Cwikius-Spring/spring-security
1
0
Fork 0
mirror of https://github.com/spring-projects/spring-security.git synced 2025-06-12 07:02:13 +00:00
Code Issues Packages Projects Releases Wiki Activity

Added note in namespace docs on mismatch between using filters="none" and other attributes.

Browse Source
This commit is contained in:
Luke Taylor 2011-06-06 12:37:52 +01:00
parent d5f1f6cbff
commit dfbc938e99
1 changed files with 16 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
docs/manual/src/docbook/namespace-config.xml
View File

@ -259,7 +259,22 @@
attributes such as <literal>requires-channel</literal>, so you will not be able to access
information on the current user or call secured methods during the request. Use
<literal>access='IS_AUTHENTICATED_ANONYMOUSLY'</literal> as an alternative if you still
want the security filter chain to be applied.</para>
want the security filter chain to be applied.
<note>
<para>Using <literal>filters="none"</literal> operates by creating an empty filter
chain in Spring Security's <classname>FilterChainProxy</classname>, whereas
the access attributes are used to configure the
<classname>FilterSecurityInterceptor</classname> in the single filter chain
which is created by the namespace configuration. The two are applied
independently, so if you have an access contraint for a sub-pattern of a
pattern which has a <literal>filters="none"</literal> attribute, the access
constraint will be ignored, even if it is listed first. It isn't possible to
apply a <literal>filters="none"</literal> attribute to the pattern
<literal>/**</literal> since this is used by the namespace filter chain. In
version 3.1 things are more flexible. You can define multiple filter chains
and the <literal>filters</literal> attribute is no longer supported.</para>
</note>
</para>
<para>If you want to use basic authentication instead of form login, then change the
configuration to <programlisting language="xml"><![CDATA[
<http auto-config='true'>