From a55267f867e1565f6b096f7b64add92399225ec7 Mon Sep 17 00:00:00 2001 From: Romil Patel Date: Sat, 11 Jul 2020 11:44:47 +0530 Subject: [PATCH] WebSecurityConfigurerAdapter JavaDoc Closes gh-8784 --- .../configuration/WebSecurityConfigurerAdapter.java | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/config/src/main/java/org/springframework/security/config/annotation/web/configuration/WebSecurityConfigurerAdapter.java b/config/src/main/java/org/springframework/security/config/annotation/web/configuration/WebSecurityConfigurerAdapter.java index 8943fa6dd9..37aa1f5929 100644 --- a/config/src/main/java/org/springframework/security/config/annotation/web/configuration/WebSecurityConfigurerAdapter.java +++ b/config/src/main/java/org/springframework/security/config/annotation/web/configuration/WebSecurityConfigurerAdapter.java @@ -330,6 +330,15 @@ public abstract class WebSecurityConfigurerAdapter implements /** * Override this method to configure {@link WebSecurity}. For example, if you wish to * ignore certain requests. + * + * Endpoint used in this method ignores the + * spring security filters, headers, csrf etc. see + * {@link org.springframework.security.config.annotation.web.configurers.HeadersConfigurer} and + * {@link org.springframework.security.config.annotation.web.configurers.CsrfConfigurer } + * + * Instead, if you want to protect public endpoints against common vulnerabilities, then see + * {@link #configure(HttpSecurity)} and the {@link HttpSecurity#authorizeRequests} + * configuration method. */ public void configure(WebSecurity web) throws Exception { } @@ -343,6 +352,10 @@ public abstract class WebSecurityConfigurerAdapter implements * http.authorizeRequests().anyRequest().authenticated().and().formLogin().and().httpBasic(); * * + * Public endpoints that require defense against common vulnerabilities can be specified here. + * See {@link HttpSecurity#authorizeRequests} and the `permitAll()` authorization rule + * for more details. + * * @param http the {@link HttpSecurity} to modify * @throws Exception if an error occurs */