diff --git a/docs/manual/src/docs/asciidoc/index.adoc b/docs/manual/src/docs/asciidoc/index.adoc index 6c7b5b382a..d8591180b6 100644 --- a/docs/manual/src/docs/asciidoc/index.adoc +++ b/docs/manual/src/docs/asciidoc/index.adoc @@ -1,6 +1,7 @@ = Spring Security Reference Ben Alex; Luke Taylor; Rob Winch; Gunnar Hillert :include-dir: _includes +:security-api-url: http://docs.spring.io/spring-security/site/docs/current/apidocs/ Spring Security is a powerful and highly customizable authentication and access-control framework. It is the de-facto standard for securing Spring-based applications. @@ -211,13 +212,13 @@ One (tedious) way to circumvent this issue would be to include all the Spring Fr ---- - + org.springframework spring-framework-bom {spring-version} pom import - + ---- @@ -516,7 +517,7 @@ If you are not using Spring or Spring MVC, you will need to pass in the `Securit import org.springframework.security.web.context.*; public class SecurityWebApplicationInitializer - extends AbstractSecurityWebApplicationInitializer { + extends AbstractSecurityWebApplicationInitializer { public SecurityWebApplicationInitializer() { super(SecurityConfig.class); @@ -538,7 +539,7 @@ If we were using Spring elsewhere in our application we probably already had a ` import org.springframework.security.web.context.*; public class SecurityWebApplicationInitializer - extends AbstractSecurityWebApplicationInitializer { + extends AbstractSecurityWebApplicationInitializer { } ---- @@ -692,7 +693,7 @@ protected void configure(HttpSecurity http) throws Exception { === Handling Logouts When using the -`http://docs.spring.io/spring-security/site/docs/current/apidocs/org/springframework/security/config/annotation/web/configuration/WebSecurityConfigurerAdapter.html[WebSecurityConfigurerAdapter]`, +`{security-api-url}org/springframework/security/config/annotation/web/configuration/WebSecurityConfigurerAdapter.html[WebSecurityConfigurerAdapter]`, logout capabilities are automatically applied. The default is that accessing the URL `/logout` will log the user out by: @@ -709,22 +710,22 @@ to further customize your logout requirements: protected void configure(HttpSecurity http) throws Exception { http .logout() <1> - .logoutUrl("/my/logout") <2> - .logoutSuccessUrl("/my/index") <3> - .logoutSuccessHandler(logoutSuccessHandler) <4> - .invalidateHttpSession(true) <5> - .addLogoutHandler(logoutHandler) <6> - .deleteCookies(cookieNamesToClear) <7> - .and() - ... + .logoutUrl("/my/logout") <2> + .logoutSuccessUrl("/my/index") <3> + .logoutSuccessHandler(logoutSuccessHandler) <4> + .invalidateHttpSession(true) <5> + .addLogoutHandler(logoutHandler) <6> + .deleteCookies(cookieNamesToClear) <7> + .and() + ... } ---- <1> Provides logout support. This is automatically applied when using `WebSecurityConfigurerAdapter`. -<2> The URL that triggers log out to occur (default is `/logout`). If CSRF protection is enabled (default), then the request must also be a POST. For for information, please consult the http://docs.spring.io/spring-security/site/docs/current/apidocs/org/springframework/security/config/annotation/web/configurers/LogoutConfigurer.html#logoutUrl(java.lang.String)[JavaDoc]. -<3> The URL to redirect to after logout has occurred. The default is `/login?logout`. For for information, please consult the http://docs.spring.io/spring-security/site/docs/current/apidocs/org/springframework/security/config/annotation/web/configurers/LogoutConfigurer.html#logoutSuccessUrl(java.lang.String)[JavaDoc]. -<4> Let's you specify a custom `LogoutSuccessHandler`. If this is specified, `logoutSuccessUrl()` is ignored. For for information, please consult the http://docs.spring.io/spring-security/site/docs/current/apidocs/org/springframework/security/config/annotation/web/configurers/LogoutConfigurer.html#logoutSuccessHandler(org.springframework.security.web.authentication.logout.LogoutSuccessHandler)[JavaDoc]. -<5> Specify whether to invalidate the `HttpSession` at the time of logout. This is *true* by default. Configures the `SecurityContextLogoutHandler` under the covers. For for information, please consult the http://docs.spring.io/spring-security/site/docs/current/apidocs/org/springframework/security/config/annotation/web/configurers/LogoutConfigurer.html#invalidateHttpSession(boolean)[JavaDoc]. +<2> The URL that triggers log out to occur (default is `/logout`). If CSRF protection is enabled (default), then the request must also be a POST. For for information, please consult the {security-api-url}org/springframework/security/config/annotation/web/configurers/LogoutConfigurer.html#logoutUrl(java.lang.String)[JavaDoc]. +<3> The URL to redirect to after logout has occurred. The default is `/login?logout`. For for information, please consult the {security-api-url}org/springframework/security/config/annotation/web/configurers/LogoutConfigurer.html#logoutSuccessUrl(java.lang.String)[JavaDoc]. +<4> Let's you specify a custom `LogoutSuccessHandler`. If this is specified, `logoutSuccessUrl()` is ignored. For for information, please consult the {security-api-url}org/springframework/security/config/annotation/web/configurers/LogoutConfigurer.html#logoutSuccessHandler(org.springframework.security.web.authentication.logout.LogoutSuccessHandler)[JavaDoc]. +<5> Specify whether to invalidate the `HttpSession` at the time of logout. This is *true* by default. Configures the `SecurityContextLogoutHandler` under the covers. For for information, please consult the {security-api-url}org/springframework/security/config/annotation/web/configurers/LogoutConfigurer.html#invalidateHttpSession(boolean)[JavaDoc]. <6> Adds a `LogoutHandler`. `SecurityContextLogoutHandler` is added as the last `LogoutHandler` by default. <7> Allows specifying the names of cookies to be removed on logout success. This is a shortcut for adding a `CookieClearingLogoutHandler` explicitly. @@ -734,25 +735,25 @@ Logouts can of course also be configured using the XML Namespace notation. Pleas ==== Generally, in order to customize logout functionality, you can add -`http://docs.spring.io/spring-security/site/docs/current/apidocs/org/springframework/security/web/authentication/logout/LogoutHandler.html[LogoutHandler]` +`{security-api-url}org/springframework/security/web/authentication/logout/LogoutHandler.html[LogoutHandler]` and/or -`http://docs.spring.io/spring-security/site/docs/current/apidocs/org/springframework/security/web/authentication/logout/LogoutSuccessHandler.html[LogoutSuccessHandler]` +`{security-api-url}org/springframework/security/web/authentication/logout/LogoutSuccessHandler.html[LogoutSuccessHandler]` implementations. For many common scenarios, these handlers are applied under the covers when using the fluent API. [[jc-logout-handler]] ==== LogoutHandler -Generally, `http://docs.spring.io/spring-security/site/docs/current/apidocs/org/springframework/security/web/authentication/logout/LogoutHandler.html[LogoutHandler]` +Generally, `{security-api-url}org/springframework/security/web/authentication/logout/LogoutHandler.html[LogoutHandler]` implementations indicate classes that are able to participate in logout handling. They are expected to be invoked to perform necessary cleanup. As such they should not throw exceptions. Various implementations are provided: -- http://docs.spring.io/spring-security/site/docs/current/apidocs/org/springframework/security/web/authentication/rememberme/PersistentTokenBasedRememberMeServices.html[PersistentTokenBasedRememberMeServices] -- http://docs.spring.io/spring-security/site/docs/current/apidocs/org/springframework/security/web/authentication/rememberme/TokenBasedRememberMeServices.html[TokenBasedRememberMeServices] -- http://docs.spring.io/spring-security/site/docs/current/apidocs/org/springframework/security/web/authentication/logout/CookieClearingLogoutHandler.html[CookieClearingLogoutHandler] -- http://docs.spring.io/spring-security/site/docs/current/apidocs/org/springframework/security/web/csrf/CsrfLogoutHandler.html[CsrfLogoutHandler] -- http://docs.spring.io/spring-security/site/docs/current/apidocs/org/springframework/security/web/authentication/logout/SecurityContextLogoutHandler.html[SecurityContextLogoutHandler] +- {security-api-url}org/springframework/security/web/authentication/rememberme/PersistentTokenBasedRememberMeServices.html[PersistentTokenBasedRememberMeServices] +- {security-api-url}org/springframework/security/web/authentication/rememberme/TokenBasedRememberMeServices.html[TokenBasedRememberMeServices] +- {security-api-url}org/springframework/security/web/authentication/logout/CookieClearingLogoutHandler.html[CookieClearingLogoutHandler] +- {security-api-url}org/springframework/security/web/csrf/CsrfLogoutHandler.html[CsrfLogoutHandler] +- {security-api-url}org/springframework/security/web/authentication/logout/SecurityContextLogoutHandler.html[SecurityContextLogoutHandler] Please see <> for details. @@ -771,7 +772,7 @@ interface is almost the same as the `LogoutHandler` but may raise an exception. The following implementations are provided: -- http://docs.spring.io/spring-security/site/docs/current/apidocs/org/springframework/security/web/authentication/logout/SimpleUrlLogoutSuccessHandler.html[SimpleUrlLogoutSuccessHandler] +- {security-api-url}org/springframework/security/web/authentication/logout/SimpleUrlLogoutSuccessHandler.html[SimpleUrlLogoutSuccessHandler] - HttpStatusReturningLogoutSuccessHandler As mentioned above, you don't need to specify the `SimpleUrlLogoutSuccessHandler` directly. @@ -1091,9 +1092,9 @@ To start using the security namespace in your application context, you need to h xmlns:security="http://www.springframework.org/schema/security" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.springframework.org/schema/beans - http://www.springframework.org/schema/beans/spring-beans-3.0.xsd - http://www.springframework.org/schema/security - http://www.springframework.org/schema/security/spring-security.xsd"> + http://www.springframework.org/schema/beans/spring-beans-3.0.xsd + http://www.springframework.org/schema/security + http://www.springframework.org/schema/security/spring-security.xsd"> ... ---- @@ -1111,9 +1112,9 @@ In many of the examples you will see (and in the sample) applications, we xmlns:beans="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.springframework.org/schema/beans - http://www.springframework.org/schema/beans/spring-beans-3.0.xsd - http://www.springframework.org/schema/security - http://www.springframework.org/schema/security/spring-security.xsd"> + http://www.springframework.org/schema/beans/spring-beans-3.0.xsd + http://www.springframework.org/schema/security + http://www.springframework.org/schema/security/spring-security.xsd"> ... ---- @@ -1200,8 +1201,8 @@ To add some users, you can define a set of test data directly in the namespace: - - + + @@ -1276,7 +1277,7 @@ If a form login isn't prompted by an attempt to access a protected resource, the + always-use-default-target='true' /> ---- @@ -1350,9 +1351,9 @@ Passwords should always be encoded using a secure hashing algorithm designed for - - @@ -1458,7 +1459,7 @@ Then add the following lines to your application context: ... - + ---- @@ -1470,7 +1471,7 @@ This will prevent a user from logging in multiple times - a second login will ca ... - + ---- @@ -1758,7 +1759,7 @@ The use of `protect-pointcut` is particularly powerful, as it allows you to appl ---- + access="ROLE_USER"/> ---- @@ -1822,7 +1823,7 @@ Another common requirement is that another bean in the context may require a ref + class="com.somecompany.security.web.CustomFormLoginFilter"> ... @@ -2075,21 +2076,21 @@ public static void main(String[] args) throws Exception { BufferedReader in = new BufferedReader(new InputStreamReader(System.in)); while(true) { - System.out.println("Please enter your username:"); - String name = in.readLine(); - System.out.println("Please enter your password:"); - String password = in.readLine(); - try { + System.out.println("Please enter your username:"); + String name = in.readLine(); + System.out.println("Please enter your password:"); + String password = in.readLine(); + try { Authentication request = new UsernamePasswordAuthenticationToken(name, password); Authentication result = am.authenticate(request); SecurityContextHolder.getContext().setAuthentication(result); break; - } catch(AuthenticationException e) { + } catch(AuthenticationException e) { System.out.println("Authentication failed: " + e.getMessage()); - } + } } System.out.println("Successfully authenticated. Security context contains: " + - SecurityContextHolder.getContext().getAuthentication()); + SecurityContextHolder.getContext().getAuthentication()); } } @@ -2102,10 +2103,10 @@ static { public Authentication authenticate(Authentication auth) throws AuthenticationException { if (auth.getName().equals(auth.getCredentials())) { - return new UsernamePasswordAuthenticationToken(auth.getName(), + return new UsernamePasswordAuthenticationToken(auth.getName(), auth.getCredentials(), AUTHORITIES); - } - throw new BadCredentialsException("Bad Credentials"); + } + throw new BadCredentialsException("Bad Credentials"); } } ---- @@ -2384,7 +2385,7 @@ Spring Security also includes a `UserDetailsService` that can obtain authenticat + class="org.springframework.security.core.userdetails.jdbc.JdbcDaoImpl"> ---- @@ -2471,16 +2472,16 @@ Spring Security's web infrastructure should only be used by delegating to an ins - - + + @@ -2567,13 +2568,13 @@ We've already seen `FilterSecurityInterceptor` briefly when discussing < + class="org.springframework.security.web.access.intercept.FilterSecurityInterceptor"> - - + + @@ -2590,14 +2591,14 @@ The `SecurityMetadataSource` created by the namespace syntax obtains the configu [source,xml] ---- + class="org.springframework.security.web.access.intercept.FilterSecurityInterceptor"> - - + + @@ -2624,7 +2625,7 @@ class="org.springframework.security.web.authentication.LoginUrlAuthenticationEnt + class="org.springframework.security.web.access.AccessDeniedHandlerImpl"> @@ -2679,7 +2680,7 @@ public interface SecurityContextRepository { SecurityContext loadContext(HttpRequestResponseHolder requestResponseHolder); void saveContext(SecurityContext context, HttpServletRequest request, - HttpServletResponse response); + HttpServletResponse response); } ---- @@ -2693,7 +2694,7 @@ The default implementation is `HttpSessionSecurityContextRepository`, which stor class="org.springframework.security.web.context.SecurityContextPersistenceFilter"> - + @@ -3123,16 +3124,16 @@ Now pretend you authenticate to your bank's website and then, without logging ou ----
+ name="amount" + value="100.00"/> + name="routingNumber" + value="evilsRoutingNumber"/> + name="account" + value="evilsAccountNumber"/> + value="Win Money!"/>
---- @@ -3177,7 +3178,7 @@ A common question is "do I need to protect JSON requests made by javascript?" Th
+ value="Win Money!"/>
---- @@ -3201,7 +3202,7 @@ If an application were not validating the Content-Type, then it would be exposed
+ value="Win Money!"/>
---- @@ -3252,7 +3253,7 @@ WebSecurityConfigurerAdapter { @Override protected void configure(HttpSecurity http) throws Exception { http - .csrf().disable(); + .csrf().disable(); } } ---- @@ -3368,12 +3369,12 @@ If you really want to use HTTP GET with logout you can do so, but remember this public class WebSecurityConfig extends WebSecurityConfigurerAdapter { -@Override -protected void configure(HttpSecurity http) throws Exception { - http - .logout() - .logoutRequestMatcher(new AntPathRequestMatcher("/logout")); -} + @Override + protected void configure(HttpSecurity http) throws Exception { + http + .logout() + .logoutRequestMatcher(new AntPathRequestMatcher("/logout")); + } } ---- @@ -3511,8 +3512,8 @@ WebSecurityConfigurerAdapter { @Override protected void configure(HttpSecurity http) throws Exception { http - // ... - .headers() + // ... + .headers() .frameOptions() .sameOrigin() .and() @@ -3549,9 +3550,9 @@ WebSecurityConfigurerAdapter { @Override protected void configure(HttpSecurity http) throws Exception { http - // ... - .headers() - // do not use any default headers unless explicitly listed + // ... + .headers() + // do not use any default headers unless explicitly listed .defaultsDisabled() .cacheControl(); } @@ -3583,8 +3584,8 @@ WebSecurityConfigurerAdapter { @Override protected void configure(HttpSecurity http) throws Exception { http - // ... - .headers().disable(); + // ... + .headers().disable(); } } ---- @@ -3636,8 +3637,8 @@ WebSecurityConfigurerAdapter { @Override protected void configure(HttpSecurity http) throws Exception { http - // ... - .headers() + // ... + .headers() .defaultsDisabled() .cacheControl(); } @@ -3708,8 +3709,8 @@ WebSecurityConfigurerAdapter { @Override protected void configure(HttpSecurity http) throws Exception { http - // ... - .headers() + // ... + .headers() .defaultsDisabled() .contentTypeOptions(); } @@ -3762,8 +3763,8 @@ WebSecurityConfigurerAdapter { @Override protected void configure(HttpSecurity http) throws Exception { http - // ... - .headers() + // ... + .headers() .httpStrictTransportSecurity() .includeSubdomains(true) .maxAgeSeconds(31536000); @@ -3802,7 +3803,7 @@ For example, the following will instruct Spring Security to use "X-Frame-Options + policy="SAMEORIGIN" /> ---- @@ -3818,8 +3819,8 @@ WebSecurityConfigurerAdapter { @Override protected void configure(HttpSecurity http) throws Exception { http - // ... - .headers() + // ... + .headers() .frameOptions() .sameOrigin(); } @@ -3861,8 +3862,8 @@ WebSecurityConfigurerAdapter { @Override protected void configure(HttpSecurity http) throws Exception { http - // ... - .headers() + // ... + .headers() .xssProtection() .block(false); } @@ -3892,12 +3893,12 @@ When using the XML namespace, these headers can be added to the response using t [source,xml] ---- - + - -
-
- + +
+
+ ---- @@ -3912,8 +3913,8 @@ WebSecurityConfigurerAdapter { @Override protected void configure(HttpSecurity http) throws Exception { http - // ... - .headers() + // ... + .headers() .addHeaderWriter(new StaticHeadersWriter("X-Content-Security-Policy","default-src 'self'")) .addHeaderWriter(new StaticHeadersWriter("X-WebKit-CSP","default-src 'self'")); } @@ -3956,8 +3957,8 @@ WebSecurityConfigurerAdapter { @Override protected void configure(HttpSecurity http) throws Exception { http - // ... - .headers() + // ... + .headers() .addHeaderWriter(new XFrameOptionsHeaderWriter(XFrameOptionsMode.SAMEORIGIN)); } } @@ -4010,8 +4011,8 @@ protected void configure(HttpSecurity http) throws Exception { DelegatingRequestMatcherHeaderWriter headerWriter = new DelegatingRequestMatcherHeaderWriter(matcher,new XFrameOptionsHeaderWriter()); http - // ... - .headers() + // ... + .headers() .frameOptions().disabled() .addHeaderWriter(headerWriter); } @@ -4079,7 +4080,7 @@ To use concurrent session support, you'll need to add the following to `web.xml` - org.springframework.security.web.session.HttpSessionEventPublisher + org.springframework.security.web.session.HttpSessionEventPublisher ---- @@ -4113,16 +4114,16 @@ class="org.springframework.security.web.session.ConcurrentSessionFilter"> - + - - - - + + + + - + @@ -4199,11 +4200,11 @@ As explained earlier, the benefit of anonymous authentication is that all URI pa - - - - - + + + + + " + @@ -4389,8 +4390,8 @@ You can of course configure a `MethodSecurityIterceptor` directly in your applic - - + + @@ -4415,8 +4416,8 @@ Let's first consider how the `AspectJSecurityInterceptor` is configured in the S - - + + @@ -4484,8 +4485,8 @@ You will need to configure Spring to load the aspect and wire it with the `Aspec ---- + class="security.samples.aspectj.DomainObjectInstanceSecurityAspect" + factory-method="aspectOf"> ---- @@ -4695,10 +4696,10 @@ There are some built-in expressions which are specific to method security, which [source,java] ---- boolean hasPermission(Authentication authentication, Object targetDomainObject, - Object permission); + Object permission); boolean hasPermission(Authentication authentication, Serializable targetId, - String targetType, Object permission); + String targetType, Object permission); ---- which map directly to the available versions of the expression, with the exception that the first argument (the `Authentication` object) is not supplied. The first is used in situations where the domain object, to which access is being controlled, is already loaded. Then expression will return true if the current user has the given permission for that object. The second version is used in cases where the object is not loaded, but its identifier is known. An abstract "type" specifier for the domain object is also required, allowing the correct ACL permissions to be loaded. This has traditionally been the Java class of the object, but does not have to be as long as it is consistent with how the permissions are loaded. @@ -4713,7 +4714,7 @@ To use `hasPermission()` expressions, you have to explicitly configure a `Permis - + ---- @@ -4919,8 +4920,8 @@ A typical configuration using this filter would look like this: - + class="org.springframework.security.core.userdetails.UserDetailsByNameServiceWrapper"> + @@ -5006,7 +5007,7 @@ This simple example would obtain the DN for the user by substituting the user lo [source,xml] ---- + user-search-base="ou=people"/> ---- If used with the server definition above, this would perform a search under the DN `ou=people,dc=springframework,dc=org` using the value of the `user-search-filter` attribute as a filter. Again the user login name is substituted for the parameter in the filter name, so it will search for an entry with the `uid` attribute equal to the user name. If `user-search-base` isn't supplied, the search will be performed from the root. @@ -5097,18 +5098,18 @@ A typical configuration, using some of the beans we've discussed here, might loo class="org.springframework.security.ldap.authentication.LdapAuthenticationProvider"> - - - uid={0},ou=people - + + + uid={0},ou=people + - - - + class="org.springframework.security.ldap.userdetails.DefaultLdapAuthoritiesPopulator"> + + + @@ -5141,7 +5142,7 @@ The net result of an authentication using `LdapAuthenticationProvider` is the sa public interface UserDetailsContextMapper { UserDetails mapUserFromContext(DirContextOperations ctx, String username, - Collection authorities); + Collection authorities); void mapUserToContext(UserDetails user, DirContextAdapter ctx); } @@ -5406,25 +5407,25 @@ class="org.springframework.security.authentication.jaas.DefaultJaasAuthenticatio - - - - + + + + - - + - - - - + + + + - - - + + + @@ -5465,14 +5466,14 @@ class="org.springframework.security.authentication.jaas.JaasAuthenticationProvid + class="org.springframework.security.authentication.jaas.JaasNameCallbackHandler"/> + class="org.springframework.security.authentication.jaas.JaasPasswordCallbackHandler"/> - + @@ -5545,9 +5546,9 @@ This section describes how to setup Spring Security to authenticate Service Tick [source,xml] ---- + class="org.springframework.security.cas.ServiceProperties"> + value="https://localhost:8443/cas-sample/login/cas"/> ---- @@ -5564,12 +5565,12 @@ The following beans should be configured to commence the CAS authentication proc + class="org.springframework.security.cas.web.CasAuthenticationFilter"> + class="org.springframework.security.cas.web.CasAuthenticationEntryPoint"> @@ -5588,16 +5589,16 @@ Next you need to add a `CasAuthenticationProvider` and its collaborators: + class="org.springframework.security.cas.authentication.CasAuthenticationProvider"> - + - + @@ -5634,11 +5635,11 @@ The CAS protocol supports Single Logout and can be easily added to your Spring S + class="org.springframework.security.web.authentication.logout.LogoutFilter"> + "org.springframework.security.web.authentication.logout.SecurityContextLogoutHandler"/> @@ -5713,10 +5714,10 @@ The next step is to update the `CasAuthenticationProvider` to be able to obtain ... - + - + value="https://localhost:8443/cas-sample/login/cas/proxyreceptor"/> + @@ -5771,7 +5772,7 @@ This section builds upon the previous sections to accomodate proxy ticket authen [source,xml] ---- + class="org.springframework.security.cas.ServiceProperties"> ... @@ -5782,13 +5783,13 @@ The next step is to specify `serviceProperties` and the `authenticationDetailsSo [source,xml] ---- + class="org.springframework.security.cas.web.CasAuthenticationFilter"> ... - + "org.springframework.security.cas.web.authentication.ServiceAuthenticationDetailsSource"> + @@ -5804,23 +5805,23 @@ You will also need to update the `CasAuthenticationProvider` to handle proxy tic ... - - + + - + - - - - - - + + + + + + - + @@ -6152,7 +6153,7 @@ private Executor executor; // becomes an instance of our DelegatingSecurityConte public void submitRunnable() { Runnable originalRunnable = new Runnable() { public void run() { - // invoke secured service + // invoke secured service } }; executor.execute(originalRunnable); @@ -6217,7 +6218,7 @@ import org.springframework.security.web.bind.annotation.AuthenticationPrincipal; @RequestMapping("/messages/inbox") public ModelAndView findMessagesForUser() { Authentication authentication = - SecurityContextHolder.getContext().getAuthentication(); + SecurityContextHolder.getContext().getAuthentication(); CustomUser custom = (CustomUser) authentication == null ? null : authentication.getPrincipal(); // .. find messags for this user and return them ... @@ -6272,8 +6273,8 @@ public Callable processUpload(final MultipartFile file) { return new Callable() { public Object call() throws Exception { - // ... - return "someView"; + // ... + return "someView"; } }; } @@ -6306,9 +6307,9 @@ Spring Security will automatically < - -