HTTP Requests (HTTP Requests) _ Spring Security5.8.15-SNAPSHOT中文文档(官方文档中文翻译)|Spring 教程 —

This version is still in development and is not considered stable yet. For the latest stable version, please use Spring Security 6.3.3!spring-doc.cn

All HTTP based communication should be protected using TLS.spring-doc.cn

Below you can find details around WebFlux specific features that assist with HTTPS usage.spring-doc.cn

Redirect to HTTPS

If a client makes a request using HTTP rather than HTTPS, Spring Security can be configured to redirect to HTTPS.spring-doc.cn

For example, the following Java configuration will redirect any HTTP requests to HTTPS:spring-doc.cn

Redirect to HTTPS

Javaspring-doc.cn
Kotlinspring-doc.cn

@Bean
SecurityWebFilterChain springSecurityFilterChain(ServerHttpSecurity http) {
	http
		// ...
		.redirectToHttps(withDefaults());
	return http.build();
}

@Bean
fun springSecurityFilterChain(http: ServerHttpSecurity): SecurityWebFilterChain {
    return http {
        // ...
        redirectToHttps { }
    }
}

The configuration can easily be wrapped around an if statement to only be turned on in production. Alternatively, it can be enabled by looking for a property about the request that only happens in production. For example, if the production environment adds a header named X-Forwarded-Proto the following Java Configuration could be used:spring-doc.cn

Redirect to HTTPS when X-Forwarded

Javaspring-doc.cn
Kotlinspring-doc.cn

@Bean
SecurityWebFilterChain springSecurityFilterChain(ServerHttpSecurity http) {
	http
		// ...
		.redirectToHttps(redirect -> redirect
			.httpsRedirectWhen(e -> e.getRequest().getHeaders().containsKey("X-Forwarded-Proto"))
		);
	return http.build();
}

@Bean
fun springSecurityFilterChain(http: ServerHttpSecurity): SecurityWebFilterChain {
    return http {
        // ...
        redirectToHttps {
            httpsRedirectWhen {
                it.request.headers.containsKey("X-Forwarded-Proto")
            }
        }
    }
}

Strict Transport Security

Spring Security provides support for Strict Transport Security and enables it by default.spring-doc.cn

Proxy Server Configuration

Spring Security integrates with proxy servers.spring-doc.cn