Cwikius-Spring/spring-security
1
0
Fork 0
mirror of https://github.com/spring-projects/spring-security.git synced 2025-06-13 23:52:14 +00:00
Code Issues Packages Projects Releases Wiki Activity

Added note in namespace docs on mismatch between using filters="none" and other attributes.

Browse Source
This commit is contained in:
Luke Taylor 2011-06-06 12:37:52 +01:00
parent d5f1f6cbff
commit dfbc938e99
1 changed files with 16 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
docs/manual/src/docbook/namespace-config.xml
View File

@ -259,7 +259,22 @@
attributes such as <literal>requires-channel</literal>, so you will not be able to access attributes such as <literal>requires-channel</literal>, so you will not be able to access
information on the current user or call secured methods during the request. Use information on the current user or call secured methods during the request. Use
<literal>access='IS_AUTHENTICATED_ANONYMOUSLY'</literal> as an alternative if you still <literal>access='IS_AUTHENTICATED_ANONYMOUSLY'</literal> as an alternative if you still
want the security filter chain to be applied.</para> want the security filter chain to be applied.
<note>
<para>Using <literal>filters="none"</literal> operates by creating an empty filter
chain in Spring Security's <classname>FilterChainProxy</classname>, whereas
the access attributes are used to configure the
<classname>FilterSecurityInterceptor</classname> in the single filter chain
which is created by the namespace configuration. The two are applied
independently, so if you have an access contraint for a sub-pattern of a
pattern which has a <literal>filters="none"</literal> attribute, the access
constraint will be ignored, even if it is listed first. It isn't possible to
apply a <literal>filters="none"</literal> attribute to the pattern
<literal>/**</literal> since this is used by the namespace filter chain. In
version 3.1 things are more flexible. You can define multiple filter chains
and the <literal>filters</literal> attribute is no longer supported.</para>
</note>
</para>
<para>If you want to use basic authentication instead of form login, then change the <para>If you want to use basic authentication instead of form login, then change the
configuration to <programlisting language="xml"><![CDATA[ configuration to <programlisting language="xml"><![CDATA[
<http auto-config='true'> <http auto-config='true'>