Spring Security in Action, Second Edition

✍ Scribed by Laurențiu Spilcă

• Publisher: Manning Publications Co.
• Year: 2024
• Tongue: English
• Leaves: 440
• Edition: 2
• Category: Library

✦ Synopsis

Design and develop Spring applications that are secure right from the start. In Spring Security in Action, Second Edition you will learn essential security skills including how to: Implement and customize authentication and authorization Set up all components of an OAuth 2/OpenID Connect system Utilize CRSF and CORS configurations Secure Spring reactive applications Write tests for security configurations Spring Security in Action, Second Edition is a revised version of the bestselling original, fully updated for Spring Boot 3 and Oauth2/OpenID Connect. This new edition covers the latest patterns for application-level security in Spring apps, demonstrating how Spring Security simplifies every step of the security process. Code samples and useful real-world examples give you hands-on experience of protecting your apps from common threats such as injection attacks and poor monitoring. About the technology Spring Security is essential for any Java developer looking to master authentication and authorization in Spring apps. By adopting "secure by design" principles with Spring Security's out-of-the-box features, you can protect your apps from data theft and unauthorized intrusions. About the book Spring Security in Action, Second Edition reveals the Spring Security techniques and tools you need to defend your apps against attack. In this book, author Lauren?iu Spilca, a skilled Java and Spring developer, will teach you how to build your own authorization server, manage system users, configure secure endpoints, and prevent cross-site scripting and request forgery attacks. This new second edition delves into the OAuth 2/OpenID Connect stack and details SecurityFilterChain for security configuration. Don't let security be an afterthought. Start protecting your apps from the first line of code! About the reader For experienced Java and Spring developers. About the author Laurentiu Spilca is a skilled Java and Spring developer and an experienced technology instructor. He is also the author of Manning’s Spring Start Here and Troubleshooting Java.

✦ Table of Contents

Praise for the first edition
Spring Security in Action
Copyright
contents
front matter
foreword
preface
acknowledgments
about this book
Who should read this book?
How this book is organized: A roadmap
About the code
liveBook discussion forum
about the author
about the cover illustration
Part 1. Say hello to Spring Security
1 Security today
1.1 Discovering Spring Security
1.2 What is software security?
1.3 Why is security important?
1.4 What will you learn in this book?
Summary
2 Hello, Spring Security
2.1 Starting your first project
2.2 The big picture of Spring Security class design
2.3 Overriding default configurations
2.3.1 Customizing user details management
2.3.2 Applying authorization at the endpoint level
2.3.3 Configuring in different ways
2.3.4 Defining custom authentication logic
2.3.5 Using multiple configuration classes
Summary
Part 2. Configuring authentication
3 Managing users
3.1 Implementing authentication in Spring Security
3.2 Describing the user
3.2.1 Describing users with the UserDetails contract
3.2.2 Detailing on the GrantedAuthority contract
3.2.3 Writing a minimal implementation of UserDetails
3.2.4 Using a builder to create instances of the UserDetails type
3.2.5 Combining multiple responsibilities related to the user
3.3 Instructing Spring Security on how to manage users
3.3.1 Understanding the UserDetailsService contract
3.3.2 Implementing the UserDetailsService contract
3.3.3 Implementing the UserDetailsManager contract
Summary
4 Managing passwords
4.1 Using password encoders
4.1.1 The PasswordEncoder contract
4.1.2 Implementing your PasswordEncoder
4.1.3 Choosing from the provided PasswordEncoder implementations
4.1.4 Multiple encoding strategies with DelegatingPasswordEncoder
4.2 Taking advantage of the Spring Security Crypto module
4.2.1 Using key generators
4.2.2 Encrypting and decrypting secrets using encryptors
Summary
5 A web app’s security begins with filters
5.1 Implementing filters in the Spring Security architecture
5.2 Adding a filter before an existing one in the chain
5.3 Adding a filter after an existing one in the chain
5.4 Adding a filter at the location of another in the chain
5.5 Filter implementations provided by Spring Security
Summary
6 Implementing authentications
6.1 Understanding the AuthenticationProvider
6.1.1 Representing the request during authentication
6.1.2 Implementing custom authentication logic
6.1.3 Applying custom authentication logic
6.2 Using the SecurityContext
6.2.1 Using a holding strategy for the security context
6.2.2 Using a holding strategy for asynchronous calls
6.2.3 Using a holding strategy for standalone applications
6.2.4 Forwarding the security context with DelegatingSecurityContextRunnable
6.2.5 Forwarding the security context with DelegatingSecurityContextExecutorService
6.3 Understanding HTTP Basic and form-based login authentications
6.3.1 Using and configuring HTTP Basic
6.3.2 Implementing authentication with form-based login
Summary
Part 3. Configuring authorization
7 Configuring endpoint-level authorization: Restricting access
7.1 Restricting access based on authorities and roles
7.1.1 Restricting access for all endpoints based on user authorities
7.1.2 Restricting access for all endpoints based on user roles
7.1.3 Restricting access to all endpoints
Summary
8 Configuring endpoint-level authorization: Applying restrictions
8.1 Using the requestMatchers() method to select endpoints
8.2 Selecting requests to apply authorization restrictions
8.3 Using regular expressions with request matchers
Summary
9 Configuring CSRF protection
9.1 How CSRF protection works in Spring Security
9.2 Using CSRF protection in practical scenarios
9.3 Customizing CSRF protection
Summary
10 Configuring CORS
10.1 How does CORS work?
10.2 Applying CORS policies with the @CrossOrigin annotation
10.3 Applying CORS using a CorsConfigurer
Summary
11 Implementing authorization at the method level
11.1 Enabling method security
11.1.1 Understanding call authorization
11.1.2 Enabling method security in your project
11.2 Applying preauthorization rules
11.3 Applying postauthorization rules
11.4 Implementing permissions for methods
Summary
12 Implementing filtering at the method level
12.1 Applying prefiltering for method authorization
12.2 Applying postfiltering for method authorization
12.3 Using filtering in Spring Data repositories
Summary
Part 4. Implementing OAuth 2 and OpenID Connect
13 What are OAuth 2 and OpenID Connect?
13.1 The big picture of OAuth 2 and OpenID Connect
13.2 Using various token implementations
13.2.1 Using opaque tokens
13.2.2 Using non-opaque tokens
13.3 Obtaining tokens through various grant types
13.3.1 Getting a token using the authorization code grant type
13.3.2 Applying PKCE protection to the authorization code grant type
13.3.3 Getting a token with the client credentials grant type
13.3.4 Using refresh tokens to get new access tokens
13.4 What OpenID Connect brings to OAuth 2
13.5 The sins of OAuth 2
Summary
14 Implementing an OAuth 2 authorization server
14.1 Implementing basic authentication using JSON web tokens
14.2 Running the authorization code grant type
14.3 Running the client credentials grant type
14.4 Using opaque tokens and introspection
14.5 Revoking tokens
Summary
15 Implementing an OAuth 2 resource server
15.1 Configuring JWT validation
15.2 Using customized JWTs
15.3 Configuring token validation through introspection
15.4 Implementing multitenant systems
Summary
16 Implementing an OAuth 2 client
16.1 Implementing OAuth 2 login
16.1.1 Implementing authentication with a common provider
16.1.2 Giving the user more possibilities
16.1.3 Using a custom authorization server
16.1.4 Adding flexibility to your configurations
16.1.5 Managing authorization for an OAuth 2 login
16.2 Implementing an OAuth 2 client
Summary
Part 5. Going reactive
17 Implementing security in reactive applications
17.1 What are reactive apps?
17.2 User management in reactive apps
17.3 Configuring authorization rules in reactive apps
17.3.1 Applying authorization at the endpoint layer in reactive apps
17.3.2 Using method security in reactive apps
17.4 Creating a reactive OAuth 2 resource server
Summary
Part 6. Testing security configurations
18 Testing security configurations
18.1 Using mock users for tests
18.2 Testing with users from a UserDetailsService
18.3 Using custom Authentication objects for testing
18.4 Testing method security
18.5 Testing authentication
18.6 Testing CSRF configurations
18.7 Testing CORS configurations
18.8 Testing reactive Spring Security implementations
Summary
Appendix A. Links to official documentation
Appendix B. Further reading
For Spring Framework in general
Spring in Action, Sixth Edition by Craig Walls (Manning, 2022)
Spring Boot Up & Running by Mark Heckler (O’Reilly Media, 2022)
Spring Start Here by Laurențiu Spilcă (Manning, 2021)
To help you learn more about building your Java app’s persistence layer
High-Performance Java Persistence by Vlad Mihalcea (self-published, 2019)
Java Persistence with Spring Data and Hibernate, Third Edition by Cătălin Tudose (Manning, 2023)
JUnit in Action, Third Edition by Cătălin Tudose (Manning, 2021)
index