浏览代码

Add servlet HTTP exploit samples

Issue gh-8172
Eleftheria Stein 5 年之前
父节点
当前提交
019c27b0a0
共有 1 个文件被更改,包括 21 次插入2 次删除
  1. 21 2
      docs/manual/src/docs/asciidoc/_includes/servlet/exploits/http.adoc

+ 21 - 2
docs/manual/src/docs/asciidoc/_includes/servlet/exploits/http.adoc

@@ -12,9 +12,10 @@ If a client makes a request using HTTP rather than HTTPS, Spring Security can be
 
 For example, the following Java configuration will redirect any HTTP requests to HTTPS:
 
-.Redirect to HTTPS with Java Configuration
+.Redirect to HTTPS
 ====
-[source,java]
+.Java
+[source,java,role="primary"]
 ----
 @Configuration
 @EnableWebSecurity
@@ -31,6 +32,24 @@ public class WebSecurityConfig extends
 	}
 }
 ----
+
+.Kotlin
+[source,kotlin,role="secondary"]
+----
+@Configuration
+@EnableWebSecurity
+class SecurityConfig : WebSecurityConfigurerAdapter() {
+
+    override fun configure(http: HttpSecurity) {
+        http {
+            // ...
+            requiresChannel {
+                secure(AnyRequestMatcher.INSTANCE, "REQUIRES_SECURE_CHANNEL")
+            }
+        }
+    }
+}
+----
 ====
 
 The following XML configuration will redirect all HTTP requests to HTTPS