81 lines
1.8 KiB
Plaintext
81 lines
1.8 KiB
Plaintext
[[servlet-http]]
|
|
= HTTP
|
|
|
|
All HTTP based communication should be protected xref:features/exploits/http.adoc#http[using TLS].
|
|
|
|
Below you can find details around Servlet specific features that assist with HTTPS usage.
|
|
|
|
[[servlet-http-redirect]]
|
|
== Redirect to HTTPS
|
|
|
|
If a client makes a request using HTTP rather than HTTPS, Spring Security can be configured to redirect to HTTPS.
|
|
|
|
For example, the following Java configuration will redirect any HTTP requests to HTTPS:
|
|
|
|
.Redirect to HTTPS
|
|
[tabs]
|
|
======
|
|
Java::
|
|
+
|
|
[source,java,role="primary"]
|
|
----
|
|
@Configuration
|
|
@EnableWebSecurity
|
|
public class WebSecurityConfig {
|
|
|
|
@Bean
|
|
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
|
|
http
|
|
// ...
|
|
.requiresChannel(channel -> channel
|
|
.anyRequest().requiresSecure()
|
|
);
|
|
return http.build();
|
|
}
|
|
}
|
|
----
|
|
|
|
Kotlin::
|
|
+
|
|
[source,kotlin,role="secondary"]
|
|
----
|
|
@Configuration
|
|
@EnableWebSecurity
|
|
class SecurityConfig {
|
|
|
|
@Bean
|
|
open fun filterChain(http: HttpSecurity): SecurityFilterChain {
|
|
http {
|
|
// ...
|
|
requiresChannel {
|
|
secure(AnyRequestMatcher.INSTANCE, "REQUIRES_SECURE_CHANNEL")
|
|
}
|
|
}
|
|
return http.build()
|
|
}
|
|
}
|
|
----
|
|
======
|
|
|
|
The following XML configuration will redirect all HTTP requests to HTTPS
|
|
|
|
.Redirect to HTTPS with XML Configuration
|
|
[source,xml]
|
|
----
|
|
<http>
|
|
<intercept-url pattern="/**" access="ROLE_USER" requires-channel="https"/>
|
|
...
|
|
</http>
|
|
----
|
|
|
|
|
|
[[servlet-hsts]]
|
|
== Strict Transport Security
|
|
|
|
Spring Security provides support for xref:servlet/exploits/headers.adoc#servlet-headers-hsts[Strict Transport Security] and enables it by default.
|
|
|
|
[[servlet-http-proxy-server]]
|
|
== Proxy Server Configuration
|
|
|
|
Spring Security xref:features/exploits/http.adoc#http-proxy-server[integrates with proxy servers].
|