mirror of
https://github.com/spring-projects/spring-security.git
synced 2025-07-01 16:22:15 +00:00
1f90df6a14
find -name "*.adoc" | xargs -I{file} awk -v file={file} '/\[\[/ { gsub("\[|\]", ""); id=$0; gsub("./docs/modules/ROOT/pages/", "", file); gsub("\[|\]", ""); id=$0;getline;text=$0; sub("^=+ ","", text); print file > "build/ids/"id".id"; print text > "build/ids/"id".text" }' {file}
find docs/modules -name "*.adoc"|while read adoc_file_to_replace; do
echo "Replacing $adoc_file_to_replace"
for id_file in build/ids/*.id; do
id=$(basename $id_file | sed 's/\.id$//')
xref_page=$(cat $id_file)
if [[ "$adoc_file_to_replace" -ef "./docs/modules/ROOT/pages/$xref_page" ]]
then
echo " - Skipping same page refid $id "
else
sed -i -E "s%<<$id(|,([^,>]+))>>%xref:${xref_page}#${id}[\2]%g" $adoc_file_to_replace
fi
done
done
88 lines
2.2 KiB
Plaintext
88 lines
2.2 KiB
Plaintext
[[webflux-http]]
|
|
= HTTP
|
|
|
|
All HTTP based communication should be protected xref:overview/features/exploits/http.adoc#http[using TLS].
|
|
|
|
Below you can find details around WebFlux specific features that assist with HTTPS usage.
|
|
|
|
[[webflux-http-redirect]]
|
|
== Redirect to HTTPS
|
|
|
|
If a client makes a request using HTTP rather than HTTPS, Spring Security can be configured to redirect to HTTPS.
|
|
|
|
For example, the following Java configuration will redirect any HTTP requests to HTTPS:
|
|
|
|
.Redirect to HTTPS
|
|
====
|
|
.Java
|
|
[source,java,role="primary"]
|
|
----
|
|
@Bean
|
|
SecurityWebFilterChain springSecurityFilterChain(ServerHttpSecurity http) {
|
|
http
|
|
// ...
|
|
.redirectToHttps(withDefaults());
|
|
return http.build();
|
|
}
|
|
----
|
|
|
|
.Kotlin
|
|
[source,kotlin,role="secondary"]
|
|
----
|
|
@Bean
|
|
fun springSecurityFilterChain(http: ServerHttpSecurity): SecurityWebFilterChain {
|
|
return http {
|
|
// ...
|
|
redirectToHttps { }
|
|
}
|
|
}
|
|
----
|
|
====
|
|
|
|
The configuration can easily be wrapped around an if statement to only be turned on in production.
|
|
Alternatively, it can be enabled by looking for a property about the request that only happens in production.
|
|
For example, if the production environment adds a header named `X-Forwarded-Proto` the following Java Configuration could be used:
|
|
|
|
.Redirect to HTTPS when X-Forwarded
|
|
====
|
|
.Java
|
|
[source,java,role="primary"]
|
|
----
|
|
@Bean
|
|
SecurityWebFilterChain springSecurityFilterChain(ServerHttpSecurity http) {
|
|
http
|
|
// ...
|
|
.redirectToHttps(redirect -> redirect
|
|
.httpsRedirectWhen(e -> e.getRequest().getHeaders().containsKey("X-Forwarded-Proto"))
|
|
);
|
|
return http.build();
|
|
}
|
|
----
|
|
|
|
.Kotlin
|
|
[source,kotlin,role="secondary"]
|
|
----
|
|
@Bean
|
|
fun springSecurityFilterChain(http: ServerHttpSecurity): SecurityWebFilterChain {
|
|
return http {
|
|
// ...
|
|
redirectToHttps {
|
|
httpsRedirectWhen {
|
|
it.request.headers.containsKey("X-Forwarded-Proto")
|
|
}
|
|
}
|
|
}
|
|
}
|
|
----
|
|
====
|
|
|
|
[[webflux-hsts]]
|
|
== Strict Transport Security
|
|
|
|
Spring Security provides support for xref:servlet/exploits/headers.adoc#servlet-headers-hsts[Strict Transport Security] and enables it by default.
|
|
|
|
[[webflux-http-proxy-server]]
|
|
== Proxy Server Configuration
|
|
|
|
Spring Security xref:overview/features/exploits/http.adoc#http-proxy-server[integrates with proxy servers].
|