Spring security basics

 

 

Hello geeks, here I come up with another blog series on spring-security, Where I am going to explore some of the basic concepts behind the spring boot security as well as hands-on examples. 

 

This is going to be the first blog in this series on spring boot security, so please follow all blogs in order to better understanding the concepts.

Before we begin to deep dive into spring-security, we need to understand why we need application-level security. Since we have already OS-level security, server-level security then why we need this application-level security. The answer is pretty much self-explanatory, since we are developing APIs in Java, these endpoints are explicitly exposed to end-user that's why all the already applied security on OS-level and server are forcefully bypassed here.

 

So, all in all, we need another application-level security here. For this spring security came to the rescue here.

 

 

 

 

 

In real spring security is a filter standing between your application and all the incoming request coming to the application server. It verifies each and every request made to the server and validates it, is it authenticated and authorized to access the requested endpoint on the basis of some pre-defined authorized and authentication rules.

 

Also Read: Creating Asynchronous Methods in Spring Boot

 

So, Spring security is an application framework that provides:

•  Login and logout functionality.
•  Allow/block access to URLs to users.
•  Allow/block access to URLs to logged in users and with certain roles(access control).

It handles lots of vulnerabilities on its own by providing any extra configurations, like Session fixations, click jacking, click site and request forgery.
 

Types of authentication that can be achieved using spring boot are as follows:-

 

• Username/password-based authentication
• SSO/Okta/LDAP (Single sign-on authorization)
• App-level authorization
• Intra App authorization using OAuth
• Micro-Service security
• Method level security

 

Also Read: Reading a CSV file in java

 

5 core concepts in spring-security

•  Authentication: It is a way to uniquely identifies the requesting user by any one of the following methods:-
  
  * Knowledge-based authentication by providing user name/password or pin or question ( like pet name etc.) that are actually provided by end-user at the time of registration.
  * Possession base authentication is something like only you are at the possession of providing that information like OTP, access card, etc, that only you can have this.
  * Multi-factor authentication is the combination of both the above knowledge base and possession-based authentication to make sign-in more secure.
   
• Authorization: It is a boolean check that confirms that is requested user is eligible to perform the requested operation or not.
   
• Principal: It is the environment or preferences a user has configured to his account, you can things principal as currently logged in user. where he has configured things according to his preferences, this may be different for a different user account.
   
• Granted Authority: It is a list of authorized activities to a particular user account. Like a user can view his balance, language preferences, transaction history. But he is not allowed to delete a particular transaction history.
   
• Role: It is the granted authority, or you can say it is a collection of granted authority based on the certain positions like admin has approx all granted authority present into the system but a user has not. So admin and users are two different roles here.
  
  That's all required core concepts to dive into spring-security, in the next blog I will implement a sample spring boot service using spring security. 
  
  Hope you enjoyed this blog and find this useful.

Also Read: Sending HTML template based email in spring boot using a free marker

Why You Should Choose Oodles For SaaS Product Development?

We are a 360-degree software development company that provides cross-platform SaaS app development services to address varied software project requirements. We have an experienced team of Java, PHP, and Python developers who use advanced frameworks, tools, and SDKs to build scalable web and mobile applications with custom features. For more detail, reach us out at [email protected].