Spring Security Secure Your Web Application (original) (raw)

Spring Security is a framework used to secure Spring and Spring Boot applications. It provides features like authentication, authorization, password protection, session management, and security filters to protect applications from unauthorized access and cyber attacks. Spring Security integrates easily with Spring Boot and helps developers build secure enterprise-level applications.

Importance of Spring Security

Security is important in web applications to protect user data and restrict unauthorized access.

Core Concepts of Spring Security

Spring Security provides important security features to protect web applications from unauthorized access and attacks. It mainly focuses on authentication, authorization, request filtering, and secure user management.

Authentication

Authentication is the process of verifying the identity of a user before allowing access to the application. Spring Security checks user credentials like username and password during login.

Authorization determines what resources or actions a user can access after successful authentication. Access is controlled using roles and permissions.

Security Filters

Security filters intercept HTTP requests and apply security checks before requests reach the application. They help enforce authentication and authorization rules.

Security Providers

Security providers are responsible for validating user credentials and managing authentication logic. They connect Spring Security with different authentication sources.

Setting up Spring Security in Spring Boot 3.0

Step 1: Create a Spring Boot Project

Create a Spring Boot project using Spring Initializr or any IDE. Add the following dependency:

**Adding Spring Security dependency:

org.springframework.boot spring-boot-starter-security

Step 2: Create REST Controller

Create a controller class to define secured and public endpoints.

**HomeController

Java `

package com.spring.security.controllers;

import org.springframework.http.ResponseEntity; import org.springframework.web.bind.annotation.GetMapping; import org.springframework.web.bind.annotation.RequestMapping; import org.springframework.web.bind.annotation.RestController;

@RestController @RequestMapping("/home") public class HomeController {

  // Handler Methods
@GetMapping("/normal")
public ResponseEntity<String> normalUser(){
    return ResponseEntity.ok("I am User");
}

@GetMapping("/admin")
public ResponseEntity<String> adminUser(){
    return ResponseEntity.ok("I am Admin");
}

@GetMapping("/public")
public ResponseEntity<String> publicUser(){
    return ResponseEntity.ok("I am Public User");
}

}

`

Step 3: Create Security Configuration Class

Create a configuration class to define Spring Security settings.

**Configuring Security Filters

Java `

package com.spring.security.config;

import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Configuration; import org.springframework.security.config.annotation.web.builders.HttpSecurity; import org.springframework.security.core.userdetails.User; import org.springframework.security.core.userdetails.UserDetails; import org.springframework.security.core.userdetails.UserDetailsService; import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder; import org.springframework.security.crypto.password.PasswordEncoder; import org.springframework.security.provisioning.InMemoryUserDetailsManager; import org.springframework.security.web.SecurityFilterChain;

@Configuration public class SecurityConfig {

// Password Encoder
@Bean
public PasswordEncoder passwordEncoder() {
    return new BCryptPasswordEncoder();
}

// User configuration
@Bean
public UserDetailsService userDetailsService() {
    UserDetails normalUser=User
            .withUsername("Pranay")
            .password(passwordEncoder().encode("password"))
              // roles
            .roles("NORMAL") 
            .build();
    UserDetails adminUser=User
            .withUsername("Admin")
            .password(passwordEncoder().encode("password"))
            .roles("ADMIN")
            .build();
    InMemoryUserDetailsManager inMemoryUserDetailsManager= new InMemoryUserDetailsManager();
    inMemoryUserDetailsManager.createUser(normalUser);
    inMemoryUserDetailsManager.createUser(adminUser);

    return inMemoryUserDetailsManager;
}


@Bean
public SecurityFilterChain filterChain(HttpSecurity httpSecurity) throws Exception{
    
    httpSecurity.csrf().disable()
    .authorizeHttpRequests()
    // Role based Authentication
    .requestMatchers("/home/admin")
    .hasRole("ADMIN")        
    .requestMatchers("/home/normal")
    .hasRole("NORMAL")        
    .requestMatchers("/home/public")
    .permitAll()
    .anyRequest()
    .authenticated()
    .and()
    .formLogin();
    
return httpSecurity.build();
}

}

`

Step 4: Configure User Authentication

Create users and assign roles.

UserDetails adminUser = User .withUsername("Admin") .password(passwordEncoder().encode("password")) .roles("ADMIN") .build();

`

Step 5: Configure Security Filter Chain

Configure URL access rules using SecurityFilterChain.

Step 6: Run the Spring Boot Application

Run the application.

**Output:

Best Practices for Spring Security Configuration