Security in Spring Boot REST Web Service Applications

Explore threats to confidentiality, integrity, and availability in Spring Boot REST web services, and learn to protect data at rest, in transit, and in processing from social engineering and exfiltration.

Explore the five dimensions of security breach consequences—financial, reputational, strategic, operational, and compliance—and how breaches affect your customers, partners, and bottom line.

Examine the mighty password, its vulnerabilities and defenses, including encryption, https, salt and key stretching, and attacks like brute force, dictionary, rainbow table, and spraying, plus multi-factor authentication.

Explore how cryptography transforms plaintext into ciphertext to ensure confidentiality, integrity, authentication, and non-repudiation, and distinguish encryption, decryption, hashing, and encoding.

Explore how algorithms and keys transform data into ciphertext, using rotation and secret keys. Learn about block and stream ciphers and hashing with sha variants.

Compare symmetric and asymmetric cryptography, highlighting fast secret-key encryption for large payloads and scalable public-private key pairs for multi-party communication. Grasp how keys ensure confidentiality and non-repudiation.

Explore named cryptography algorithms and protocols, including aes, des, 3des, chacha20-poly1305, and gcm, with notes on rsa, ecdsa, and diffie-hellman for secure key exchange.

Explain SSL and TLS, TLS as SSL's successor, and how Spring Boot configures TLS via server.ssl to secure communication with authentication, encryption, integrity, digital certificates, PKI, and cipher suites.

Explore how digital certificates and PKI secure web services with HTTPS, enabling authentication, confidentiality, and integrity through a trusted chain of certificate authorities, X.509 standards, and subject alt names.

Explore TLS v1.2 cipher suites and the handshake, detailing key exchange, authentication, encryption, and hashing for secure HTTPS sessions.

Explore TLS version 1.3, reducing cipher suites and removing most key exchange methods to strengthen security. Shorten the handshake and rely on Diffie-Hellman ephemeral with AEAD and sha 256/384.

Explore rainbow table attacks on hashed passwords, and how salting and strong, random passwords defend against them, as we prepare a demo app secured by Spring Security.

Examine a custom user security schema for Spring Boot REST apps, detailing authentication with hashed passwords, roles, subject actions, and views for user authorities and data segregation.

Explore how the angular ui client for fbos implements authentication and role-based authorization, controlling data access and user interface elements through login and is-permitted checks.

Acquire a digital certificate from a trusted CA, deploy the public certificate, private key, and keystore to enable HTTPS, and configure Spring Boot SSL properties.

Deploy your web app to your domain by preparing private keys and certificates, placing files on the deployment server, and reviewing an Apache Docker example.

Acquire a digital certificate from a certificate authority by generating a certificate signing request (CSR) with your private and public keys, then verify domain ownership and deploy the certificate.

Deploy the public certificate and private key into the Spring Boot project's keystore, configure tls on port 8443 via application.properties, and ignore private keys in gitignore.

Deploy a certificate and private key to an Apache web server via Docker, copy server.key and server.crt to the conf, enable https on port 443 in httpd.conf, and note keystores.

Explore keystores in Spring Boot and how they secure certificates and keys. Use OpenSSL to create PKCS12 keystores and manage certificates with externalized passwords.

Explore the spring security framework through a practical rest web service demo, focusing on authentication and authorization, with fortress, fbos, and the Rad Spring Security library.

Learn how Spring security represents users with the user details, granted authority, and authentication interfaces, using role prefixes and subject action pairs to model roles, permissions, and access.

Learn how to populate granted authority from user roles and explicit subject-action pairs using a JPA User Authority model and a view, enabling UI and JWT permissions.

Explain the authentication and authorization cycle in a spring boot rest app, where fortress authenticates the service, issues a JWT with authorities, and the UI client accesses FBOS resources.

Show how fortress authenticates end user accounts via the /authenticate endpoint, using a simple user pass DTO and authentication provider to return an authenticated object with authorities for JWT-based authorization.

Explain how to verify a JWT with a custom authorization filter in spring security, parse the token's claims into granted authorities, and set the security context to authenticated before controllers.

Learn role-based and fine-grained authorization in Spring Boot REST services using requestMatchers, hasAnyRoles, and hasAnyAuthorities to protect admin and data endpoints.

Learn how an Angular UI authenticates users to a Spring Boot REST service by posting credentials, retrieving a JWT bearer token, and enforcing role-based authorization.

Explore Spring Security's architecture and theory, including filters, authentication and authorization, and how the authentication object and security context enable secure access to resources.

Explore spring security filters and configuration to compose the authentication object, attach it to the security context, and authorize legitimate users through the filter chain.

Explore configuring CORS in Spring Boot REST apps to resolve cross-origin blocks, using a global CorsConfigurationSource with allowed origins, methods, headers, and exposed authorization headers.

Explore CSRF protection for mutating HTTP requests, how the underscore CSRF token is issued and used, and why stateless REST APIs rely on JWT tokens instead of cookies.

Configure requestMatchers and applied policies to implement role-based authorization in a Spring Boot REST service, mapping URL patterns and HTTP methods with ant patterns for fine-grained access.

Explore user account representation and management in Spring Security, comparing the default SQL schema with custom schemas, and implement authentication using user details, authorities, and bcrypt password encoding.

Implement Spring Security's standard users and authorities schema with default components handling authentication. Review Postgres DDL and DML scripts, note the denormalized design, and see the workflow for default authentication.

Watch how http basic credentials are processed by spring security's authentication manager and dao authentication provider to enforce role-based access for endpoints like api flight.

Explore basic authentication in a Spring Boot REST app by configuring beans for password encoding, user details, and authentication, and verify role-based access via the security filter chain.

Implement a dedicated authentication endpoint that accepts username and password, authenticates via the authentication manager, and issues a signed JWT containing user authorities for subsequent requests.

Implement JWT-based authorization in a Spring Boot REST service with a Rad Authorization Filter that reads tokens from the Authorization header and builds authentication from claims.

We conclude the course on security in Spring Boot REST web service applications and invite you to stay tuned for updates on Spring Security best practices and related technologies.

Graduate from H2 to Postgres, installing and exploring pgadmin and sql cli, downloading Postgres from postgres.org for Windows, Mac, and Linux, and prepping ddl basics.

Install Postgres on Windows by downloading the Windows x86_64 installer, configuring the data directory, creating a password, keeping the default port, selecting a locale, and finishing the setup.

Open pgAdmin after installing Postgres, create a dedicated login and a database owned by that user. Create an oltp schema and the aircraft_type table, then view and insert data.

Connect to a Postgres database with the psql command-line tool, execute backslash and SQL commands, set the search path, and query schemas, tables, and metadata while noting case sensitivity.

Get a quick JPA sneak peek by turning a DTO into a JPA entity with basic annotations. Use a CrudRepository for create, retrieve, update, and delete operations.

Map a simple dto aircraft type to a JPA entity using @Entity, @Table, @Id, @Column, @GeneratedValue with a sequence generator, enabling database mapping and eliminating verbose JDBC code.

Leverage JPA repositories in Spring Data to auto-wire CrudRepository methods like save, find by id, and find all, translating entity operations into SQL with minimal code.

Apply the FboAce schema and set-based business rules to enforce that only pilots with the correct aircraft type certifications join a flight crew, via an identifying flight crew member entity.

Learn how to secure Spring Boot rest web service applications, presented in a lively, just-for-fun lecture featuring Howard performing a night in Tunisia by Dizzy Gillespie.