book

Pro Spring Security

Name: Pro Spring Security
Author: Carlo Scarioni
ISBN: 9781430248187

by Carlo Scarioni

March 2013

Intermediate to advanced

340 pages

10h 46m

English

Apress

Read now

Unlock full access

Title Page
Dedication
Contents at a Glance
Contents
About the Author
About the Technical Reviewer
Acknowledgments
Introduction
CHAPTER 1: The Scope of Security
The Network Security LayerThe Operating System LayerThe Application LayerAuthentication and Authorization: General ConceptsWhat to SecureMore Security ConcernsJava Options for SecuritySummary
CHAPTER 2: Introducing Spring Security
What Is Spring Security?Where Does Spring Security Fit In?Spring Security and SpringSpring Framework: A Quick OverviewAn Initial Spring Security Secured ApplicationUnderstanding the Simple ApplicationSummary

CHAPTER 3: Spring Security Architecture and Design
What Components Make Up Spring Security?Good Design and Patterns in Spring SecuritySummary
CHAPTER 4: Web Security
Introducing the Simple Example ApplicationThe Special URLsCustom Login FormBasic HTTP AuthenticationDigest AuthenticationRemember-Me AuthenticationAllowing Remember-Me Access to Selected Parts of the ApplicationLogging OutThe Session (javax.servlet.http.HttpSession) and the SecurityContextBeyond Simple User Roles: Using Spring Expression Language to Secure the Web LayerExtend with Your Own ExpressionsSwitching to a Different UserSession ManagementForcing the Request to HTTPSRole HierarchiesSummary
CHAPTER 5: Securing the Service Layer
The Limitations of Web-Level SecurityWhat Is Business Service-Level Security?Setting Up the Example for the ChapterHow the Described Actions Happen Under the HoodCreating a Business Layer in Your Application@RolesAllowed AnnotationSecuring the Application Using SpEL ExpressionsSecuring the Data Returned from a MethodFiltering Collections Sent and Returned from MethodsSecurity Defined in XMLSecurity Without a Web LayerUsing AspectJ AOP instead of Spring AOPSummary
CHAPTER 6: Configuring Alternative Authentication Providers
Database-Provided AuthenticationLDAP AuthenticationAuthenticating with OpenIDX.509 AuthenticationJAAS AuthenticationCentral Authentication Service (CAS) AuthenticationIntegrating CAS with a Different Authentication ProviderSummary
CHAPTER 7: Business Object Security with ACLs
The Security Example ApplicationAccessing Secured ObjectsFiltering Returned ObjectsSecuring the View Layer with ACLsThe Cost of ACLsSummary
CHAPTER 8: Customizing and Extending Spring Security
Spring Security Extension PointsPlug into the Spring Security Event SystemYour Own AuthenticationProvider and UserDetailsServicePassword EncryptionNew Voters in AccessDecisionManagerNonvoter AccessDecisionManager ImplementationsNew Expression Root and SpELNon-JDBC AclServiceCustom Security FilterHandling Errors and Entry PointsChanging the Security InterceptorSpring Security Extensions ProjectSummary
CHAPTER 9: Integrating Spring Security with Other Frameworks and Languages
Spring Security with Struts 2Spring Security with Spring Web FlowSpring Security in Other JVM LanguagesSpring Security and Ruby (JRuby)Web-Layer Security in RailsSpring Security, Groovy, and GrailsUsing Grails to Secure the Web Layer with URL RulesUsing Grails Security at the Method LevelSpring Security and ScalaSummary
Index

Content preview from Pro Spring Security

CHAPTER 3

Spring Security Architecture and Design

In the previous chapter, I developed an initial application secured with Spring Security. I gave an overview of the way this application worked and looked in detail at some of the Spring Security components that are put into action in common Spring Security–secured application. In this chapter, I am going to extend those explanations and delve deeply into the framework.

I’ll look at the main components of the framework, explain the work of the servlet filters for securing web applications, look at how Spring AOP (Aspect Oriented Programming) helps you add security in an unobtrusive way, and in ...

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.

Read now

Unlock full access

More than 5,000 organizations count on O’Reilly

O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.

Julian F.

Head of Cybersecurity

I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.

Addison B.

Field Engineer

I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.

Amir M.

Data Platform Tech Lead

I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.

Mark W.

Embedded Software Engineer

Publisher Resources

ISBN: 9781430248187Purchase book

Cloud Computing

Data Engineering

Data Science

AI & ML

Programming Languages

Software Architecture

IT/Ops

Security

Design

Business

Soft Skills

Pro Spring Security

by Carlo Scarioni

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.