Polish form.asc

docs/guides/src/asciidoc/form.asc

@@ -10,7 +10,7 @@ include::{include-dir}/setting-up-the-sample.asc[]
 
 Verify the application is working:
 
-* A page displaying a user's inbox can be seen at http://localhost:8080/sample/
+* A page displaying a user's inbox can be seen at http://localhost:8080/sample/ after authenticating with the *username* _user_ and the *password* _password_.
 * Try clicking on the Compose link and creating a message. The message details should be displayed.
 * Now click on the Inbox link and see the message listed. You can click on the summary link to see the details displayed again.
 
@@ -52,8 +52,10 @@ We will want to ensure we compensate for overriding these defaults in our update
 ----
 // ...
 
+import org.springframework.security.config.annotation.web.builders.HttpSecurity;
+
 @Configuration
-@EnableWebSecurity
+@EnableWebMvcSecurity
 public class SecurityConfig extends WebSecurityConfigurerAdapter {
 
     @Override
@@ -100,7 +102,7 @@ To fix this we need to instruct Spring Security to allow anyone to access the */
 // ...
 
 @Configuration
-@EnableWebSecurity
+@EnableWebMvcSecurity
 public class SecurityConfig extends WebSecurityConfigurerAdapter {
 
     @Override
@@ -118,11 +120,11 @@ public class SecurityConfig extends WebSecurityConfigurerAdapter {
 }
 ----
 
-The `permitAll()` statement instructs Spring Security to allow any access to any URL (i.e. */login* and */login?error*) associated to `formLogin()`.
+The method `formLogin().permitAll()` statement instructs Spring Security to allow any access to any URL (i.e. */login* and */login?error*) associated to `formLogin()`.
 
 NOTE: Granting access to the `formLogin()` URLs is not done by default since Spring Security needs to make certain assumptions about what is allowed and what is not. To be secure, it is best to ensure granting access to resources is explicit.
 
-Start up the server and try visiting http://localhost:8080/sample/ to see the updates to our configuration. You should now get a 404 error stating that */login* cannot be found.
+Start up the server and try visiting http://localhost:8080/sample/ to see the updates to our configuration. You should now get a 500 error stating **Error resolving template "login"**.
 
 = Creating a login page
 
@@ -197,7 +199,7 @@ Our existing configuration means that all we need to do is create a *login.html*
 
 IMPORTANT: Do not display details about why authentication failed. For example, we do not want to display that the user does not exist as this will tell an attacker that they should try a different username.
 
-TIP: We use Spring Web MVC's <form:form> tag to automatically add the CSRF token to our form. We could also manually add the CSRF token using `<input type="hidden" name="${_csrf.parameterName}" value="${_csrf.token}"/>`.
+TIP: We use Thymeleaf to automatically add the CSRF token to our form. If we were not using Thymleaf or Spring MVCs taglib we could also manually add the CSRF token using `<input type="hidden" name="${_csrf.parameterName}" value="${_csrf.token}"/>`.
 
 Start up the server and try visiting http://localhost:8080/sample/ to see the updates to our configuration. We now see our login page, but it does not look very pretty. The issue is that we have not granted access to the css files.
 
@@ -211,7 +213,7 @@ We need to update our configuration to allow anyone to access our resources and
 // ...
 
 @Configuration
-@EnableWebSecurity
+@EnableWebMvcSecurity
 public class SecurityConfig extends WebSecurityConfigurerAdapter {
 
     @Override
@@ -237,10 +239,10 @@ public class SecurityConfig extends WebSecurityConfigurerAdapter {
 <2> As you might expect, `logout().permitAll()` allows any user to request logout and view logout success URL.
 
 
-Start up the server and try visiting http://localhost:8080/sample/ to see the updates to our configuration. We now see a custom login page that looks like the rest of our application.
+Restart the server and try visiting http://localhost:8080/sample/ to see the updates to our configuration. We now see a custom login page that looks like the rest of our application.
 
 * Try entering an invalid username and password. You will see our error message is displayed.
-* Try entering a valid username and password. You will be authenticated successfully.
+* Try entering a valid username (user) and password (password). You will be authenticated successfully.
 * Try clicking the Log Out button. You will see our logout success message
 
 == Conclusion