REST API Security-BasicAuth-Authorization-JWT-OAuth-MFA-HMAC

Install and configure Java, Maven, and a development IDE, set Java home and Maven home, and prepare Postman for API testing to secure and develop your applications.

Explore the OpenAPI 3.0 spec for the books API and learn how to secure it with basic authentication, illustrating get and post operations on /books and /books/{book}.

Develop the initial books API with spring boot by creating a book model and controller, then secure endpoints using spring security and basic authentication.

Learn how https secures client–server communication by performing the ssl handshake, validating certificates, and using self-signed certificates with Java keytool to create keystores.

Enable https for the books api by configuring ssl with a certificate and keystore, then verify basic authentication in Postman to secure requests.

Learn how browsers display and validate certificates, including leaf and intermediate certificates. Understand how to export and import trusted certificates to resolve untrusted handshake warnings.

This lecture explains how filters intercept requests and responses in a Spring MVC application, forming a filter chain that enables security, logging, compression, and data transformation before reaching dispatcher servlet.

Demonstrate basic authentication by showing how a client obtains a user id and password, encodes them with base64, and sends them in an authorization header to trigger a 401 challenge.

Design an in-memory basic authentication flow by building a simple user model with username, password, and enabled flag, then implement Spring Security's UserDetails to bridge to authentication.

Create a user service as a non-spring-specific layer that stores a hardcoded in-memory user, exposes get by username, and demonstrates password hashing with a password encoder for basic authentication.

Implement a Spring Security user details service to retrieve user information by username, using constructor-based dependency injection from a user service, and handle not-found cases for authentication.

Configure spring security with a configuration class, enabling web security, and DSL methods to authorize requests using basic authentication and wire password encoder, user details service, and authentication entry point.

Develop a basic authentication entry point by extending BasicAuthenticationEntryPoint, configuring it as a component, and returning a 401 with a WWW-Authenticate header and basic authentication guidance.

Demonstrate how a client’s request flows through the security interceptor to a basic authentication filter, triggering authentication entry point and authentication manager with the user details service to authorize access.

See basic authentication in action as app boots, runs through security interceptors and filters, tests with Postman, handles unauthorized and bad credentials, and completes authentication via the user details service.

Implement a file-based user repository to manage a small set of users from a JSON file, and integrate it with the existing user service with minimal changes.

Install MySQL, set up MySQL Workbench, create a schema, create a user with a password, grant access on the schema, and prepare the database for storing users.

Create the users table and insert test users to prepare the api test data. Verify that two users appear by running insert and select queries in the database.

Add JPA and Hibernate dependencies, configure the spring data source, and implement a user entity mapped to the users table with username and password fields using JPA annotations.

Replace the file-based user repository with a database-backed repository, implement a repository interface and mapping, and test basic authentication flow using dependency injection and Spring Data.

Implement a post endpoint to create a book using a request body, generate a random barcode, and return a created status, with basic auth enforcing admin-only creation.

Explore how Spring Security uses granted authority to define roles like admin and user, and implement getAuthorities in the user details service to supply these authorities.

Implement authorization by modeling authorities and a one-to-many relation to users, and configure repositories and security rules to enforce admin and user access.

Explore the difference between roles and authorities in Spring Security, and learn how settings like in-memory authentication and granted authorities influence access control for user profiles and details.

Update the user entity to support roles with a new user_role table and many-to-one links, refactor authorities with a role string, and adjust repositories accordingly.

Modify the user service to load roles and authorities from the database, map user rules to authorities, and expose combined authorities for access control.

Test and verify role and authority changes in the rest api by updating user authorities, observing access permissions, and combining roles with authorities in security checks.