Skip to content

Commit 8824a09

Browse files
committed
Polish "Document WebSecurityCustomizer for H2 Console"
See gh-29932
1 parent 9d46a18 commit 8824a09

File tree

1 file changed

+5
-3
lines changed
  • spring-boot-project/spring-boot-docs/src/docs/asciidoc/features

1 file changed

+5
-3
lines changed

spring-boot-project/spring-boot-docs/src/docs/asciidoc/features/sql.adoc

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -323,8 +323,9 @@ You can customize the console's path by using the configprop:spring.h2.console.p
323323

324324

325325
[[features.sql.h2-web-console.spring-security]]
326-
==== Configuring Spring Security for H2 Console
327-
H2 Console uses frames and, as it's intended for development only, does not implement CSRF protection measures. If your application uses Spring Security, you need to configure it to
326+
==== Accessing the H2 Console in a Secured Application
327+
H2 Console uses frames and, as it is intended for development only, does not implement CSRF protection measures.
328+
If your application uses Spring Security, you need to configure it to
328329

329330
* disable CSRF protection for requests against the console,
330331
* set the header `X-Frame-Options` to `SAMEORIGIN` on responses from the console.
@@ -338,7 +339,8 @@ In simple setups, a `SecurityFilterChain` like the following can be used:
338339
include::{docs-java}/features/sql/h2webconsole/springsecurity/DevProfileSecurityConfiguration.java[]
339340
----
340341

341-
WARNING: The H2 console is only intended for use during development. In production, disabling CSRF protection or allowing frames for a website may create severe security risks.
342+
WARNING: The H2 console is only intended for use during development.
343+
In production, disabling CSRF protection or allowing frames for a website may create severe security risks.
342344

343345
TIP: `PathRequest.toH2Console()` returns the correct request matcher also when the console's path has been customized.
344346

0 commit comments

Comments
 (0)