Spring Security 5.5 From Taxi to Takeoff
Why Stack Overflow recommends it
Stack Overflow users, mostly Spring Security team members answering questions, link it when asking how to set up OAuth2 resource servers, custom authorization, and secure endpoints in Spring Security 5.5 and later.
Recommended by 3 people across 5 different months, 2021 to 2022.
What it is
A SpringOne 2021 conference talk by three VMware engineers on the Spring Security team. It starts from an unsecured single-page app and builds up from HTTP basic auth to advanced cases, covering the new AuthorizationManager, newer OAuth support, and a backend-for-frontend setup.
What people said
Recommends Steve Riesenberg · 2021-09 · Stack Overflow · on “How to get JWT claims in a Spring Service or Controller”
@EnableResourceServer is part of spring-security-oauth which is end of life, and you should migrate away [LINK] as it's not recommended for new projects. Check out the reference for the new oauth2-resource-server [LINK] support, which should allow @AuthenticationPrincipal Jwt principal to work correctly in your controller. Also, see this repository's [LINK] SecurityConfiguration [LINK] , or follow along with the video presentation from SpringOne 2021 [this video] . When reading the reference docs, you would be most interested in overriding Spring Boot's configuration [LINK] to provide your own @Bean of JwtDecoder using your available public key. You can also optionally provide your own @Bean of J
Recommends Marcus Hert da Coregio · 2021-10 · Stack Overflow · on “Spring Security add/remove antMatchers and roles dynamically at runtime”
In Spring Security version 5.6 , which is in 5.6.0.M3 as of now, you can create an AuthorizationManager bean and define place your rules anywhere you want, like so: @Autowired private MyCustomAuthorizationManager access; @Override protected void configure(HttpSecurity http) throws Exception { http.authorizeRequests().access(access); } Or even better, you can define a SecurityFilterChain bean and make use of method parameter injection, instead of extending WebSecurityConfigurerAdapter : @Bean SecurityFilterChain app(HttpSecurity http, MyCustomAuthorizationManager access) throws Exception { ... http.authorizeRequests().access(access); ... return http.build(); } There is a great presentation [V
Recommends Steve Riesenberg · 2022-01 · Stack Overflow · on “How to secure resources of a different user”
See this section of our SpringOne 2021 [this video] presentation which shows how to protect an endpoint using advanced authorization scenarios like this with `@PreAuthorize` or `@PostAuthorize` annotations
Recommends Steve Riesenberg · 2022-07 · Stack Overflow · on “Is my Spring Boot controller secure when ithe may include id?”
In case it helps, the issue here is what's known as insecure direct object reference [LINK] . We discussed this in our SpringOne 2021 talk (starting here [this video] ) and some ways to mitigate it. You may want to review the whole presentation for context.
Recommends vgabor · 2022-12 · Stack Overflow · on “Spring authorization server OAuth2 login from my own login page”
As ch4mp said, it's best to leave all the authentication and authorization logic and pages to the Spring Authorization Server, it's pretty easy to customize and configure all the user accessible pages (login, authorize, etc...) with Thymeleaf, you only have to bring in your CSS to unify the design. There was a great demo [this video] in last year's Spring One which seems like something you'd like to achieve, you can find the code in this repo [LINK] . They used Spring Cloud Gateway [LINK] as a means to run the Angular SPA in the flights-web app, configuring it as the OAuth client. Following this path you can route all calls to your backend API through the gateway's WebClient .
Cites Erycoking · 2022-01 · Stack Overflow · on “Spring oauth2 authorization server: unable to logout users”
For anyone facing the same issue, I was not able to make it work when using angular directly as a client, but following the advice of @SteveRiesenberg I recommended using the backend-for-frontend pattern for your OAuth client I was able to make it work, therefore I advise anyone to use this pattern as it will help you avoid some of the pitfalls you would otherwise have faced as I did, plus it integrates seamlessly. For a head start you can refer to the sample project below created by the spring security team SpringOne 2021 repository [LINK] Also here is a link to the presentation Spring Security 5.5 From Taxi to Takeoff [this video]