Spring Security in Action

A personal practice to cover Spring Security Based on this book

Table of Contents

1. Security Today
2. Hello Spring Securiy
3. Managing users
4. Dealing with passwords
5. Implementing authentication
6. Hands-on:A small secured web application
7. Configuring authorization: Restricting access
8. Configuring authorization: Applying restrictions
9. Implementing filters
10. Applying CSRF protection and CORS
11. Hands on: A separation of responsibilities
12. How does OAuth2 work?
13. OAuth2: Implementing the authorization server
14. OAuth2: Implementing the resource server
15. OAuth2: Using JWT and cryptographic signatures
16. Global method security:Pre- and postauthorizations
17. Global method security:Pre- and postfiltering
18. Hands-on:An OAuth 2 application
19. Spring Security for reactive apps
20. Spring Security testing

Contents to cover in detail

1. Security Today

• Spring Security: The what and the why
• What is software security?
• Why is security important?
• Common security vulnerabilities in web applications
• Security applied in various architectures
• What will you learn in this book?

2. Hello Spring Securiy

• Starting with the first project
• Which are the default configurations?
• Overriding default configurations

3. Managing users

• Implementing authentication in Spring Security
• Describing the user
• Instructing Spring Security on how to manage users

4. Dealing with passwords

• Understanding the PasswordEncoder contract
• More about the Spring Security Crypto module

5. Implementing authentication

• Understanding the AuthenticationProvider
• Using the SecurityContext
• Understanding HTTP Basic and form-based login authentications

6. Hands-on:A small secured web application

• Project requirements and setup
• Implementing user management
• Implementing custom authentication logic
• Implementing the main page
• Running and testing the application

7. Configuring authorization: Restricting access

• Restricting access based on authorities and roles

8. Configuring authorization: Applying restrictions

• Using matcher methods to select endpoints
• Selecting requests for authorization using MVC matchers
• Selecting requests for authorization using Ant matchers
• Selecting requests for authorization using regex matchers

9. Implementing filters

• Implementing filters in the Spring Security architecture
• Adding a filter before an existing one in the chain
• Adding a filter after an existing one in the chain
• Adding a filter at the location of another in the chain
• Filter implementations provided by Spring Security

10. Applying CSRF protection and CORS

• Applying cross-site request forgery (CSRF) protection in applications
• Using cross-origin resource sharing

11. Hands on: A separation of responsibilities

• The scenario and requirements of the example
• Implementing and using tokens
• Implementing the authentication server
• Implementing the business logic server

12. How does OAuth2 work?

• The OAuth 2 framework
• The components of the OAuth 2 authentication architecture
• Implementation choices with OAuth 2
• The sins of OAuth 2
• Implementing a simple single sign-on application

13. OAuth2: Implementing the authorization server

• Writing your own authorization server implementation
• Defining user management
• Registering clients with the authorization server
• Using the password grant type
• Using the authorization code grant type
• Using the client credentials grant type
• Using the refresh token grant type

14. OAuth2: Implementing the resource server

• Implementing a resource server
• Checking the token remotely
• Implementing blackboarding with a JdbcTokenStore
• A short comparison of approaches

15. OAuth2: Implementing the resource server

• Using tokens signed with symmetric keys with JWT
• Using tokens signed with asymmetric keys with JWT
• Adding custom details to the JWT

16. Global method security:Pre- and postauthorizations

• Enabling global method security
• Applying preauthorization for authorities and roles
• Applying postauthorization
• Implementing permissions for methods

17. Global method security:Pre- and postfiltering

• Applying prefiltering for method authorization
• Applying postfiltering for method authorization
• Using filtering in Spring Data repositories

18. Hands-on:An OAuth 2 application

• The application scenario
• Configuring Keycloak as an authorization server
• Implementing the resource server
• Testing the application

19. Spring Security for reactive apps

• What are reactive apps?
• User management in reactive apps
• Configuring authorization rules in reactive apps
• Reactive apps and OAuth 2

20. Spring Security testing

• Using mock users for tests
• Testing with users from a UserDetailsService
• Using custom Authentication objects for testing
• Testing method security
• Testing authentication
• Testing CSRF configurations
• Testing CORS configurations
• Testing reactive Spring Security implementations