Hands-On Spring Security 5 for Reactive Applications

Advanced REST API security

REST APIs can be secured by another mechanism in your web application, OAuth.

OAuth is an authorization framework that allows other applications with the right credentials access to partial/limited user profile details stored on platforms such as Google and Facebook. The authentication part is delegated to these services and if successful, appropriate grants are given to the calling client/application, which can be used to get access to secured resources (in our case RESTful APIs).

We have seen OAuth security using a public authentication provider in Chapter 3, Authentication Using CAS and JAAS (in the OAuth 2 and OpenID connect section). However, we need not use these public providers; you have the choice of using ...