
Discover how the spring security framework handles authentication and authorization, proving identity with username and password or private key, then granting admin or read, insert, edit, delete access.
Launch a Spring Boot app with Spring Security, Thymeleaf, JPA, and MySQL, create a User entity and dashboard page, and explore the default login protection.
Explore configuring Spring Security with Java configuration, creating a security configuration class, and setting up in-memory authentication, role-based access, and a form login flow that redirects to a dashboard.
Create a login page using Thymeleaf, convert CF tags to Thymeleaf syntax, and configure a Spring controller with a get mapping to /login to render it.
Encode passwords with a bcrypt password encoder as a Spring bean wired into security configuration, enabling encoded login in Java Spring Security.
Explore creating a custom user details service in Java Spring Security, replacing in-memory authentication, implementing loadUserByUsername, wiring a user repository, and returning a user details object.
Compare embedding user details on the user object with creating a custom security user. Implement authorities and the four flags: non expired, non locked, credentials not expired, and enabled.
Test a database-backed user details service in Java Spring Security. Seed an encrypted password, assign the role user via authorities, and verify authentication and authorization.
Explore one-to-many and many-to-one mappings in JPA, with bidirectional relationships between user and authorities, lazy vs eager fetch, and cascade behavior in Spring Data.
learn how cross-site request forgery works and how to defend it by using csrf tokens on state-changing requests (post, put, patch, delete) in Spring Security with Thymeleaf forms.
Learn how to implement logout in a Spring Security app by using a form post with a csrf token, replacing a simple get link when csrf is enabled.
Pass the authenticated user object into controller methods with the authentication principal annotation in Spring Security, then expose it in the model and dashboard view.
Explore method level security with the @Secured annotation in spring security, guarding admin services and endpoints by role, enabling global method security, and handling access 403 errors.
Enable method level security in Spring using @Secured and enable Global method security. Secure admin methods by roles and verify access with admin and user accounts.
Learn how to enforce concurrent session management in Spring Security to prevent account sharing by limiting maximum sessions and logging out duplicate sessions.
This course will teach a Java programmer to add robust security to their web applications. Just like Facebook requires you to login before you can access your profile page, I will teach you how to stop unauthorized users from accessing the protected pages in your Java web application.
No prior experience with Spring Security is needed.
I'll show you exactly how to take your new or existing Java web application and make it so that you can protect certain pages/URLs from unauthorized users.
What is an unauthorized user?
Anyone who hasn't yet provided a username and password that matches an entry in your database!
I even show you how to assign roles to user accounts so you can custom tailor the user experience.
Basic users, Admin users, Super users, whatever user role you'd like to create, you can weave them into your web application and have it respond in dynamic ways
You'll learn how to integrate Spring Security directly into your existing database and protect whichever pages you like in less than a day.
Plus I show you exactly how to handle the always pesky "set up" process so it'll be a pain free experience for you.