Your cart is empty.
Keep shopping
Teach on Udemy
Turn what you know into an opportunity and reach millions around the world.
Learn MoreSecurity in Spring Boot REST Web Service Applications
Rating: 3.5 out of 53.5(4 ratings)
162 students
Security in Spring Boot REST Web Service Applications
With Spring Security, authentication, filters, JWT, TLS/HTTPS, Digital Certificates, PKI and Role-based Authorization
Created byHoward Hyde
Last updated 8/2024
English
English [Auto],
What you'll learn
- Comprehensive Security for Spring Boot REST web service applications: HTTPS, User management, Authentication, Role-based Authorization
- General principles of cyber security: Threats and defenses, Cryptography (encryption/decryption/hashing; symmetric/asymmetric), TLS, cypher suites
- Implementing user/security and business databases, JSON Web Tokens (JWTs) and SSL/TLS over HTTP (HTTPS) communication with web services
- Spring Security Framework: Architecture, Theory, practical examples: Configuration, filters, authentication and authorization
Explore related topics
Course content
10 sections • 68 lectures • 8h 7m total length
- Introduction and "Part 0": Is this course right for me?6:43
Determine if this course fits your needs by outlining security for Spring Boot rest apps. Learn about encryption basics, https, public key infrastructure, json web tokens, and role-based authorization.
- It's a dangerous world out there.6:56
Explore threats to confidentiality, integrity, and availability in Spring Boot REST web services, and learn to protect data at rest, in transit, and in processing from social engineering and exfiltration.
- Consequences of Security Breaches2:00
Explore the five dimensions of security breach consequences—financial, reputational, strategic, operational, and compliance—and how breaches affect your customers, partners, and bottom line.
- The Mighty PASS-WORD6:03
- Introduction to Cryptography5:39
Explore how cryptography transforms plaintext into ciphertext to ensure confidentiality, integrity, authentication, and non-repudiation, and distinguish encryption, decryption, hashing, and encoding.
- Cryptography Algorithms and Keys5:43
- Symmetric and Asymmetric Cryptography3:07
Compare symmetric and asymmetric cryptography, highlighting fast secret-key encryption for large payloads and scalable public-private key pairs for multi-party communication. Grasp how keys ensure confidentiality and non-repudiation.
- Named / Branded Cryptography Algorithms7:45
Explore named cryptography algorithms and protocols, including aes, des, 3des, chacha20-poly1305, and gcm, with notes on rsa, ecdsa, and diffie-hellman for secure key exchange.
- SSL and TLS2:34
Explain SSL and TLS, TLS as SSL's successor, and how Spring Boot configures TLS via server.ssl to secure communication with authentication, encryption, integrity, digital certificates, PKI, and cipher suites.
- Digital Certificates and the Public Key Inftrastructure (PKI)11:30
- TLS v1.2 Cipher Suites and Handshake6:55
Explore TLS v1.2 cipher suites and the handshake, detailing key exchange, authentication, encryption, and hashing for secure HTTPS sessions.
- TLS v1.3 Cipher Suites and Handshake3:42
Explore TLS version 1.3, reducing cipher suites and removing most key exchange methods to strengthen security. Shorten the handshake and rely on Diffie-Hellman ephemeral with AEAD and sha 256/384.
- The Mighty PASS-WORD Redux4:30
Explore rainbow table attacks on hashed passwords, and how salting and strong, random passwords defend against them, as we prepare a demo app secured by Spring Security.
- Part 2: Introducing the Demo App and its Components: Overview10:52
Introducing the Demo App and its Components
Databases (PostGreSQL):
Business application database/schema
User/security database/schema
Web Services (Spring Boot)
Business Application: “FboAce”
Authorization Server/Gateway to User Database: “Fortress”
Client UI Application (Angular)
- Database Schema Design Considerations3:56
Database: Schema Design Considerations
Application database/schema
Application design (surrogate keys)
with additional namespace differentiator column in all transactional tables for data segregation.
User/Security database/schema
"Utility" design (immutable unique business identifiers)
with overloaded usage of username column for data namespace specification
- Business Application DB tables, columns, keys, views6:50
The Business Application Database Design & DDL
Tables, views, triggers, functions
The attached file resource contains all of the SQL scripts to create and pre-populate the business AND user/security database tables and related objects.
For a more in-depth introduction to PostGreSQL, see my course "Introduction to Database Application Development with Spring Boot, Angular and PostGres": https://www.udemy.com/course/intro-db-app-dev-springboot-angular/
- User/Security DB tables, views and reference data9:31
- Demo App web services overview and resource bundles8:47
Web Services:
Authorization Server/Gateway to User Database: “Fortress”
Business Application: “FboAce”
Fortress and FboAce share common library: “RadSpringSecurity”
Review of Database CRUD operations with the Java Persistence API (JPA):
See my course “Introduction to Database Application Development with Spring Boot, Angular, and Postgres”
https://www.udemy.com/course/intro-db-app-dev-springboot-angular
JPA video discourses included in Extra Appendix to this course
- Client User Interface App: Angular/Typescript2:27
Explore how the angular ui client for fbos implements authentication and role-based authorization, controlling data access and user interface elements through login and is-permitted checks.
- Enabling HTTPS Overview: Certificates, Spring Boot, Web Server3:09
Acquire a digital certificate from a trusted CA, deploy the public certificate, private key, and keystore to enable HTTPS, and configure Spring Boot SSL properties.
- Deploying your Web App to your Domain2:41
Deploy your web app to your domain by preparing private keys and certificates, placing files on the deployment server, and reviewing an Apache Docker example.
- Acquire the Certificate from a Certificate Authority5:27
Acquire a digital certificate from a certificate authority by generating a certificate signing request (CSR) with your private and public keys, then verify domain ownership and deploy the certificate.
- Deploy Private Key and Certificate to Spring Boot project5:00
- Deploy Private Key and Certificate to web application server3:32
Deploy a certificate and private key to an Apache web server via Docker, copy server.key and server.crt to the conf, enable https on port 443 in httpd.conf, and note keystores.
- Introduction to Keystores and OpenSSL6:34
Explore keystores in Spring Boot and how they secure certificates and keys. Use OpenSSL to create PKCS12 keystores and manage certificates with externalized passwords.
- Part 4: The Spring Security Framework in our Demo App: Overview4:38
Explore the spring security framework through a practical rest web service demo, focusing on authentication and authorization, with fortress, fbos, and the Rad Spring Security library.
- Representing Users: interfaces UserDetails, GrantedAuthority, and Authentication6:01
Learn how Spring security represents users with the user details, granted authority, and authentication interfaces, using role prefixes and subject action pairs to model roles, permissions, and access.
- Populating GrantedAuthority: UserRoles and Subject:Action pairs4:46
Learn how to populate granted authority from user roles and explicit subject-action pairs using a JPA User Authority model and a view, enabling UI and JWT permissions.
- UserDetailsService, UserDetailsManager, and custom extensions4:47
Spring Security User Management/Service interfaces
interface UserDetailsService
Methods:
UserDetails loadUserByUsername(String username)
interface UserDetailsManager extends UserDetailsService
Methods:
void createUser(UserDetails user)
void updateUser(UserDetails user)
void deleteUser(String username)
void changePassword(String oldPassword, String newPassword)
UserService extends UserDetailsManager
Custom methods:
List<? extends SimpleUser> getAllSimple ();
SimpleUser getSimpleUser(String userName) throws Exception;
SimpleUserPass getSimpleUserPass(String userName) throws Exception;
SimpleUser addUserPass (SimpleUserPass userPass);
SimpleUser updateUserPass (SimpleUserPass userPass) throws Exception;
int deleteUserPass (String username) throws Exception;
Boolean validateUserPass (SimpleUserPass userPass) throws Exception;
int addUserRole (UserRole userRole) throws Exception;
int removeUserRole (UserRole userRole) throws Exception;
List<? extends SimpleUser> getAllUsersPerPrincipal(String principal);
List<? extends UserRole> getAllRolesPerUser(String username);
List<? extends GrantedAuthority> getAuthorities (String username);
- @EnableWebSecurity, @Bean PasswordEncoder and encrypting/validating passwords5:36
User Accounts (and passwords): Creating, Retrieving, Updating and Deleting
Fortress is our demo Spring Boot web service which exposes CRUD operations on the User/security database tables.
When creating/updating User records, we don’t save the password in clear text.
We encrypt (hash) them before saving to the database.
org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder
implements PasswordEncoder
Also enables us to validate them later, during Authentication
Sneak Peek: @EnableWebSecurity
The class with this annotation is the heart of the Spring Security configuration and magic in your Spring app.
We will have much more to say about it later (under “Authorization”), but for now we are only interested in its secondary function as a(n) @Configuration class, provider of @Beans.
Specifically, a bean of type PasswordEncoder.
- Overview of the Authentication and Authorization Cycle7:11
Explain the authentication and authorization cycle in a spring boot rest app, where fortress authenticates the service, issues a JWT with authorities, and the UI client accesses FBOS resources.
- Custom AuthenticationProvider, UserDetails and UserDetailsService; JWTs17:17
HOW does Fortress provide for FboAce to log in/authenticate?
- UserDetailsService implementation deeper dive8:12
Show how fortress authenticates end user accounts via the /authenticate endpoint, using a simple user pass DTO and authentication provider to return an authenticated object with authorities for JWT-based authorization.
- Authorization: Introducing @EnableWebSecurity and @Bean SecurityFilterChain7:23
Authorization: Introducing @EnableWebSecurity and @Bean SecurityFilterChain
How does Fortress know how to permit or deny access to a requested resource?
HttpSecurity and its builder methods
- Authentication, Authorization Filter and Validating the JWT6:35
Explain how to verify a JWT with a custom authorization filter in spring security, parse the token's claims into granted authorities, and set the security context to authenticated before controllers.
- One Spring Boot Webservice authenticates another: WebClient16:30
FboAce:
public class FortressAuthenticationProvider implements AuthenticationProvider ...
Different implementation than Fortress:
public class UserPassAuthenticationProvider implements AuthenticationProvider ...
FortressAuthenticationProvider calls/delegates to Fortress
WebClient (More current than RestTemplate):
pom.xml entry:
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-webflux</artifactId>
</dependency>See code examples in FboAce:
./main/java/com/radinfodesign/fboace04/security/config/WebClientConfig.java
./main/java/com/radinfodesign/fboace04/security/component/FortressAuthenticationProvider.java
./main/java/com/radinfodesign/fboace04/security/service/FortressLoginService.java
Resources:
https://docs.spring.io/spring-framework/reference/web/webflux-webclient.html
https://spring.academy/guides/spring-webclient-gs
https://docs.spring.io/spring-framework/docs/current/javadoc-api/org/springframework/web/reactive/function/client/WebClient.html
https://www.baeldung.com/webflux-webclient-parameters
- Endpoint Authorization with requestMatchers(), hasAnyRoles() hasAnyAuthorities()11:41
Learn role-based and fine-grained authorization in Spring Boot REST services using requestMatchers, hasAnyRoles, and hasAnyAuthorities to protect admin and data endpoints.
- Method-based Authorization with @EnableMethodSecurity26:19
@EnableMethodSecurity, MethodSecurityExpressionHandler and PermissionEvaluator
@PreAuthorize()
@PostAuthorize()
Spring Expression Language:
https://docs.spring.io/spring-framework/docs/3.0.x/reference/expressions.html
https://docs.spring.io/spring-security/site/docs/3.1.x/apidocs/org/springframework/security/access/PermissionEvaluator.html
More on method-level authorization:
https://www.baeldung.com/spring-security-method-security
https://docs.spring.io/spring-security/reference/servlet/authorization/method-security.html
- Implementing Authentication and (Role-based) Authorization in Angular1:24
Implementing Authentication and (Role-based) Authorization in Angular
How can an Angular UI app facilitate Authentication of its users against a web service like FboAce?
How may the Angular app know what modules, elements and/or data it may present to and/or enable for a user?
For an in-depth treatment (from complete beginner) of Angular, Typescript and the demo UI app for FboAce, see the course "Introduction to Database Application Development with Spring Boot, Angular and PostGres": https://www.udemy.com/course/intro-db-app-dev-springboot-angular/
- Authentication using Angular and Typescript6:02
- Authorization using Angular and Typescript11:45
(Role-based) Authorization in Angular (External to Spring Boot/Security)
Even if you have little or no interest in Angular or Typescript, we highly recommend watching this discourse, if only to get a conceptual understanding of the mechanics of this very important feature.
LoginService
public isPermitted(subject: string, permission: string): boolean
AuthorizationService
public isPermitted(subject: string, permission: string, authorities: string[]): Boolean
Entity Component class / constructor
this.mayEditData = this.isPermitted(PATH_ENTITY, PERMISSION__ALL);
Entity Component HTML template
Structural Directive: *ngIf
<button *ngIf=" isPermitted(SUBJECT_AIRPORT, PERMISSION_NAVIGATE)"
- Part 5: Spring Security Theory, Architecture and Variations: Overview7:30
Explore Spring Security's architecture and theory, including filters, authentication and authorization, and how the authentication object and security context enable secure access to resources.
- Spring Security Inception7:41
spring-boot-starter-security and @EnableWebSecurity
- Filters and Configuration - Introduction4:56
- Filters and Configuration: CORS (Cross-Origin Resource Sharing)11:17
Explore configuring CORS in Spring Boot REST apps to resolve cross-origin blocks, using a global CorsConfigurationSource with allowed origins, methods, headers, and exposed authorization headers.
- Filters and Configuration: CSRF, SessionManagement, httpBasic, formLogin5:33
- Filters and Configuration: requestMatchers() and Action/applied policies12:41
Configure requestMatchers and applied policies to implement role-based authorization in a Spring Boot REST service, mapping URL patterns and HTTP methods with ant patterns for fine-grained access.
- Filters and Configuration: Custom Filters and insertion into the chain8:20
Custom Filter Insertions
HttpSecurity
.addFilterBefore(customFilterBean1Name, SpringFilter.class)
.addFilterAt(customFilterBean2Name, SpringFilter.class)
.addFilterAfter(customFilterBean3Name, SpringFilter.class)
https://docs.spring.io/spring-security/site/docs/current/api/org/springframework/security/config/annotation/web/HttpSecurityBuilder.html#addFilter(jakarta.servlet.Filter)
- User Account Representation, Persistence and Management10:35
Explore user account representation and management in Spring Security, comparing the default SQL schema with custom schemas, and implement authentication using user details, authorities, and bcrypt password encoding.
- Spring Security standard User SQL database schema2:21
Implement Spring Security's standard users and authorities schema with default components handling authentication. Review Postgres DDL and DML scripts, note the denormalized design, and see the workflow for default authentication.
- Basic Authentication Scenarios18:52
Watch how http basic credentials are processed by spring security's authentication manager and dao authentication provider to enforce role-based access for endpoints like api flight.
- Basic Authentication Review6:32
- Authentication Endpoint6:58
Implement a dedicated authentication endpoint that accepts username and password, authenticates via the authentication manager, and issues a signed JWT containing user authorities for subsequent requests.
- Authorization with JWT5:17
Implement JWT-based authorization in a Spring Boot REST service with a Rad Authorization Filter that reads tokens from the Authorization header and builds authentication from claims.
- UserDetailsManager: Maintaining User and Authorities data18:21
Maintaining User Data Records (SQL)
Using (Jdbc)UserDetailsManager
to:
Create, update, delete users
Grant, revoke authorities
- Conclusion0:57
We conclude the course on security in Spring Boot REST web service applications and invite you to stay tuned for updates on Spring Security best practices and related technologies.
- Introduction to this Appendix0:12
The videos in this appendix are taken from the author's course “Introduction to Database Application Development with Spring Boot, Angular and Postgres” at
https://www.udemy.com/course/intro-db-app-dev-springboot-angular/?referralCode=3AB74AFDA723F00C4762
These videos are offered as a convenience to help students implement the SQL DDL and DML scripts associated with this course.
- PostgreSQL Database installation and tools1:31
- PostGreSQL Installation on Windows2:36
Install Postgres on Windows by downloading the Windows x86_64 installer, configuring the data directory, creating a password, keeping the default port, selecting a locale, and finishing the setup.
- Using pgAdmin9:19
Open pgAdmin after installing Postgres, create a dedicated login and a database owned by that user. Create an oltp schema and the aircraft_type table, then view and insert data.
- Using the psql command-line tool11:14
Connect to a Postgres database with the psql command-line tool, execute backslash and SQL commands, set the search path, and query schemas, tables, and metadata while noting case sensitivity.
- EXTRA APPENDIX II: Maintaining Data with the Java Persistence API (JPA)0:21
- JPA Sneak Peek2:54
- JPA Model Entities14:47
Map a simple dto aircraft type to a JPA entity using @Entity, @Table, @Id, @Column, @GeneratedValue with a sequence generator, enabling database mapping and eliminating verbose JDBC code.
- JPA Repositories9:27
Leverage JPA repositories in Spring Data to auto-wire CrudRepository methods like save, find by id, and find all, translating entity operations into SQL with minimal code.
- Advanced Database Design Concepts0:24
The video in this appendix is taken from the author's course “Introduction to Database Application Development with Spring Boot, Angular and Postgres” at
https://www.udemy.com/course/intro-db-app-dev-springboot-angular/learn/lecture/32221706
This discourse illustrates database design and ER Diagraming techniques with ER Studio, an in-depth discussion of the FboAce schema, and set-based business rule enforcement and facilitation in particular ("Only Pilots certified in an Aircraft Type may be assigned to Flights piloting Aircraft of that Type").
The enforcement of business rules of this nature are as much a part of your application's Security profile as anything else; remember Confidentiality, Availability and INTEGRITY.
- FboAce Schema and Set-based Business Rules15:48
Apply the FboAce schema and set-based business rules to enforce that only pilots with the correct aircraft type certifications join a flight crew, via an identifying flight crew member entity.
- Just for Fun: Howard performs "A Night in Tunisia" by Dizzy Gillespie3:33
Learn how to secure Spring Boot rest web service applications, presented in a lively, just-for-fun lecture featuring Howard performing a night in Tunisia by Dizzy Gillespie.
Requirements
- Intermediate Java programming and Spring Boot development knowledge
Description
A complete practical case study and tutorial featuring the Spring Security framework.
Filters and configuration
Authentication
JSON Web Tokens (JWT)
Role-based Authorization
In-depth theory
Also:
General Cybersecurity principles and concepts
Cryptography: Encryption, encoding and hashing
Symmetric and Asymmetric (public/private key) encryption
HTTP over SSL/TLS (HTTPS)
Digital Certificates & Public Key Infrastructure (PKI)
TLS Cipher Suites and handshakes
Case study of a Demo App with 2 Spring Boot REST web services, an Angular/Typescript UI client app and PostGreSQL database(s), which
Encrypts all communication between browser and server via HTTP over SSL/TLS (HTTPS)
Establishes trust via signed digital certificates (Public Key Infrastructure -- PKI)
Requires valid credentials to log in.
Custom example user/role/resource/action/authority database.
Limits access to resources in web service and client app according to roles / authorities of user account; detailed development of Authorization
Employs JSON Web Tokens (JWTs) as its authorization mechanism.
NOT WebMvc: Does NOT track sessions or JSESSONID cookies; does not output HMTL, login forms etc. (not JSP or Thymeleaf)
Rather, REpresentational State Transfer (REST): Exchanges JSON data payloads with clients
Assumes clients take care of all UI elements, HTML code, css, Javascript etc.
Course Structure
Part 0: Is this Course Right for Me?
Part 1: General Cyber Security Principles
Part 2: Introducing the Demo App and its Components
Part 3: Application Security elements BEFORE adding the Spring Security Framework
Part 4: The Spring Security Framework in our Demo App
Part 5: A Deeper Dive into Spring Security Architecture and Theory
Who this course is for:
- Web service developers/software engineers, architects, cyber security professionals