Spring Security with ReactJS, OAuth2, JWT, MFA | Spring Boot

Learn how principal represents the currently logged-in user and how the authentication object, including credentials and authorities (roles), defines who you are and what you can do in Spring Security.

Explore how filters intercept and modify requests and responses, and how a filter chain in Spring Boot and Spring Security handles authentication, authorization, and pre- and post-processing.

Learn how Spring security handles authentication and authorization in a Spring Boot app, exploring authentication filters, authentication manager, providers, user details service, password encoder, and security context.

Configure spring security in a Spring Boot app by adding starter security dependencies with start.spring.io, enabling auto configuration and a login flow for secured endpoints.

Discover how Spring Security authenticates every endpoint by default in a Spring Boot project with form-based, built-in login and logout forms, plus development console password.

Explore how spring security auto configuration works behind the scenes by inspecting logs, including the user detail service auto configuration and the in-memory user details manager.

Configure static credentials in spring security by setting spring.security.user.name and spring.security.user.password in application.properties for development, bypassing the login form, while noting this is not secure for production.

Explore the internal spring security flow, from the authorization and authentication filters to the authentication manager and providers, including in-memory user details and password encoding.

Explore form-based authentication by hitting the hello endpoint, logging out at /logout, and noting the default login page generated by the logout page generating web filter and the login redirection.

Demonstrate form-based authentication in a Spring Security 6 app using Postman, showing how to send basic auth headers, decode credentials, and view authorization flow from login to validated access.

Explore essential Spring security filters, including security context persistence, web async manager integration, header writer, cross-origin resource sharing, CSRF, logout, and authentication filters, for interview readiness and secure app design.

Explore how Jsession ID and Spring Security manage sessions in the browser by inspecting cookies, loading a page, and observing session continuity across requests.

Learn basic authentication in Spring Security by sending username and password in the authorization header, base64-encoded, with the server returning the response on success or 401 unauthorized on failure.

Switch from form-based to basic authentication by creating a custom security config that backs off the default Spring Security filter chain and enforces authentication for all requests.

Restart the application to verify basic authentication prompts a browser alert instead of a login form, with form-based login disabled; access the hello endpoint, enter credentials, and view authenticated data.

Demonstrates basic authentication using an authorization header and session cookies, versus form-based authentication with an html login form, csrf protection, payload data, and redirect-based access control.

Convert a stateful session-based API to stateless by configuring the session creation policy to stateless, removing cookies, and achieving stateless authentication in Spring Security.

learn to perform basic authentication in postman by using the authorization tab, entering a username and password, and sending requests to observe the authorization header and base64 encoding.

Learn how base64 encoding converts binary data to ascii strings and forms the basic authentication header, with a Postman demo encoding the username:password and decoding the credentials.

Learn how to permit certain endpoints in spring security by using request matches to mark public pages like /contact or /public/*, bypassing authentication while securing the rest.

Use deny all to reject requests to endpoints like /admin, regardless of authentication, yielding a 403 forbidden response. Use it for maintenance mode, deprecated endpoints, or endpoints with sensitive data.

Structure the secure nodes project by outlining simple CRUD endpoints for notes (create, read, update, delete) and exploring authentication concepts to build a secure base.

Set up the notes model in a Spring Boot project using JPA and Lombok, with id, content as a large object, and ownerUsername, and configure dependencies in pom.xml.

Set up the repository and service layer for a Spring Boot app by creating a node repository and a node service interface and implementation to perform CRUD for a user.

Implement a notes controller at /api/notes in Spring Boot, providing CRUD endpoints that associate notes with the currently authenticated user.

Download the offline MySQL installer for Windows from the official site, then install the server, MySQL Workbench, and MySQL Shell, and configure a root password and localhost connection.

Install MySQL on your Mac by downloading the MySQL community server for macOS (ARM or x86 DMG) and then install MySQL workbench to connect and manage the database.

Install and secure MySQL server on ubuntu using apt, start the service, log into the MySQL shell, and connect with MySQL Workbench to manage databases.

Explore the MySQL Workbench interface, including the administration pane, schemas, and the main query editor. Learn to run queries, view output, and customize fonts for clearer database work.

Configure a Spring Boot app to use a local MySQL database by creating a schema, adding the MySQL connector, and updating application.properties with the URL, credentials, and dialect.

Test the secure notes API by running the app in IntelliJ, verify the MySQL connection and notes table, and test CRUD operations in Postman with authorization and CSRF disabled.

Update security configurations for the nodes project by replacing the security config class, authorizing every request, disabling CSRF checks, and enabling basic authentication via http build.

Learn how Spring Security uses authentication providers to process login requests, verify credentials against databases or external services, and issue authentication tokens with user authorities.

Explore Spring Security 6 authentication providers such as Dao (default), in-memory, ldap, active directory ldap, pre authenticated, and oauth2, and learn how each implements the authentication provider interface.

Explore how the authentication provider interface powers Spring Security's authentication flow. Learn about the authenticate and supports methods, the authentication object, credential verification, and loading user details for authorization.

Implement in-memory authentication by storing credentials in application memory for quick setup during development and testing. Hardcode users and roles to bypass a database, enabling fast prototyping.

Configure in-memory authentication using an in-memory user details manager to support multiple users. Define two users with usernames and plaintext passwords, showing how spring security handles multi-user setup without encryption.

Test changes by running the app and using Postman to create and view nodes with basic auth. Validate in-memory users and multi-user authentication in Spring Security.

Explore the core classes and interfaces for user management in Spring Security, including authentication, authorization, and how user details are saved, to navigate and debug security workflows.

Explore the user details interface in spring security as a standardized representation of a user and how the user class implements it with username, password, authorities, and status flags.

Explore how Spring Security's user details, user details service, and user details manager handle authentication and account management, including loading by username and JDBC or in-memory implementations.

Review how in-memory authentication uses the in-memory user details manager in security config to create users from the user class that implements user details.

Move from in-memory to database backed authentication using JDBC user details manager with a MySQL schema, creating users and authorities tables and configuring MySQL connectivity.

Let spring boot's auto configuration wire a JDBC user details manager for a configured MySQL database, replacing in-memory authentication so users are stored and authenticated in the database.

Configure JDBC user details manager with a data source, verify MySQL-backed authentication, and ensure two users (admin and user) with roles work via dao authentication.

Learn why and how to use a custom user model in a Spring Boot app to extend user information, meet domain specific needs, and enable custom authentication.

Define a custom user model and a role system with an app role enum. Create a role class, a user class, and a user repository; add bean validation dependency.

Implement custom user details and a user details service to bridge your database user model with Spring Security for authentication and authorization.

Create a role repository to manage roles and users, using the role entity with a long id and a find by role name method returning an optional role.

Demonstrate adding a custom user model in Spring Security by dropping and recreating user and authority tables, seeding data, and validating role-based authentication.

Reveal the behind the scenes login flow: from the username password authentication filter to the DAO authentication provider and user details service using a MySQL repository.

Explore role based authorization by mapping roles to permissions, illustrating admin, teller, and customer access with restricted APIs and scalable, dynamic permissions for secure application access.

Explore spring security's inbuilt authorization tools by learning the granted authority interface and its simple granted authority implementation, which define and represent user roles and authorities.

Explain how to create and manage custom roles with a role model, map roles to users, and use simple granted authority in user details for spring security and database persistence.

Implement an admin controller in spring boot to expose admin-only endpoints for listing all users, updating user roles, and retrieving individual user details via a DTO.

Implement authorization to restrict admin actions in a spring security 6 setup, allowing only admins to access admin APIs via URL based restrictions or method level security.

Learn to manage access in Spring Boot with method level security using Spring Security annotations such as pre authorize, secured, pre filter, and post filter, including an admin check.

Explore method level security in Spring Security by applying access rules directly to methods using pre-authorize and secured annotations. Learn owner checks, post authorize, and pre filter for ownership-based access.

Enable method security in the security configuration, enable pre/post annotations, and apply pre-authorize with has role admin to restrict endpoints at controller or service level.

Configure url based restrictions with spring security using a security filter chain and request matchers to open api/auth and images publicly, restrict /admin to admins, and require authentication elsewhere.

Demonstrates enabling url based restrictions with spring security, protecting /api/admin endpoints by role, correcting role prefix, and using request matches to define public versus protected paths in a hands-on setup.

Clean up the security configuration by exposing the public endpoint and removing unnecessary settings. Choose annotation-based controller level security with pre authorized on the admin controller, and disable method-level security.

Compare method level security and the request matches approach in Spring Security, detailing annotations versus URL-based configuration. Learn pros and cons, granularity, and how to combine approaches for maintainable security.

Secure password practices protect user data by encoding passwords in the database and preventing unauthorized access, ensuring password security matters for compliance, trust, and robust authentication.

Learn how hashing converts a message into a distinct, one-way value using algorithms like bcrypt. Explore how salt adds randomness to each hash, boosting security for passwords and data transmission.

Explore the spring security password encoder interface, encoding raw passwords and validating matches, with upgradeEncoding; review implementations like Argon2, BCrypt, and Pbkdf2.

Explore inbuilt password encoders in Spring Security, including bcrypt password encoder, Pbkdf2 password encoder, script password encoder, Argon2 password encoder, and no op encoder, with bcrypt most recommended for production.

Encode passwords with a bcrypt password encoder in the security config, store encoded values in the database, and verify them using matches to secure authentication.

Discover how Spring Security filters intercept requests, and how to create custom filters for token-based authentication, rate limiting, IP whitelisting, geo blocking, and compliance logging.

Explore how Spring Security's default filter chain processes authentication, authorization, and CSRF protection in a defined order, managed by the filter chain proxy and virtual filter chain.

Explore the servlet filter lifecycle from init for initialization, through doFilter for request processing, to destroy for cleanup, all managed by the servlet container via the filter interface.

Explore inbuilt Spring Security filters, including the once per request filter and generic filter bean, and position custom filters in the security filter chain with addFilterBefore and addFilterAfter.

Create a custom logging filter in Spring Security and attach it to the filter chain, logging each request URI and response status before the authentication filter.

Create a Spring Security request validation filter that intercepts requests and reads the x-valid-request header; allow or reject the chain after the custom logging filter.

Explore advanced custom filter scenarios in Spring Security by combining multiple filters with correct order, implementing conditional filters based on request attributes, and enabling dynamic filter configurations via application properties.

Comment and disable the custom filters after learning to insert them before or after a filter in the chain, then delete the related files to keep the project clean.

Explain cross-site request forgery (CSRF), how authenticated sessions are exploited by malicious sites, and common impact scenarios like bank transfer attacks and unauthorized changes.

Learn how csrf protection uses a server-stored token linked to the user session to block unauthorized state-changing requests via hidden fields or headers.

Spring security enables CSRF protection by default, so APIs expect a CSRF token for state-changing requests. Built-in login forms include a hidden token; custom front ends must supply it.

Configure CSRF protection in Spring Security with a cookie CSRF token repository and expose a CSRF token API endpoint for front-end apps like React or Angular.

Enable CSRF bypass by ignoring request matches for api/auth/public. This lets public pages like about and contact be accessed without CSRF tokens while protected endpoints remain secured.