Cwikius-Spring/spring-security
1
0
Fork 0
mirror of https://github.com/spring-projects/spring-security.git synced 2025-06-14 08:02:22 +00:00
Code Issues Packages Projects Releases Wiki Activity

Polish WebSecurityConfigurerAdapter JavaDoc

Browse Source 
Issue gh-8784
This commit is contained in:
Josh Cummings 2020-07-20 15:19:25 -06:00
parent 0c85dd9cd1
commit e937366f50
No known key found for this signature in database
GPG Key ID: 49EF60DD7FF83443
1 changed files with 5 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
config/src/main/java/org/springframework/security/config/annotation/web/configuration/WebSecurityConfigurerAdapter.java
View File

@ -333,12 +333,10 @@ public abstract class WebSecurityConfigurerAdapter implements
* Override this method to configure {@link WebSecurity}. For example, if you wish to * Override this method to configure {@link WebSecurity}. For example, if you wish to
* ignore certain requests. * ignore certain requests.
* *
* Endpoint used in this method ignores the * Endpoints specified in this method will be ignored by Spring Security, meaning it
* spring security filters, headers, csrf etc. see * will not protect them from CSRF, XSS, Clickjacking, and so on.
* {@link org.springframework.security.config.annotation.web.configurers.HeadersConfigurer} and
* {@link org.springframework.security.config.annotation.web.configurers.CsrfConfigurer }
* *
* Instead, if you want to protect public endpoints against common vulnerabilities, then see * Instead, if you want to protect endpoints against common vulnerabilities, then see
* {@link #configure(HttpSecurity)} and the {@link HttpSecurity#authorizeRequests} * {@link #configure(HttpSecurity)} and the {@link HttpSecurity#authorizeRequests}
* configuration method. * configuration method.
*/ */
@ -354,9 +352,9 @@ public abstract class WebSecurityConfigurerAdapter implements
* http.authorizeRequests().anyRequest().authenticated().and().formLogin().and().httpBasic(); * http.authorizeRequests().anyRequest().authenticated().and().formLogin().and().httpBasic();
* </pre> * </pre>
* *
* Public endpoints that require defense against common vulnerabilities can be specified here. * Any endpoint that requires defense against common vulnerabilities can be specified here, including public ones.
* See {@link HttpSecurity#authorizeRequests} and the `permitAll()` authorization rule * See {@link HttpSecurity#authorizeRequests} and the `permitAll()` authorization rule
* for more details. * for more details on public endpoints.
* *
* @param http the {@link HttpSecurity} to modify * @param http the {@link HttpSecurity} to modify
* @throws Exception if an error occurs * @throws Exception if an error occurs