issues/6722[AuthenticationManagerResolver]
* Introducing https://github.com/spring-projects/spring-security/issues/6506[AuthenticationFilter]

View File

@ -77,7 +77,7 @@ We could easily update our configuration if some of the defaults do not meet our
<3> If the query parameter `logout` exists, the user was successfully logged out
<4> The username must be present as the HTTP parameter named __username__
<5> The password must be present as the HTTP parameter named __password__
<6> We must <<csrf-include-csrf-token>> To learn more read the <<csrf>> section of the reference
<6> We must <<servlet-csrf-include>> To learn more read the <<csrf>> section of the reference
=== Form Login XML Configuration

View File

@ -123,6 +123,6 @@ If not configured a status code 200 will be returned by default.
- <<test-logout, Testing Logout>>
- <<servletapi-logout, HttpServletRequest.logout()>>
- <<remember-me-impls>>
- <<csrf-logout, Logging Out>> in section CSRF Caveats
- <<servlet-considerations-csrf-logout, Logging Out>> in section CSRF Caveats
- Section <<cas-singlelogout, Single Logout>> (CAS protocol)
- Documentation for the <<nsa-logout, logout element>> in the Spring Security XML Namespace section

View File

@ -205,7 +205,7 @@ By storing the expected CSRF in a cookie, JavaScript frameworks like https://doc
[[servlet-csrf-include-ajax-meta]]
===== Meta tags
An alternative pattern to <<servlet-csrf-include-form-attr-auto,exposing the CSRF in a cookie>> is to include the CSRF token within your `meta` tags.
An alternative pattern to <<servlet-csrf-include-form-auto,exposing the CSRF in a cookie>> is to include the CSRF token within your `meta` tags.
The HTML might look something like this:
.CSRF meta tag HTML
@ -278,7 +278,7 @@ Refer to <<csrf-considerations>> for a more general discussion.
It is important to <<csrf-considerations-login,require CSRF for log in>> requests to protect against forging log in attempts.
Spring Security's servlet support does this out of the box.
[[servlet-considerations-csrf-login]]
[[servlet-considerations-csrf-logout]]
=== Logging Out
It is important to <<csrf-considerations-logout,require CSRF for log out>> requests to protect against forging log out attempts.

View File

@ -9,7 +9,7 @@ NOTE: You can find the completed application at {gh-samples-url}/javaconfig/hell
== Updating Dependencies
The first step is to update the dependencies by using <<getting-maven-without-spring-boot,Maven>> or <<gradle-without-spring-boot,Gradle>>.
The first step is to update the dependencies by using <<getting-maven-no-boot,Maven>> or <<gradle-without-spring-boot,Gradle>>.
[[servlet-hello-jc-ews]]
@ -96,7 +96,7 @@ public class SecurityInitializer
The `SecurityInitializer` does the following things:
* Adds a `ContextLoaderListener` that loads the <<servlet-hello-ews,`WebSecurityConfig`>>.
* Adds a `ContextLoaderListener` that loads the <<servlet-hello-jc-ews,`WebSecurityConfig`>>.
* Finds the bean of type `Filter` named `springSecurityFilterChain` and registers it to process every URL in the application.

View File

@ -312,7 +312,7 @@ However, you can still use <<concurrency,Concurrency Support>> to provide transp
==== Automatic Token Inclusion
Spring Security will automatically <<csrf-include-csrf-token,include the CSRF Token>> within forms that use the https://docs.spring.io/spring/docs/3.2.x/spring-framework-reference/html/view.html#view-jsp-formtaglib-formtag[Spring MVC form tag].
Spring Security will automatically <<servlet-csrf-include,include the CSRF Token>> within forms that use the https://docs.spring.io/spring/docs/3.2.x/spring-framework-reference/html/view.html#view-jsp-formtaglib-formtag[Spring MVC form tag].
For example, the following JSP:
[source,xml]

View File

@ -222,7 +222,7 @@ Typically we need to include the CSRF token in an HTTP header or an HTTP paramet
However, SockJS does not allow for these options.
Instead, we must include the token in the Stomp headers
Applications can <<csrf-include-csrf-token,obtain a CSRF token>> by accessing the request attribute named _csrf.
Applications can <<servlet-csrf-include,obtain a CSRF token>> by accessing the request attribute named _csrf.
For example, the following will allow accessing the `CsrfToken` in a JSP:
[source,javascript]