Spring Security with ReactJS, OAuth2, JWT, MFA | Spring Boot

Explore how filters intercept and modify requests and responses, and how a filter chain in Spring Boot and Spring Security handles authentication, authorization, and pre- and post-processing.

Learn how Spring security handles authentication and authorization in a Spring Boot app, exploring authentication filters, authentication manager, providers, user details service, password encoder, and security context.

Configure spring security in a Spring Boot app by adding starter security dependencies with start.spring.io, enabling auto configuration and a login flow for secured endpoints.

Discover how Spring Security authenticates every endpoint by default in a Spring Boot project with form-based, built-in login and logout forms, plus development console password.

Explore how spring security auto configuration works behind the scenes by inspecting logs, including the user detail service auto configuration and the in-memory user details manager.

Configure static credentials in spring security by setting spring.security.user.name and spring.security.user.password in application.properties for development, bypassing the login form, while noting this is not secure for production.

Explore form-based authentication by hitting the hello endpoint, logging out at /logout, and noting the default login page generated by the logout page generating web filter and the login redirection.

Explore how Jsession ID and Spring Security manage sessions in the browser by inspecting cookies, loading a page, and observing session continuity across requests.

Switch from form-based to basic authentication by creating a custom security config that backs off the default Spring Security filter chain and enforces authentication for all requests.

Restart the application to verify basic authentication prompts a browser alert instead of a login form, with form-based login disabled; access the hello endpoint, enter credentials, and view authenticated data.

Demonstrates basic authentication using an authorization header and session cookies, versus form-based authentication with an html login form, csrf protection, payload data, and redirect-based access control.

Convert a stateful session-based API to stateless by configuring the session creation policy to stateless, removing cookies, and achieving stateless authentication in Spring Security.

Structure the secure nodes project by outlining simple CRUD endpoints for notes (create, read, update, delete) and exploring authentication concepts to build a secure base.

Set up the notes model in a Spring Boot project using JPA and Lombok, with id, content as a large object, and ownerUsername, and configure dependencies in pom.xml.

Implement a notes controller at /api/notes in Spring Boot, providing CRUD endpoints that associate notes with the currently authenticated user.

Install MySQL on your Mac by downloading the MySQL community server for macOS (ARM or x86 DMG) and then install MySQL workbench to connect and manage the database.

Install and secure MySQL server on ubuntu using apt, start the service, log into the MySQL shell, and connect with MySQL Workbench to manage databases.

Learn how Spring Security uses authentication providers to process login requests, verify credentials against databases or external services, and issue authentication tokens with user authorities.

Explore how the authentication provider interface powers Spring Security's authentication flow. Learn about the authenticate and supports methods, the authentication object, credential verification, and loading user details for authorization.

Implement in-memory authentication by storing credentials in application memory for quick setup during development and testing. Hardcode users and roles to bypass a database, enabling fast prototyping.

Explore the user details interface in spring security as a standardized representation of a user and how the user class implements it with username, password, authorities, and status flags.

Move from in-memory to database backed authentication using JDBC user details manager with a MySQL schema, creating users and authorities tables and configuring MySQL connectivity.

Learn why and how to use a custom user model in a Spring Boot app to extend user information, meet domain specific needs, and enable custom authentication.

Define a custom user model and a role system with an app role enum. Create a role class, a user class, and a user repository; add bean validation dependency.

Create a role repository to manage roles and users, using the role entity with a long id and a find by role name method returning an optional role.

Reveal the behind the scenes login flow: from the username password authentication filter to the DAO authentication provider and user details service using a MySQL repository.

Explore spring security's inbuilt authorization tools by learning the granted authority interface and its simple granted authority implementation, which define and represent user roles and authorities.

Explain how to create and manage custom roles with a role model, map roles to users, and use simple granted authority in user details for spring security and database persistence.

Implement an admin controller in spring boot to expose admin-only endpoints for listing all users, updating user roles, and retrieving individual user details via a DTO.

Implement authorization to restrict admin actions in a spring security 6 setup, allowing only admins to access admin APIs via URL based restrictions or method level security.

Learn to manage access in Spring Boot with method level security using Spring Security annotations such as pre authorize, secured, pre filter, and post filter, including an admin check.

Explore method level security in Spring Security by applying access rules directly to methods using pre-authorize and secured annotations. Learn owner checks, post authorize, and pre filter for ownership-based access.

Configure url based restrictions with spring security using a security filter chain and request matchers to open api/auth and images publicly, restrict /admin to admins, and require authentication elsewhere.

Clean up the security configuration by exposing the public endpoint and removing unnecessary settings. Choose annotation-based controller level security with pre authorized on the admin controller, and disable method-level security.

Secure password practices protect user data by encoding passwords in the database and preventing unauthorized access, ensuring password security matters for compliance, trust, and robust authentication.

Learn how hashing converts a message into a distinct, one-way value using algorithms like bcrypt. Explore how salt adds randomness to each hash, boosting security for passwords and data transmission.

Explore the spring security password encoder interface, encoding raw passwords and validating matches, with upgradeEncoding; review implementations like Argon2, BCrypt, and Pbkdf2.

Explore inbuilt password encoders in Spring Security, including bcrypt password encoder, Pbkdf2 password encoder, script password encoder, Argon2 password encoder, and no op encoder, with bcrypt most recommended for production.

Encode passwords with a bcrypt password encoder in the security config, store encoded values in the database, and verify them using matches to secure authentication.

Explore how Spring Security's default filter chain processes authentication, authorization, and CSRF protection in a defined order, managed by the filter chain proxy and virtual filter chain.

Explore the servlet filter lifecycle from init for initialization, through doFilter for request processing, to destroy for cleanup, all managed by the servlet container via the filter interface.

Create a custom logging filter in Spring Security and attach it to the filter chain, logging each request URI and response status before the authentication filter.

Explore advanced custom filter scenarios in Spring Security by combining multiple filters with correct order, implementing conditional filters based on request attributes, and enabling dynamic filter configurations via application properties.

Comment and disable the custom filters after learning to insert them before or after a filter in the chain, then delete the related files to keep the project clean.

Explain cross-site request forgery (CSRF), how authenticated sessions are exploited by malicious sites, and common impact scenarios like bank transfer attacks and unauthorized changes.

Learn how csrf protection uses a server-stored token linked to the user session to block unauthorized state-changing requests via hidden fields or headers.

Configure CSRF protection in Spring Security with a cookie CSRF token repository and expose a CSRF token API endpoint for front-end apps like React or Angular.