Go to file
Daniel Garnier-Moiroux 93250013e4
Make X-Xss-Protection configurable through ServerHttpSecurity
OWASP recommends using "X-Xss-Protection: 0". The default is currently
"X-Xss-Protection: 1; mode=block". In 6.0, the default will be "0".

This commits adds the ability to configure the xssProtection header
value in ServerHttpSecurity.

This commit deprecates the use of "enabled" and "block" booleans to
configure XSS protection, as the state "!enabled + block" is invalid.
This impacts HttpSecurity.

Issue gh-9631
2022-09-30 09:38:08 -05:00
.github Simplify checkSamples task 2022-09-16 09:36:12 -03:00
.idea
acl Remove mockito deprecations 2022-08-23 15:59:52 -05:00
aspects Deprecate AccessDecisionManager et al 2022-09-20 16:09:59 -06:00
bom
buildSrc Update junit-bom to 5.9.0 2022-09-16 13:39:02 -05:00
cas Fix mockito 4.7.0 merge 2022-08-24 08:58:00 -05:00
config Make X-Xss-Protection configurable through ServerHttpSecurity 2022-09-30 09:38:08 -05:00
core Simplify AuthorizationManager composition 2022-09-20 16:24:45 -06:00
crypto Remove mockito deprecations 2022-08-23 15:59:52 -05:00
data Use SecurityContextHolderStrategy for Data 2022-06-27 16:35:02 -06:00
dependencies Update htmlunit-driver to 2.64.0 2022-09-16 13:39:03 -05:00
docs Merge branch '5.7.x' into 5.8.x 2022-09-29 14:09:10 -05:00
etc CsrfTokenRequestAttributeHandler -> CsrfTokenRequestHandler 2022-09-22 11:09:44 -05:00
git/hooks Use 6.0.x instead of 3.0.x as default branch 2022-08-24 16:38:27 -05:00
gradle/wrapper
itest
ldap Use SecurityContextHolderStrategy for Ldap 2022-06-27 15:55:27 -06:00
messaging Add remaining methods from ExpressionUrlAuthorizationConfigurer to MessageMatcherDelegatingAuthorizationManager 2022-08-16 15:14:08 -06:00
oauth2 Reduce severity of invalid registrationId to warn 2022-09-26 09:56:20 -05:00
openid
remoting
rsocket Adjust OAuth2 Resource Server packaging 2022-09-23 16:31:21 -06:00
saml2/saml2-service-provider Move Saml2 Authentication Filters 2022-09-26 10:44:27 -06:00
scripts
taglibs Use SecurityContextHolderStrategy for Taglibs 2022-06-27 17:45:01 -06:00
test CsrfTokenRequestHandler extends CsrfTokenRequestResolver 2022-09-23 15:09:00 -05:00
web Make X-Xss-Protection configurable through ServerHttpSecurity 2022-09-30 09:38:08 -05:00
.editorconfig
.gitattributes
.gitignore
.sdkmanrc
CONTRIBUTING.adoc Setup Forward Merge 2022-08-22 16:19:44 -05:00
LICENSE.txt
README.adoc
RELEASE.adoc Document sagan Release tasks require read:org scope 2022-06-21 14:47:46 -05:00
build.gradle Update aspectj-plugin to 6.5.1 2022-09-16 13:38:58 -05:00
class_mapping_from_2.0.x.txt
gradle.properties Next development version 2022-09-19 16:55:17 +00:00
gradlew
gradlew.bat
notice.txt
settings.gradle Update Gradle Enterprise plugin to 3.11.1 2022-09-16 13:14:53 -03:00

README.adoc

image::https://badges.gitter.im/Join%20Chat.svg[Gitter,link=https://gitter.im/spring-projects/spring-security?utm_source=badge&utm_medium=badge&utm_campaign=pr-badge&utm_content=badge]

image:https://github.com/spring-projects/spring-security/workflows/CI/badge.svg?branch=main["Build Status", link="https://github.com/spring-projects/spring-security/actions?query=workflow%3ACI"]

image:https://img.shields.io/badge/Revved%20up%20by-Gradle%20Enterprise-06A0CE?logo=Gradle&labelColor=02303A["Revved up by Gradle Enterprise", link="https://ge.spring.io/scans?search.rootProjectNames=spring-security"]

= Spring Security

Spring Security provides security services for the https://docs.spring.io[Spring IO Platform]. Spring Security 5.0 requires Spring 5.0 as
a minimum and also requires Java 8.

For a detailed list of features and access to the latest release, please visit https://spring.io/projects[Spring projects].

== Code of Conduct
Please see our https://github.com/spring-projects/.github/blob/main/CODE_OF_CONDUCT.md[code of conduct]

== Downloading Artifacts
See https://docs.spring.io/spring-security/site/docs/current/reference/html5/#getting[Getting Spring Security] for how to obtain Spring Security.

== Documentation
Be sure to read the https://docs.spring.io/spring-security/site/docs/current/reference/htmlsingle/[Spring Security Reference].
Extensive JavaDoc for the Spring Security code is also available in the https://docs.spring.io/spring-security/site/docs/current/api/[Spring Security API Documentation].

== Quick Start
See https://docs.spring.io/spring-security/site/docs/current/reference/html5/#servlet-hello[Hello Spring Security] to get started with a "Hello, World" application.

== Building from Source
Spring Security uses a https://gradle.org[Gradle]-based build system.
In the instructions below, https://vimeo.com/34436402[`./gradlew`] is invoked from the root of the source tree and serves as
a cross-platform, self-contained bootstrap mechanism for the build.

=== Prerequisites
https://help.github.com/set-up-git-redirect[Git] and the https://www.oracle.com/technetwork/java/javase/downloads[JDK11 build].

Be sure that your `JAVA_HOME` environment variable points to the `jdk-11` folder extracted from the JDK download.

=== Check out sources
[indent=0]
----
git clone git@github.com:spring-projects/spring-security.git
----

=== Install all spring-\* jars into your local Maven cache
[indent=0]
----
./gradlew publishToMavenLocal
----

=== Compile and test; build all jars, distribution zips, and docs
[indent=0]
----
./gradlew build
----

Discover more commands with `./gradlew tasks`.
See also the https://github.com/spring-projects/spring-framework/wiki/Gradle-build-and-release-FAQ[Gradle build and release FAQ].

== Getting Support
Check out the https://stackoverflow.com/questions/tagged/spring-security[Spring Security tags on Stack Overflow].
https://spring.io/services[Commercial support] is available too.

== Contributing
https://help.github.com/articles/creating-a-pull-request[Pull requests] are welcome; see the https://github.com/spring-projects/spring-security/blob/main/CONTRIBUTING.adoc[contributor guidelines] for details.

== License
Spring Security is Open Source software released under the
https://www.apache.org/licenses/LICENSE-2.0.html[Apache 2.0 license].