The CAE security implementations are established using Spring Security.

The configuration classes for the CAE security are located in the package com.coremedia.cae.security. All beans for the CAE security are created by the CaeWebSecurityAutoConfiguration auto configuration. For customizations, each of these beans can be replaced by an equally typed bean in a custom configuration class.

In Spring Security, the main bean to realize the HTTP web security is the org.springframework.security.web.SecurityFilterChain. When the application context is created, it is configured and build using the org.springframework.security.config.annotation.web.builders.HttpSecurity prototype bean. For the CAE, the default configuration is done in the CaeWebSecurityAutoConfiguration auto configuration. To customize the HTTP web security for the CAE in case that the externalized configuration possibilities are not sufficient, extend the com.coremedia.cae.security.CaeHttpSecurityConfigurer, and provide it as a bean.

With Spring-Security an HttpFirewall is configured.

For CoreMedia CAE, the StrictHttpFirewall is configured in CaeWebSecurityAutoConfiguration.html#httpFirewall. It uses the CAE http firewall configuration options to enable selective removal of its default rejections. In the default CAE (without any extensions), none of the default rejections are removed. If a rejection has to be removed for an extension, the regarding cae.http-firewall.allow-* property has to be set to true in the extensions component properties file.