Skip to content

Remove text about default user/password as it no longer is printed #196

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
mrhaki wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Remove text about default user/password as it no longer is printed #196

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 0 additions & 20 deletions adding-spring-security/README.adoc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -159,26 +159,6 @@ image:docs/signin.png[alt='Please sign in']

When you open the same endpoint from the commandline you immediately get a `HTTP/1.1 401` response.

We turn to the application logs to find out what happened in our application.
As it turns out, there's a curious new logline from
https://github.com/spring-projects/spring-boot/blob/2.7.x/spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/security/servlet/UserDetailsServiceAutoConfiguration.java#L89[`UserDetailsServiceAutoConfiguration`]:

.Using generated security password warning
[source,text]
----
WARN UserDetailsServiceAutoConfiguration :

Using generated security password: 9c991bee-bf35-4970-92ed-e5458d561a73

This generated password is for development use only. Your security configuration must be updated before running your application in production.
----

This auto configuration triggers when no other security configuration has been provided.
It sets up our application with a default user and generated password, as a fallback of sorts.
After all, if you're adding Spring Security to your class path you will want some form of security.
At the very least the log line and dialog serve as a reminder to configure exactly what you want in your application.


== 2. Configure OAuth2 resource server
Since we wish to configure our application to function as an OAuth2 resource server,
we can provide the required configuration to make the generated security password go away.
Expand Down