Springboot security secures our web application by default further we can customize
it according to the need of an application.
Spring Security is a framework which provides various security features like:
authentication, authorization to create secure Java Enterprise Applications. It
overcomes all the problems that come during creating non spring security
applications and manage new server environment for the application.
This framework targets two major areas of application are authentication and
authorization. Authentication is the process of knowing and identifying the user that
wants to access.
Authorization is the process to allow authority/permission to user perform actions in
the application.
Authentication: The identity of users are checked for providing the access to the
system
Filter: filter is an object that is invoked at the preprocessing and postprocessing of a
request
We can apply authorization to authorize web request, methods and access to
individual domain.
Spring Security framework supports wide range of authentication models. These
models either provided by third parties or framework itself. Spring Security supports
integration with all of these technologies
Advantages
Spring Security has numerous advantages. Some of that are given below.
o Comprehensive support for authentication and authorization.
o Protection against common tasks
o Servlet API integration
o Integration with Spring MVC
o Portability
o Java Configuration support
What Is the AuthenticationManager?
Simply put, the AuthenticationManager is the main strategy interface for
authentication.
If the principal of the input authentication is valid and
verified, AuthenticationManager returns an Authentication instance with
the authenticated flag set to true. Otherwise, if the principal is not valid, it will throw
an AuthenticationException. For the last case, it returns null if it can't decide.
ProviderManager is the default implementation of AuthenticationManager. It
delegates the authentication process to a list of AuthenticationProvider instances.
We can set up global or local AuthenticationManager if we create
a SecurityFilterChain bean. For a local AuthenticationManager, we could create
an AuthenticationManager bean,
accessing AuthenticationManagerBuilder through HttpSecurity.
Default Security Setup
In order to add security to our Spring Boot application, we need to add
the security starter dependency:
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-security</artifactId>
</dependency>
By default, the Authentication gets enabled for the Application. Also,
content negotiation is used to determine if basic or formLogin should
be used.
There are some predefined properties:
spring.security.user.name
spring.security.user.password
If we don't configure the password using the predefined
property spring.security.user.password and start the application, a default
password is randomly generated and printed in the console log:
Using default security password: c8be15de-4488-4490-9dc6-fab3f91435c6
After creating a bean of ScecurityFilterChain ,basic
authentication will be apply on our application..if we have
not add this method then form based authentication is apply on
our app
In form based authentication, we can be able to logout by
firing "localhost:8098/logout". And in form based
authentication we will get form on which we have to provide
spring security username and password access that particular
application
but in basic authentication,we can not be able to logout. And
in form based authentication we will get one pop up on which
we have to provide spring security username and password
access that particular application.
SecurityFilterChain=>Defines a filter chain which is capable
of being matched against an HttpServletRequest. in order to
decide whether it applies to that request.
UserDetailsService is a core interface
in Spring Security framework, which is
used to retrieve the user's
authentication and authorization
information.
CSRF attack
Cross-site Request Forgery (CSRF, sometimes also called XSRF) is an
attack that can trick an end-user using a web application to unknowingly
execute actions that can compromise security. To understand what
constitutes a CSRF attack, The standard recommendation is to have CSRF
protection enabled when we create a service that could be processed by
browsers. If the created service is exclusively for non-browser clients we
could disable CSRF protection.
