26 lines
881 B
YAML
26 lines
881 B
YAML
# Every scenario in the article is a profile. The default is `securitysource`, the
|
|
# configuration that works, so that a bare `mvn spring-boot:run` starts something sane.
|
|
spring:
|
|
application:
|
|
name: cors-csrf-samesite
|
|
profiles:
|
|
default: securitysource
|
|
|
|
server:
|
|
port: 8080
|
|
servlet:
|
|
session:
|
|
cookie:
|
|
# Boot writes exactly what you put here. It does NOT add `Secure` for you when
|
|
# same-site is `none`, which is the whole subject of docs/07-samesite.md. Flip
|
|
# SESSION_SAME_SITE / SESSION_SECURE from scripts/scenario-samesite.sh and read the
|
|
# emitted Set-Cookie header back.
|
|
same-site: ${SESSION_SAME_SITE:lax}
|
|
secure: ${SESSION_SECURE:false}
|
|
http-only: true
|
|
|
|
logging:
|
|
level:
|
|
org.springframework.security.web.csrf: ${CSRF_LOG_LEVEL:INFO}
|
|
org.springframework.web.cors: ${CORS_LOG_LEVEL:INFO}
|