Question

We just recently upgraded from Spring Security version 3.0 to version 3.1. Our old configuration file was apparently using a deprecated feature where you can disable security for <intercept-url> blocks within the <http> block using the ‘filter=”none”‘ option. Here’s a snippet from our old applicationContext-security.xml file:

<http ...>
    <intercept-url pattern="/resetPassword" filter="none" requires-channel="https" />
</http>

Spring Security 3.1 forces you to define additional <http> blocks to turn off security for certain URL patterns:

<http security="none" pattern="/resetPassword" />

Question: How do I force the HTTPS channel for this new <http> block?

Answer 1

The configuration you were using was not actually requiring https, because filters=”none” means that Spring Security should not pay attention to that request. Instead for both Spring Security 3 and 3.1 you should use something like:

  <http use-expressions="true" ...>
    <intercept-url pattern="/resetPassword" access="permitAll" requires-channel="https" />
  </http>