From 15e7fc1c21b7b7e4f0caa4cf77459eb586cde20e Mon Sep 17 00:00:00 2001
From: monkeyk7 <zhao@idsmanager.com>
Date: Sun, 10 Sep 2017 20:24:05 +0800
Subject: [PATCH] =?UTF-8?q?=E6=B7=BB=E5=8A=A0=20=E5=BF=85=E8=A6=81?=
 =?UTF-8?q?=E7=9A=84=E6=B3=A8=E9=87=8A?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 src/main/resources/spring/security.xml | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/src/main/resources/spring/security.xml b/src/main/resources/spring/security.xml
index f8fef86..75b2b0d 100644
--- a/src/main/resources/spring/security.xml
+++ b/src/main/resources/spring/security.xml
@@ -224,17 +224,24 @@
         <intercept-url pattern="/oauth/**" access="ROLE_USER,ROLE_UNITY,ROLE_MOBILE"/>
         <intercept-url pattern="/**" access="IS_AUTHENTICATED_ANONYMOUSLY"/>
 
+
+        <!-- 配置表单验证 -->
         <form-login authentication-failure-url="/login.jsp?authentication_error=1" default-target-url="/index.jsp"
                     login-page="/login.jsp" login-processing-url="/login.do"/>
         <logout logout-success-url="/index.jsp" logout-url="/logout.do"/>
         <access-denied-handler error-page="/login.jsp?authorization_error=2"/>
         <anonymous/>
+
+        <!--CSRF 不启用; 实际 场景 推荐启用 -->
         <csrf disabled="true"/>
     </http>
 
 
     <authentication-manager alias="authenticationManager">
         <authentication-provider user-service-ref="userService">
+            <!--
+            密码使用 MD5 加密 ; 实际使用时推荐使用 SHA-256, 并使用 salt
+            -->
             <password-encoder hash="md5"/>
         </authentication-provider>
     </authentication-manager>