12 lines
670 B
Plaintext
12 lines
670 B
Plaintext
|
= Exploit Protection Migrations
|
||
|
|
|
||
|
|
The following steps relate to how to finish migrating exploit protection support.
|
||
|
|
|
||
|
|
== CSRF BREACH with WebSocket support
|
||
|
|
|
||
|
|
In Spring Security 5.8, the default `ChannelInterceptor` for making the `CsrfToken` available with xref:servlet/integrations/websocket.adoc[WebSocket Security] is `CsrfChannelInterceptor`.
|
||
|
|
`XorCsrfChannelInterceptor` was added to allow opting into CSRF BREACH support.
|
||
|
|
|
||
|
|
In Spring Security 6, `XorCsrfChannelInterceptor` is the default `ChannelInterceptor` for making the `CsrfToken` available.
|
||
|
|
If you configured the `XorCsrfChannelInterceptor` only for the purpose of updating to 6.0, you can remove it completely.
|