|
|
|
@ -1239,8 +1239,8 @@ the classes imported from there (`SpringBootWebSecurityConfiguration` for web se
|
|
|
|
|
and `AuthenticationManagerConfiguration` for authentication configuration which is also
|
|
|
|
|
relevant in non-web applications). To switch off the Boot default configuration
|
|
|
|
|
completely in a web application you can add a bean with `@EnableWebSecurity`. To customize
|
|
|
|
|
it you normally use external properties and beans of type `WebConfigurerAdapter` (e.g. to
|
|
|
|
|
add form-based login). There are several secure applications in the
|
|
|
|
|
it you normally use external properties and beans of type `WebSecurityConfigurerAdapter`
|
|
|
|
|
(e.g. to add form-based login). There are several secure applications in the
|
|
|
|
|
{github-code}/spring-boot-samples/[Spring Boot samples] to get you started with common
|
|
|
|
|
use cases.
|
|
|
|
|
|
|
|
|
@ -1258,7 +1258,7 @@ The basic features you get out of the box in a web application are:
|
|
|
|
|
|
|
|
|
|
All of the above can be switched on and off or modified using external properties
|
|
|
|
|
(`+security.*+`). To override the access rules without changing any other autoconfigured
|
|
|
|
|
features add a `@Bean` of type `WebConfigurerAdapter` with
|
|
|
|
|
features add a `@Bean` of type `WebSecurityConfigurerAdapter` with
|
|
|
|
|
`@Order(SecurityProperties.ACCESS_OVERRIDE_ORDER)`.
|
|
|
|
|
|
|
|
|
|
If the Actuator is also in use, you will find:
|
|
|
|
@ -1269,7 +1269,7 @@ If the Actuator is also in use, you will find:
|
|
|
|
|
|
|
|
|
|
The Actuator security features can be modified using external properties
|
|
|
|
|
(`+management.security.*+`). To override the application access rules
|
|
|
|
|
add a `@Bean` of type `WebConfigurerAdapter` and use
|
|
|
|
|
add a `@Bean` of type `WebSecurityConfigurerAdapter` and use
|
|
|
|
|
`@Order(SecurityProperties.ACCESS_OVERRIDE_ORDER)` if you _don't_ want to override
|
|
|
|
|
the actuator access rules, or `@Order(ManagementServerProperties.ACCESS_OVERRIDE_ORDER)`
|
|
|
|
|
if you _do_ want to override the actuator access rules.
|
|
|
|
|