Web Application Security

<debug>

Enables Spring Security debugging infrastructure. This will provide human-readable (multi-line) debugging information to monitor requests coming into the security filters. This may include sensitive information, such as request parameters or headers, and should only be used in a development environment.

<http>

If you use an <http> element within your application, a FilterChainProxy bean named "springSecurityFilterChain" is created and the configuration within the element is used to build a filter chain within FilterChainProxy. As of Spring Security 3.1, additional http elements can be used to add extra filter chains [1] for how to set up the mapping from your web.xml ]. Some core filters are always created in a filter chain and others will be added to the stack depending on the attributes and child elements which are present. The positions of the standard filters are fixed (see the filter order table in the namespace introduction), removing a common source of errors with previous versions of the framework when users had to configure the filter chain explicitly in the FilterChainProxy bean. You can, of course, still do this if you need full control of the configuration.

All filters which require a reference to the AuthenticationManager will be automatically injected with the internal instance created by the namespace configuration.

Each <http> namespace block always creates an SecurityContextPersistenceFilter, an ExceptionTranslationFilter and a FilterSecurityInterceptor. These are fixed and cannot be replaced with alternatives.

<http> Attributes

The attributes on the <http> element control some of the properties on the core filters.

  • use-authorization-manager Use AuthorizationManager API instead of SecurityMetadataSource (defaults to true)

  • authorization-manager-ref Use this AuthorizationManager instead of deriving one from <intercept-url> elements

  • access-decision-manager-ref Optional attribute specifying the ID of the AccessDecisionManager implementation which should be used for authorizing HTTP requests. By default an AffirmativeBased implementation is used for with a RoleVoter and an AuthenticatedVoter.

  • authentication-manager-ref A reference to the AuthenticationManager used for the FilterChain created by this http element.

  • observation-registry-ref A reference to the ObservationRegistry used for the FilterChain and related components

  • auto-config Automatically registers a login form, BASIC authentication, logout services. If set to "true", all of these capabilities are added (although you can still customize the configuration of each by providing the respective element). If unspecified, defaults to "false". Use of this attribute is not recommended. Use explicit configuration elements instead to avoid confusion.

  • create-session Controls the eagerness with which an HTTP session is created by Spring Security classes. Options include:

    • always - Spring Security will proactively create a session if one does not exist.

    • ifRequired - Spring Security will only create a session only if one is required (default value).

    • never - Spring Security will never create a session, but will make use of one if the application does.

    • stateless - Spring Security will not create a session and ignore the session for obtaining a Spring Authentication.

  • disable-url-rewriting Prevents session IDs from being appended to URLs in the application. Clients must use cookies if this attribute is set to true. The default is true.

  • entry-point-ref Normally the AuthenticationEntryPoint used will be set depending on which authentication mechanisms have been configured. This attribute allows this behaviour to be overridden by defining a customized AuthenticationEntryPoint bean which will start the authentication process.

  • jaas-api-provision If available, runs the request as the Subject acquired from the JaasAuthenticationToken which is implemented by adding a JaasApiIntegrationFilter bean to the stack. Defaults to false.

  • name A bean identifier, used for referring to the bean elsewhere in the context.

  • once-per-request Corresponds to the observeOncePerRequest property of FilterSecurityInterceptor. Defaults to false.

  • filter-all-dispatcher-types Corresponds to the shouldFilterAllDispatcherTypes property of the AuthorizationFilter. Does not work when use-authorization-manager=false. Defaults to true.

  • pattern Defining a pattern for the http element controls the requests which will be filtered through the list of filters which it defines. The interpretation is dependent on the configured request-matcher. If no pattern is defined, all requests will be matched, so the most specific patterns should be declared first.

  • realm Sets the realm name used for basic authentication (if enabled). Corresponds to the realmName property on BasicAuthenticationEntryPoint.

  • redirect-to-https-request-matcher-ref A reference to a bean that implements RequestMatcher that will determine which requests must redirect to HTTPS. This is helpful when, for example, wanting to run HTTP locally and HTTPS in production using a request header.

  • request-matcher Defines the RequestMatcher strategy used in the FilterChainProxy and the beans created by the intercept-url to match incoming requests. Options are currently mvc, ant, regex and ciRegex, for Spring MVC, ant, regular-expression and case-insensitive regular-expression respectively. A separate instance is created for each intercept-url element using its pattern, method and servlet-path attributes. By default, paths are matched using a PathPatternRequestMatcher; however, regular expressions are matched using a RegexRequestMatcher. See the Javadoc for these classes for more details on exactly how the matching is performed. MVC is the default strategy if Spring MVC is present in the classpath, if not, Ant paths are used.

  • request-matcher-ref A reference to a bean that implements RequestMatcher that will determine if this FilterChain should be used. This is a more powerful alternative to pattern.

  • security A request pattern can be mapped to an empty filter chain, by setting this attribute to none. No security will be applied and none of Spring Security’s features will be available.

  • security-context-repository-ref Allows injection of a custom SecurityContextHolderStrategy into SecurityContextPersistenceFilter, SecurityContextHolderFilter, BasicAuthenticationFilter, UsernamePasswordAuthenticationFilter, ExceptionTranslationFilter, LogoutFilter, and others.

  • security-context-explicit-save If true, use SecurityContextHolderFilter instead of SecurityContextPersistenceFilter. Requires explicit save

  • security-context-repository-ref Allows injection of a custom SecurityContextRepository into the SecurityContextPersistenceFilter.

  • servlet-api-provision Provides versions of HttpServletRequest security methods such as isUserInRole() and getPrincipal() which are implemented by adding a SecurityContextHolderAwareRequestFilter bean to the stack. Defaults to true.

  • use-expressions Enables EL-expressions in the access attribute, as described in the chapter on expression-based access-control. The default value is true.

Child Elements of <http>