book

Spring Security in Action, Second Edition

Name: Spring Security in Action, Second Edition
Author: Laurentiu Spilca
ISBN: 9781633437975

by Laurentiu Spilca

June 2024

Intermediate to advanced

440 pages

11h 30m

English

Manning Publications

Audiobook available

Read now

Unlock full access

Praise for the first edition
Spring Security in Action
Copyright
contents
front matter
forewordprefaceacknowledgmentsabout this bookWho should read this book?How this book is organized: A roadmapAbout the codeliveBook discussion forumabout the authorabout the cover illustration
Part 1. Say hello to Spring Security
1 Security today
1.1 Discovering Spring Security1.2 What is software security?1.3 Why is security important?1.4 What will you learn in this book?Summary
2 Hello, Spring Security
2.1 Starting your first project2.2 The big picture of Spring Security class design2.3 Overriding default configurations2.3.1 Customizing user details management2.3.2 Applying authorization at the endpoint level2.3.3 Configuring in different ways2.3.4 Defining custom authentication logic2.3.5 Using multiple configuration classesSummary
Part 2. Configuring authentication
3 Managing users
3.1 Implementing authentication in Spring Security3.2 Describing the user3.2.1 Describing users with the UserDetails contract3.2.2 Detailing on the GrantedAuthority contract3.2.3 Writing a minimal implementation of UserDetails3.2.4 Using a builder to create instances of the UserDetails type3.2.5 Combining multiple responsibilities related to the user3.3 Instructing Spring Security on how to manage users3.3.1 Understanding the UserDetailsService contract3.3.2 Implementing the UserDetailsService contract3.3.3 Implementing the UserDetailsManager contractSummary

4 Managing passwords
4.1 Using password encoders4.1.1 The PasswordEncoder contract4.1.2 Implementing your PasswordEncoder4.1.3 Choosing from the provided PasswordEncoder implementations4.1.4 Multiple encoding strategies with DelegatingPasswordEncoder4.2 Taking advantage of the Spring Security Crypto module4.2.1 Using key generators4.2.2 Encrypting and decrypting secrets using encryptorsSummary
5 A web app’s security begins with filters
5.1 Implementing filters in the Spring Security architecture5.2 Adding a filter before an existing one in the chain5.3 Adding a filter after an existing one in the chain5.4 Adding a filter at the location of another in the chain5.5 Filter implementations provided by Spring SecuritySummary
6 Implementing authentications
6.1 Understanding the AuthenticationProvider6.1.1 Representing the request during authentication6.1.2 Implementing custom authentication logic6.1.3 Applying custom authentication logic6.2 Using the SecurityContext6.2.1 Using a holding strategy for the security context6.2.2 Using a holding strategy for asynchronous calls6.2.3 Using a holding strategy for standalone applications6.2.4 Forwarding the security context with DelegatingSecurityContextRunnable6.2.5 Forwarding the security context with DelegatingSecurityContextExecutorService6.3 Understanding HTTP Basic and form-based login authentications6.3.1 Using and configuring HTTP Basic6.3.2 Implementing authentication with form-based loginSummary
Part 3. Configuring authorization
7 Configuring endpoint-level authorization: Restricting access
7.1 Restricting access based on authorities and roles7.1.1 Restricting access for all endpoints based on user authorities7.1.2 Restricting access for all endpoints based on user roles7.1.3 Restricting access to all endpointsSummary
8 Configuring endpoint-level authorization: Applying restrictions
8.1 Using the requestMatchers() method to select endpoints8.2 Selecting requests to apply authorization restrictions8.3 Using regular expressions with request matchersSummary
9 Configuring CSRF protection
9.1 How CSRF protection works in Spring Security9.2 Using CSRF protection in practical scenarios9.3 Customizing CSRF protectionSummary
10 Configuring CORS
10.1 How does CORS work?10.2 Applying CORS policies with the @CrossOrigin annotation10.3 Applying CORS using a CorsConfigurerSummary
11 Implementing authorization at the method level
11.1 Enabling method security11.1.1 Understanding call authorization11.1.2 Enabling method security in your project11.2 Applying preauthorization rules11.3 Applying postauthorization rules11.4 Implementing permissions for methodsSummary
12 Implementing filtering at the method level
12.1 Applying prefiltering for method authorization12.2 Applying postfiltering for method authorization12.3 Using filtering in Spring Data repositoriesSummary
Part 4. Implementing OAuth 2 and OpenID Connect
13 What are OAuth 2 and OpenID Connect?
13.1 The big picture of OAuth 2 and OpenID Connect13.2 Using various token implementations13.2.1 Using opaque tokens13.2.2 Using non-opaque tokens13.3 Obtaining tokens through various grant types13.3.1 Getting a token using the authorization code grant type13.3.2 Applying PKCE protection to the authorization code grant type13.3.3 Getting a token with the client credentials grant type13.3.4 Using refresh tokens to get new access tokens13.4 What OpenID Connect brings to OAuth 213.5 The sins of OAuth 2Summary
14 Implementing an OAuth 2 authorization server
14.1 Implementing basic authentication using JSON web tokens14.2 Running the authorization code grant type14.3 Running the client credentials grant type14.4 Using opaque tokens and introspection14.5 Revoking tokensSummary
15 Implementing an OAuth 2 resource server
15.1 Configuring JWT validation15.2 Using customized JWTs15.3 Configuring token validation through introspection15.4 Implementing multitenant systemsSummary
16 Implementing an OAuth 2 client
16.1 Implementing OAuth 2 login16.1.1 Implementing authentication with a common provider16.1.2 Giving the user more possibilities16.1.3 Using a custom authorization server16.1.4 Adding flexibility to your configurations16.1.5 Managing authorization for an OAuth 2 login16.2 Implementing an OAuth 2 clientSummary
Part 5. Going reactive
17 Implementing security in reactive applications
17.1 What are reactive apps?17.2 User management in reactive apps17.3 Configuring authorization rules in reactive apps17.3.1 Applying authorization at the endpoint layer in reactive apps17.3.2 Using method security in reactive apps17.4 Creating a reactive OAuth 2 resource serverSummary
Part 6. Testing security configurations
18 Testing security configurations
18.1 Using mock users for tests18.2 Testing with users from a UserDetailsService18.3 Using custom Authentication objects for testing18.4 Testing method security18.5 Testing authentication18.6 Testing CSRF configurations18.7 Testing CORS configurations18.8 Testing reactive Spring Security implementationsSummary
Appendix A. Links to official documentation
Appendix B. Further reading
For Spring Framework in generalSpring in Action, Sixth Edition by Craig Walls (Manning, 2022)Spring Boot Up & Running by Mark Heckler (O’Reilly Media, 2022)Spring Start Here by Laurențiu Spilcă (Manning, 2021)To help you learn more about building your Java app’s persistence layerHigh-Performance Java Persistence by Vlad Mihalcea (self-published, 2019)Java Persistence with Spring Data and Hibernate, Third Edition by Cătălin Tudose (Manning, 2023)JUnit in Action, Third Edition by Cătălin Tudose (Manning, 2021)
index

Content preview from Spring Security in Action, Second Edition

9 Configuring CSRF protection

This chapter covers

Understanding CSRF attacks
Implementing CSRF protection
Customizing CSRF protection

You have learned about the filter chain and its purpose in the Spring Security architecture. We worked on several examples in chapter 5, where we customized the filter chain. But Spring Security also adds its own filters to the chain. This chapter discusses the filter that configures CSRF (cross-site request forgery) protection. You’ll learn to customize the filters to make a perfect fit for your scenarios.

You have probably observed that in most of the examples up to now, we only implemented our endpoints with HTTP GET. Moreover, when we needed to configure HTTP POST, we also had to add a supplementary instruction ...

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.

Read now

Unlock full access

More than 5,000 organizations count on O’Reilly

O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.

Julian F.

Head of Cybersecurity

I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.

Addison B.

Field Engineer

I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.

Amir M.

Data Platform Tech Lead

I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.

Mark W.

Embedded Software Engineer

Publisher Resources

ISBN: 9781633437975Publisher Support Publisher Website

Cloud Computing

Data Engineering

Data Science

AI & ML

Programming Languages

Software Architecture

IT/Ops

Security

Design

Business

Soft Skills

Spring Security in Action, Second Edition

by Laurentiu Spilca

9 Configuring CSRF protection

Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.