Home Explore Help
Register Sign In
github
/
spring-security
mirror of https://github.com/spring-projects/spring-security
2
0
Fork 0
Files Issues 0 Wiki
Browse Source

SEC-2653: ldap-xml logout is post with CSRF token

Rob Winch 11 years ago
parent
f7d09c6b62
commit
19ce54e4ff
3 changed files with 15 additions and 2 deletions
Split View Show Diff Stats
  1. 2 0
      samples/ldap-xml/ldap.gradle
  2. 6 1
      samples/ldap-xml/src/main/webapp/secure/extreme/index.jsp
  3. 7 1
      samples/ldap-xml/src/main/webapp/secure/index.jsp

+ 2 - 0
samples/ldap-xml/ldap.gradle
View File 

@@ -12,6 +12,8 @@ configurations {
 
 }
 
 
 dependencies {
 
+    compile project(':spring-security-taglibs'),
 
+            jstlDependencies
 
 
     runtime project(':spring-security-web'),
 
             project(':spring-security-config'),

+ 6 - 1
samples/ldap-xml/src/main/webapp/secure/extreme/index.jsp
View File 

@@ -1,3 +1,5 @@
 
+<%@taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core" %>
 
+<%@ taglib prefix="security" uri="http://www.springframework.org/security/tags" %>
 
 
 <html>
 
 <body>
 
@@ -5,6 +7,9 @@
 
 This is a protected page. You can only see me if you are a supervisor.
 
 
 <p><a href="../../">Home</a>
 
-<p><a href="../../j_spring_security_logout">Logout</a>
 
+<form action="<c:url value="/j_spring_security_logout"/>" method="post">
 
+<input type="submit" value="Logoff"/>
 
+<security:csrfInput/>
 
+</form>
 
 </body>
 
 </html>

+ 7 - 1
samples/ldap-xml/src/main/webapp/secure/index.jsp
View File 

@@ -1,4 +1,7 @@
 
+<%@taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core" %>
 
+<%@ taglib prefix="security" uri="http://www.springframework.org/security/tags" %>
 
 <html>
 
+<head><title>Secure Page</title></head>
 
 <body>
 
 <h1>Secure Page</h1>
 
 This is a protected page. You can get to me if you've been remembered,
 
@@ -10,6 +13,9 @@ or if you've authenticated this session.<br><br>
 
 
 
 <p><a href="../">Home</a>
 
-<p><a href="../j_spring_security_logout">Logout</a>
 
+<form action="<c:url value="/j_spring_security_logout"/>" method="post">
 
+<input type="submit" value="Logoff"/> (also clears any remember-me cookie)
 
+<security:csrfInput/>
 
+</form>
 
 </body>
 
 </html>