Skip to content

Commit

Permalink
Minor doc fixes identified during QE cycle
Browse files Browse the repository at this point in the history
fix
  • Loading branch information
michelle-purcell committed Nov 18, 2023
1 parent 8b1f8a5 commit 1d16e43
Showing 1 changed file with 8 additions and 6 deletions.
14 changes: 8 additions & 6 deletions docs/src/main/asciidoc/security-overview.adoc
Original file line number Diff line number Diff line change
Expand Up @@ -38,7 +38,7 @@ For more information, see the Quarkus xref:security-customization.adoc[Security
To get started with security in Quarkus, consider combining the Quarkus built-in xref:security-basic-authentication.adoc[Basic authentication] with the Jakarta Persistence identity provider to enable role-based access control (RBAC).
Complete the steps in the xref:security-basic-authentication-tutorial.adoc[Secure a Quarkus application with Basic authentication] tutorial.

After successfully securing your Quarkus application with Basic authentication, you can increase the security further by adding more advanced authentication mechanisms, for example, the xref:security-oidc-code-flow-authentication.adoc[OpenID Connect (OIDC) authorization code flow mechanism].
After successfully securing your Quarkus application with Basic authentication, you can increase the security further by adding more advanced authentication mechanisms, for example, the Quarkus xref:security-oidc-code-flow-authentication.adoc[OpenID Connect (OIDC) authorization code flow mechanism] guide.

== Quarkus Security testing

Expand All @@ -50,7 +50,7 @@ Guidance for testing Quarkus Security features and ensuring that your Quarkus ap
=== Cross-origin resource sharing

To make your Quarkus application accessible to another application running on a different domain, you need to configure cross-origin resource sharing (CORS).
For more information about the CORS filter that Quarkus provides, see the Quarkus xref:http-reference.adoc#cors-filter[CORS filter] section of the "HTTP reference" guide.
For more information about the CORS filter that Quarkus provides, see the xref:security-cors.adoc#cors-filter[CORS filter] section of the Quarkus "Cross-origin resource sharing" guide.

[[csrf-prevention]]
=== Cross-Site Request Forgery (CSRF) prevention
Expand All @@ -62,7 +62,7 @@ For more information, see the Quarkus xref:security-csrf-prevention.adoc[Cross-S
=== SameSite cookies

You can add a link:https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Set-Cookie/SameSite[SameSite] cookie property to any of the cookies set by a Quarkus endpoint.
For more information, see the Quarkus xref:http-reference.adoc#same-site-cookie[SameSite cookies] guide.
For more information, see the xref:http-reference.adoc#same-site-cookie[SameSite cookies] section of the Quarkus "HTTP reference" guide.

[[secrets-engines]]
=== Secrets engines
Expand All @@ -75,13 +75,14 @@ For more information, see the link:{vault-guide}[Quarkus and HashiCorp Vault] do
=== Secure serialization

If your Quarkus Security architecture includes RESTEasy Reactive and Jackson, Quarkus can limit the fields that are included in JSON serialization based on the configured security.
For more information, see the Quarkus xref:resteasy-reactive.adoc#secure-serialization[Writing REST services with RESTEasy Reactive] guide.
For more information, see the xref:resteasy-reactive.adoc#secure-serialization[JSON serialisation] section of the Quarkus “Writing REST services with RESTEasy Reactive” guide.


[[rest-data-panache]]
=== Secure auto-generated resources by REST Data with Panache

If you use the REST Data with Panache extension to auto-generate your resources, you can still use security annotations within the package `jakarta.annotation.security`.
For more information, see the xref:rest-data-panache.adoc#securing-endpoints[Securing auto-generated resources] section of the Quarkus "Generating Jakarta REST resources with Panache" guide.
For more information, see the xref:rest-data-panache.adoc#securing-endpoints[Securing endpoints] section of the Quarkus "Generating Jakarta REST resources with Panache" guide.

== Security vulnerability detection

Expand All @@ -90,6 +91,7 @@ For information about security vulnerabilities, see the xref:security-vulnerabil

== References

* xref:security-basic-authentication-tutorial.adoc[Secure a Quarkus application with Basic authentication and Jakarta Persistence]
* xref:security-basic-authentication.adoc[Basic authentication]
* xref:security-getting-started-tutorial.adoc[Getting Started with Security using Basic authentication and Jakarta Persistence]
* xref:security-oidc-code-flow-authentication-tutorial.adoc[Protect a web application by using OIDC authorization code flow]
* xref:security-oidc-bearer-token-authentication-tutorial.adoc[Protect a service application by using OIDC Bearer token authentication]

0 comments on commit 1d16e43

Please sign in to comment.