Spring Security - Third Edition

Summary

In this chapter, we have covered most of the remaining areas in standard Spring Security implementations that deal with authorization. We've learned enough to take a thorough pass through the JBCP calendar application and verify that proper authorization checks are in place in all tiers of the application, to ensure that malicious users cannot manipulate or access data to which they do not have access.

We developed two techniques for micro-authorization, namely filtering out in-page content based on authorization or other security criteria using the Thymeleaf Spring Security tag library and Spring MVC controller data binding. We also explored several methods of securing business functions and data in the business tier of our application ...