Hands off my content(-type), Apache!

Just a quick note for anyone using Apache as a proxy (commonly with Tomcat, Jetty or some other Java application server behind): If your application does not set the Content-Type header, Apache will apply one for you. Which one, you ask? Well, that depends on the extension of the URL your content is served from. If that URL is http://localhost:8080/app/spring_security_login, you get...

text/plain

Bah.

Workaround: Include 'DefaultType None' in your Apache config (works well in a VirtualHost.

The fix, of course, is to set the content type. I've submitted this to the Spring Security team; hopefully it'll make it into 2.0.1.

Spring Security 2.0 + Spring 2.5 + Maven

If you're a Mavenite Spring 2.5 user, you'll need to jump through some extra hoops to use Spring Security 2, just as you had to when using Acegi with Spring 2.0.

First off you'll want to exclude org.springframework:spring-remoting and org.springframework:spring-support, as these two artifacts no longer exist in Spring 2.5.

In addition, you will most likely need to include org.springframework:spring-aop and org.springframework:spring-orm as dependencies, unless you're already using them.

That said, Spring Security's new config is nice. One particular security config file went from 118 lines to 24!