Scribd
Upload
14 views

Spring Security

The document provides an overview of authentication and authorization concepts in Spring Security. It describes common authentication components like AuthenticationFilter, AuthenticationManager and AuthenticationProvider. It also covers topics like setting up a UserDetailsService, PasswordEncoder and handling authentication success/failure. The document then discusses mocking users for testing and configuring security for REST APIs, web applications, and using OAuth and JWT.

Uploaded by

Shivam Juneja
Copyright
© © All Rights Reserved
Available Formats
Download as PPTX, PDF, TXT or read online on Scribd
14 views

Spring Security

The document provides an overview of authentication and authorization concepts in Spring Security. It describes common authentication components like AuthenticationFilter, AuthenticationManager and AuthenticationProvider. It also covers topics like setting up a UserDetailsService, PasswordEncoder and handling authentication success/failure. The document then discusses mocking users for testing and configuring security for REST APIs, web applications, and using OAuth and JWT.

Uploaded by

Shivam Juneja
Copyright
© © All Rights Reserved
Available Formats
Download as PPTX, PDF, TXT or read online on Scribd
You are on page 1/ 25

Authentication Filter Authentication Manager Authentication Provider

AuthenticationSuccessHandler

User Details Service Password Encoder


AuthenticationFailureHandler
Security Context
Security Security Testing
Authentication Authorization CSRF CORS

spring-security-test
Authentication Filter Authentication Manager Authentication Provider

AuthenticationSuccessHandler

User Details Service Password Encoder


AuthenticationFailureHandler
Security Context

Mocked User

@WithMockUser @WithUserDetails
Authentication Filter Authentication Manager Authentication Provider

Token Store
User Details Service Password Encoder

Authentication Filter

Role Info

Security Context
CSRF

Authentication Filter Authentication Manager Authentication Provider

CSRFFilter

User Details Service Password Encoder


Security Context

CSRFTokenRepository
CORS
Product Frontend

Access-Control-Allow-Origin
productfrontend.com
Access-Control-Allow-Methods

Access-Control-Allow-Headers Coupon API

couponapi.com

Coupon Frontend

couponfrontend.com
Secure REST APIs
UserDetailsService
Secure REST APIs
PasswordEncoder

WebSecurityConfig

URLs and Http Method


Secure WebApp

Create a Thymeleaf frontend

Secure it

Login and Logout


Oauth

Create Auth Server

Create a Resource Server

Access Token

Create Product
JWT

productauthserver
Generate KeyPair
Configure JWT
CSRF

Enable CSRF
Customise for POST only
CORS

Create a react app


Configure Cors Support
Customise it only for POST method
Security
Authentication and Authorisation

Banking
App

User
Role
Banking
You Basic Teller

Form Based
OAuth
Confidentiality Encrypt/Decrypt

Banking

Auth App

Https
You
Friendly Neighbourhood
Hacker
Integrity Signatures

AuthorizationServer

Token
ResourceServer
CSRF and CORS
Coupon Frontend

couonfrontend.com

Coupon Backend

couponfrontend.com
OAuth

Tax Filing

User Profile

Facebook

Drive

Google
Drive
Authorization
Server
User/Password

User/Password Token

User/Resource
Client
Owner

Token

Data

Resource
Server
Grant Types

Authorization code

Password

Client Credentials

Refresh Token
Authorization code
USER Client App Auth Server Resource Server

File Tax Returns

Talk to Auth Server

Please allow client app to access my tax data

User gave you access

Give me a token

Token

Please give me the tax data .Here is the Token

Tax Data
Password
USER Client App Auth Server Resource Server

File Tax Returns


These are my auth details

User Credentials

Token

Please give me the tax data .Here is the Token

Tax Data
Client Credentials
Client App Auth Server Resource Server

Client Credentials

Token

Please give me the tax data .Here is the Token

Tax Data
Refresh Token
USER Client App Auth Server Resource Server

File Tax Returns


These are my auth details

User Credentials

Token

Please give me the tax data .Here is the Token

Token Expired

Refresh Token

Token
Global Method Security

You might also like