Cwikius-Spring/spring-security
1
0
Fork 0
mirror of https://github.com/spring-projects/spring-security.git synced 2025-05-31 01:02:14 +00:00
Code Issues Packages Projects Releases Wiki Activity

SEC-2348: Update doc headers enabled by default with XML

Browse Source
This commit is contained in:
Rob Winch 2014-11-21 21:55:03 -06:00
parent 4392205f63
commit 3c487c0348
2 changed files with 15 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
config/src/test/java/org/springframework/security/config/http/SessionManagementConfigServlet31Tests.java
View File

@ -107,6 +107,7 @@ public class SessionManagementConfigServlet31Tests {
loadContext("<http>\n" +
" <form-login/>\n" +
" <session-management/>\n" +
" <csrf disabled='true'/>\n" +
" </http>" +
XML_AUTHENTICATION_MANAGER);
@ -132,6 +133,7 @@ public class SessionManagementConfigServlet31Tests {
loadContext("<http>\n" +
" <form-login/>\n" +
" <session-management session-fixation-protection='changeSessionId'/>\n" +
" <csrf disabled='true'/>\n" +
" </http>" +
XML_AUTHENTICATION_MANAGER);

29
docs/manual/src/asciidoc/index.adoc
View File

@ -3322,23 +3322,9 @@ Spring Security allows users to easily inject the default security headers to as
* <<headers-frame-options,X-Frame-Options>>
* <<headers-xss-protection,X-XSS-Protection>>
While each of these headers are considered best practice, it should be noted that not all clients utilize the headers, so additional testing is encouraged. For passivity reasons, if you are using Spring Security's XML namespace support, you must explicitly enable the security headers. All of the default headers can be easily added using the <<nsa-headers,<headers>>> element with no child elements:
While each of these headers are considered best practice, it should be noted that not all clients utilize the headers, so additional testing is encouraged. As of Spring Security 4.0, HTTP Security response headers are enabled by default.
[NOTE]
====
https://jira.springsource.org/browse/SEC-2348[SEC-2348] is logged to ensure Spring Security 4.x's XML namespace configuration will enable Security headers by default.
====
[source,xml]
----
<http>
<!-- ... -->
<headers />
</http>
----
Alternatively, you can choose to explicitly list the headers you wish to include. For example, the following is the same the previous configuration. Removing any of the elements will remove that header from the responses.
Alternatively, you can choose to explicitly list the headers you wish to include. For example, the following is the same the default configuration. Removing any of the elements will remove that header from the responses.
[source,xml]
----
@ -3355,6 +3341,17 @@ Alternatively, you can choose to explicitly list the headers you wish to include
</http>
----
If necessary, you can disable the HTTP Security response headers with the following configuration:
[source,xml]
----
<http>
<!-- ... -->
<headers disabled="true" />
</http>
----
If you are using Spring Security's Java configuration, all of the default security headers are added by default. They can be disabled using the Java configuration below:
[source,java]