Spring Security ACL Plugin - Reference Documentation The plugin uses domain classes to manage database state. プラグインはドメインクラスをデータベースの状態を管理するために使用します。 Ordinarily the database structure isn’t all that impor…

Spring Security ACL Plugin - Reference Documentation There are two primary use cases for ACL security: determining whether a user is allowed to perform an action on an instance before the action is invoked, and restricting access to single…

Spring Security ACL Plugin - Reference Documentation 1. Introduction to the Spring Security ACL Plugin The ACL plugin adds Domain Object Security support to a Grails application that uses Spring Security. ACL プラグインは、 Spring Security…

Spring Framework provides first class support for CORS. Spring Framework は CORS をサポートするクラスを提供します。 CORS must be processed before Spring Security because the pre-flight request will not contain any cookies (i.e. the JSESSIO…

34. Run-As Authentication Replacement 34.1 Overview The AbstractSecurityInterceptor is able to temporarily replace the Authentication object in the SecurityContext and SecurityContextHolder during the secure object callback phase. Abstract…

Detecting Timeouts You can configure Spring Security to detect the submission of an invalid session ID and redirect the user to an appropriate URL. あなたは、無効なセッションIDが渡されたことを検出し、適切な URL にリダイレクトするために Spr…

20.2.3 DelegatingRequestMatcherHeaderWriter At times you may want to only write a header for certain requests. ときどき、あなたは一定のリクエストでだけヘッダーを書きたいと思うことでしょう。 For example, perhaps you want to only protect you…

20.2.2 Headers Writer When the namespace or Java configuration does not support the headers you want, you can create a custom HeadersWriter instance or even provide a custom implementation of the HeadersWriter. namespace か Java Configurat…

20.2 Custom Headers Spring Security has mechanisms to make it convenient to add the more common security headers to your application. Spring Security はより共通のセキュリティヘッダーをアプリケーションに追加することを便利にするメカニズムを…

20.1.8 Referrer Policy Referrer Policy is a mechanism that web applications can leverage to manage the referrer field, which contains the last page the user was on. Referer ポリシーは Web アプリケーションがユーザーが最後にアクセスしていた…

20.1.7 Content Security Policy (CSP) Content Security Policy (CSP) is a mechanism that web applications can leverage to mitigate content injection vulnerabilities, such as cross-site scripting (XSS). Content Security Policy は、 Web アプリ…

正しさの保証なんてものは（ｒｙ 20.1.6 X-XSS-Protection Some browsers have built in support for filtering out reflected XSS attacks. いくつかのブラウザは Refrected XSS 攻撃を回避する組み込みのサポートを持っています。 ※Referected XSS 攻撃 反…

正しさの保証なんてものはない。 ※印で始まる文章は本文にはない、私個人の感想やコメント・注釈です。 20.1.5 X-Frame-Options Allowing your website to be added to a frame can be a security issue. Web サイトをフレームに追加できることを許可すると…