book

Spring Security in Action, Second Edition

by Laurentiu Spilca

June 2024

Intermediate to advanced

440 pages

11h 30m

English

Manning Publications

Read now

Unlock full access

forewordprefaceacknowledgmentsabout this bookWho should read this book?How this book is organized: A roadmapAbout the codeliveBook discussion forumabout the authorabout the cover illustration
1.1 Discovering Spring Security1.2 What is software security?1.3 Why is security important?1.4 What will you learn in this book?Summary
2.1 Starting your first project2.2 The big picture of Spring Security class design2.3 Overriding default configurations2.3.1 Customizing user details management2.3.2 Applying authorization at the endpoint level2.3.3 Configuring in different ways2.3.4 Defining custom authentication logic2.3.5 Using multiple configuration classesSummary
3.1 Implementing authentication in Spring Security3.2 Describing the user3.2.1 Describing users with the UserDetails contract3.2.2 Detailing on the GrantedAuthority contract3.2.3 Writing a minimal implementation of UserDetails3.2.4 Using a builder to create instances of the UserDetails type3.2.5 Combining multiple responsibilities related to the user3.3 Instructing Spring Security on how to manage users3.3.1 Understanding the UserDetailsService contract3.3.2 Implementing the UserDetailsService contract3.3.3 Implementing the UserDetailsManager contractSummary

4.1 Using password encoders4.1.1 The PasswordEncoder contract4.1.2 Implementing your PasswordEncoder4.1.3 Choosing from the provided PasswordEncoder implementations4.1.4 Multiple encoding strategies with DelegatingPasswordEncoder4.2 Taking advantage of the Spring Security Crypto module4.2.1 Using key generators4.2.2 Encrypting and decrypting secrets using encryptorsSummary
5.1 Implementing filters in the Spring Security architecture5.2 Adding a filter before an existing one in the chain5.3 Adding a filter after an existing one in the chain5.4 Adding a filter at the location of another in the chain5.5 Filter implementations provided by Spring SecuritySummary
6.1 Understanding the AuthenticationProvider6.1.1 Representing the request during authentication6.1.2 Implementing custom authentication logic6.1.3 Applying custom authentication logic6.2 Using the SecurityContext6.2.1 Using a holding strategy for the security context6.2.2 Using a holding strategy for asynchronous calls6.2.3 Using a holding strategy for standalone applications6.2.4 Forwarding the security context with DelegatingSecurityContextRunnable6.2.5 Forwarding the security context with DelegatingSecurityContextExecutorService6.3 Understanding HTTP Basic and form-based login authentications6.3.1 Using and configuring HTTP Basic6.3.2 Implementing authentication with form-based loginSummary
7.1 Restricting access based on authorities and roles7.1.1 Restricting access for all endpoints based on user authorities7.1.2 Restricting access for all endpoints based on user roles7.1.3 Restricting access to all endpointsSummary
8.1 Using the requestMatchers() method to select endpoints8.2 Selecting requests to apply authorization restrictions8.3 Using regular expressions with request matchersSummary
9.1 How CSRF protection works in Spring Security9.2 Using CSRF protection in practical scenarios9.3 Customizing CSRF protectionSummary
10.1 How does CORS work?10.2 Applying CORS policies with the @CrossOrigin annotation10.3 Applying CORS using a CorsConfigurerSummary
11.1 Enabling method security11.1.1 Understanding call authorization11.1.2 Enabling method security in your project11.2 Applying preauthorization rules11.3 Applying postauthorization rules11.4 Implementing permissions for methodsSummary
12.1 Applying prefiltering for method authorization12.2 Applying postfiltering for method authorization12.3 Using filtering in Spring Data repositoriesSummary
13.1 The big picture of OAuth 2 and OpenID Connect13.2 Using various token implementations13.2.1 Using opaque tokens13.2.2 Using non-opaque tokens13.3 Obtaining tokens through various grant types13.3.1 Getting a token using the authorization code grant type13.3.2 Applying PKCE protection to the authorization code grant type13.3.3 Getting a token with the client credentials grant type13.3.4 Using refresh tokens to get new access tokens13.4 What OpenID Connect brings to OAuth 213.5 The sins of OAuth 2Summary
14.1 Implementing basic authentication using JSON web tokens14.2 Running the authorization code grant type14.3 Running the client credentials grant type14.4 Using opaque tokens and introspection14.5 Revoking tokensSummary
15.1 Configuring JWT validation15.2 Using customized JWTs15.3 Configuring token validation through introspection15.4 Implementing multitenant systemsSummary
16.1 Implementing OAuth 2 login16.1.1 Implementing authentication with a common provider16.1.2 Giving the user more possibilities16.1.3 Using a custom authorization server16.1.4 Adding flexibility to your configurations16.1.5 Managing authorization for an OAuth 2 login16.2 Implementing an OAuth 2 clientSummary
17.1 What are reactive apps?17.2 User management in reactive apps17.3 Configuring authorization rules in reactive apps17.3.1 Applying authorization at the endpoint layer in reactive apps17.3.2 Using method security in reactive apps17.4 Creating a reactive OAuth 2 resource serverSummary
18.1 Using mock users for tests18.2 Testing with users from a UserDetailsService18.3 Using custom Authentication objects for testing18.4 Testing method security18.5 Testing authentication18.6 Testing CSRF configurations18.7 Testing CORS configurations18.8 Testing reactive Spring Security implementationsSummary
For Spring Framework in generalSpring in Action, Sixth Edition by Craig Walls (Manning, 2022)Spring Boot Up & Running by Mark Heckler (O’Reilly Media, 2022)Spring Start Here by Laurențiu Spilcă (Manning, 2021)To help you learn more about building your Java app’s persistence layerHigh-Performance Java Persistence by Vlad Mihalcea (self-published, 2019)Java Persistence with Spring Data and Hibernate, Third Edition by Cătălin Tudose (Manning, 2023)JUnit in Action, Third Edition by Cătălin Tudose (Manning, 2021)

Overview

Don't let security be an afterthought. Spring Security in Action, Second Edition is your vital companion to robust, secure applications that are protected right from the first line of code.

Spring Security in Action, Second Edition is a revised version of the bestselling original, fully updated for Spring Boot 3 and Oauth2/OpenID Connect.

In Spring Security in Action, Second Edition you will learn essential security skills including how to:

Implement and customize authentication and authorization
Set up all components of an OAuth2/OpenID Connect system
Utilize CRSF and CORS configurations
Secure Spring reactive applications
Write tests for security configurations

Whether you’re a beginner or a pro, Spring Security in Action, Second Edition teaches you how to secure your Java applications from the ground up. Author Laurențiu Spilcă distills his years of experience as a skilled Java and Spring developer into an indispensable guide to everything security—from authentication and authorization, to testing security configurations. This new edition covers the latest patterns for application-level security in Spring apps, demonstrating how Spring Security simplifies every step of the security process.

About the Technology
Spring Security makes it much, much easier to secure enterprise-scale Java applications. This powerful framework integrates with Spring apps end to end, with “secure by design” principles and ready-to-use features that help you implement robust authorization and authentication and protect against data theft and intrusions. And like everything else in the Spring ecosystem, it’s free, open source, and backed by the awesome team at VMWare.

About the Book
Spring Security in Action, Second Edition updates this bestselling guide to Spring Security to include deep coverage of OAuth2/OpenID Connect and security configuration using the new SecurityFilterChain. The crystal clear explanations and relevant examples, teach you how to build your own authorization server, configure secure endpoints, and prevent cross-site scripting and request forgery attacks.

What's Inside

Custom authentication and authorization
CRSF and CORS configurations
Secure Spring reactive applications
Write tests for security configurations

About the Reader
For experienced Java and Spring developers.

About the Author
Laurențiu Spilcă is a skilled Java and Spring developer and an experienced technology instructor. He is also the author of Manning’s Spring Start Here and Troubleshooting Java.

Quotes
This go-to guide demystifies security and provides actionable code using the industry-leading Spring Security framework.
- Josh Long, Spring Developer Advocate

Easy to grasp theory backed up by usable code.
- Ana-Maria Mihalceanu, Developer Advocate

A welcome follow-on to the excellent first edition, incorporating numerous updates to Spring Security. Check out this book!
- Mark Heckler, Author of Spring Boot: Up & Running!

Laurențiu makes the complex simple—perfect for a book about security. A must-read!
- Thomas Vitale, Author of Cloud Native Spring in Action