Professional Java for Web Applications

Chapter 26Authenticating Users with Spring Security

IN THIS CHAPTER

• Adding Spring Security Authentication to your application
• Using Form Login, JDBC, LDAP, and OpenID
• Protecting against session fixation and limiting user sessions
• Remembering users between sessions
• Creating a custom authentication provider
• Mitigating cross-site request forgery attacks

WROX.COM CODE DOWNLOADS FOR THIS CHAPTER

You can find the wrox.com code downloads for this chapter at http://www.wrox.com/go/projavaforwebapps on the Download Code tab. The code for this chapter is divided into the following major examples:

• Authentication-App Project
• Customer-Support-v19 Project

NEW MAVEN DEPENDENCIES FOR THIS CHAPTER

In addition to the Maven dependencies introduced in previous chapters, you also need the following Maven dependencies:

        <dependency>
            <groupId>org.springframework.security</groupId>
            <artifactId>spring-security-web</artifactId>
            <version>3.2.0.RELEASE</version>
            <scope>compile</scope>
        </dependency>
 
        <dependency>
            <groupId>org.springframework.security</groupId>
            <artifactId>spring-security-config</artifactId>
            <version>3.2.0.RELEASE</version>
            <scope>compile</scope>
        </dependency>
 
        <dependency>
            <groupId>org.springframework.security</groupId>
            <artifactId>spring-security-crypto</artifactId>
            <version>3.2.0.RELEASE</version>
            <scope>compile</scope>
        </dependency>

You no longer need the following dependency because Spring Security includes a BCrypt implementation in its distribution.

 <dependency> <groupId>org.mindrot</groupId> ...