Cwikius-Spring/spring-security
1
0
Fork 0
mirror of https://github.com/spring-projects/spring-security.git synced 2025-06-23 20:42:14 +00:00
Code Issues Packages Projects Releases Wiki Activity

SEC-2653: ldap-xml logout is post with CSRF token

Browse Source
This commit is contained in:
Rob Winch 2014-06-13 13:50:04 -05:00
parent f7d09c6b62
commit 19ce54e4ff
3 changed files with 15 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
samples/ldap-xml/ldap.gradle
View File

@ -12,6 +12,8 @@ configurations {
} }
dependencies { dependencies {
compile project(':spring-security-taglibs'),
jstlDependencies
runtime project(':spring-security-web'), runtime project(':spring-security-web'),
project(':spring-security-config'), project(':spring-security-config'),

7
samples/ldap-xml/src/main/webapp/secure/extreme/index.jsp
View File

@ -1,3 +1,5 @@
<%@taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core" %>
<%@ taglib prefix="security" uri="http://www.springframework.org/security/tags" %>
<html> <html>
<body> <body>
@ -5,6 +7,9 @@
This is a protected page. You can only see me if you are a supervisor. This is a protected page. You can only see me if you are a supervisor.
<p><a href="../../">Home</a> <p><a href="../../">Home</a>
<p><a href="../../j_spring_security_logout">Logout</a> <form action="<c:url value="/j_spring_security_logout"/>" method="post">
<input type="submit" value="Logoff"/>
<security:csrfInput/>
</form>
</body> </body>
</html> </html>

8
samples/ldap-xml/src/main/webapp/secure/index.jsp
View File

@ -1,4 +1,7 @@
<%@taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core" %>
<%@ taglib prefix="security" uri="http://www.springframework.org/security/tags" %>
<html> <html>
<head><title>Secure Page</title></head>
<body> <body>
<h1>Secure Page</h1> <h1>Secure Page</h1>
This is a protected page. You can get to me if you've been remembered, This is a protected page. You can get to me if you've been remembered,
@ -10,6 +13,9 @@ or if you've authenticated this session.<br><br>
<p><a href="../">Home</a> <p><a href="../">Home</a>
<p><a href="../j_spring_security_logout">Logout</a> <form action="<c:url value="/j_spring_security_logout"/>" method="post">
<input type="submit" value="Logoff"/> (also clears any remember-me cookie)
<security:csrfInput/>
</form>
</body> </body>
</html> </html>