root
/
spring-boot
mirror of https://github.com/spring-projects/spring-boot.git
1
0
Fork 0
Code Issues Actions 12 Packages Projects Releases Wiki Activity

Add /webjars/** to default list of unsecured resources 

Fixes gh-2460
This commit is contained in:
Dave Syer 2016-06-14 10:31:09 +01:00
parent 9e8beb7323
commit a3b29b0e42
3 changed files with 4 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/security/SpringBootWebSecurityConfiguration.java
View File

@ -88,7 +88,7 @@ import org.springframework.util.StringUtils;
public class SpringBootWebSecurityConfiguration { public class SpringBootWebSecurityConfiguration {
private static List<String> DEFAULT_IGNORED = Arrays.asList("/css/**", "/js/**", private static List<String> DEFAULT_IGNORED = Arrays.asList("/css/**", "/js/**",
"/images/**", "/**/favicon.ico"); "/images/**", "/webjars/**", "/**/favicon.ico");
@Bean @Bean
@ConditionalOnMissingBean({ IgnoredPathsWebSecurityConfigurerAdapter.class }) @ConditionalOnMissingBean({ IgnoredPathsWebSecurityConfigurerAdapter.class })

4
spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/security/SecurityAutoConfigurationTests.java
View File

@ -90,9 +90,9 @@ public class SecurityAutoConfigurationTests {
PropertyPlaceholderAutoConfiguration.class); PropertyPlaceholderAutoConfiguration.class);
this.context.refresh(); this.context.refresh();
assertThat(this.context.getBean(AuthenticationManagerBuilder.class)).isNotNull(); assertThat(this.context.getBean(AuthenticationManagerBuilder.class)).isNotNull();
// 4 for static resources and one for the rest // 5 for static resources and one for the rest
assertThat(this.context.getBean(FilterChainProxy.class).getFilterChains()) assertThat(this.context.getBean(FilterChainProxy.class).getFilterChains())
.hasSize(5); .hasSize(6);
} }
@Test @Test

2
spring-boot-docs/src/main/asciidoc/spring-boot-features.adoc
View File

@ -2181,7 +2181,7 @@ The basic features you get out of the box in a web application are:
* An `AuthenticationManager` bean with in-memory store and a single user (see * An `AuthenticationManager` bean with in-memory store and a single user (see
`SecurityProperties.User` for the properties of the user). `SecurityProperties.User` for the properties of the user).
* Ignored (insecure) paths for common static resource locations (`+/css/**+`, `+/js/**+`, * Ignored (insecure) paths for common static resource locations (`+/css/**+`, `+/js/**+`,
`+/images/**+` and `+**/favicon.ico+`). `+/images/**+`, `+/webjars/**+` and `+**/favicon.ico+`).
* HTTP Basic security for all other endpoints. * HTTP Basic security for all other endpoints.
* Security events published to Spring's `ApplicationEventPublisher` (successful and * Security events published to Spring's `ApplicationEventPublisher` (successful and
unsuccessful authentication and access denied). unsuccessful authentication and access denied).