eazybytes / springsecurity6

Spring Security Zero to Master along with JWT, OAUTH2 - Code Examples

Spring Security Zero to Master along with JWT,OAUTH2

'Spring Security Zero to Master' course will help in understanding the Spring Security Architecture, important packages, interfaces, classes inside it which handles authentication and authorization requests in the web applications. It also covers most common security related topics like CORs, CSRF, JWT, OAUTH2, password management, method level security, user, roles & authorities management inside web applications.

Topics covered in the course

• Spring Security framework details and it features
• How to adapt security for a Java web application using Spring Security
• Password Management in Spring Security with PasswordEncoders
• Deep dive about encoding, encryption and hashing
• What is CSRF, CORS and how to address them
• What is Authentication and Authorization. How they are different from each other.
• Securing endpoint URLs inside web applications using Ant, MVC & Regex Matchers
• Filters in Spring Security and how to write own custom filters
• Deep dive about JWT (JSON Web Tokens) and the role of them inside Authentication & Authorization
• Deep dive about OAUTH2 and various grant type flows inside OAUTH2.
• Deep dive about OpenID Connect & how it is related to OAUTH2
• Applying authorization rules using roles, authorities inside a web application using Spring Security
• Method level security in web/non-web applications
• Social Login integrations into web applications
• Set up of Authorization Server using KeyCloak

Pre-requisite for the course

• Good understanding on Java and Spring concepts
• Basic understanding on SpringBoot & REST services is a bonus but not mandatory
• Interest to learn and explore about Spring Security

Important Links

• Spring website to generate projects - https://start.spring.io/
• Spring Website - https://spring.io/
• Spring Projects website - https://spring.io/projects
• Spring Boot properties - https://docs.spring.io/spring-boot/docs/current/reference/html/application-properties.html
• AWS website - https://aws.amazon.com/
• SQLECTRON website - https://sqlectron.github.io
• Free MySQL DB website - https://www.freemysqlhosting.net
• OAuth2 Website - https://oauth.net/2/
• OAuth2 playground - https://www.oauth.com/playground/
• KeyCloak website - https://www.keycloak.org
• KeyCloak Download page - https://www.keycloak.org/downloads
• KeyCloak setup - https://www.keycloak.org/getting-started/getting-started-zip
• KeyCloak guides - https://www.keycloak.org/guides
• KeyCloak Well known APIs - http://localhost:8180/realms/eazybankdev/.well-known/openid-configuration
• Angular Keycloak library - https://www.npmjs.com/package/keycloak-angular
• Keycloak official documentation - https://www.keycloak.org/documentation
• Keycloak Admin REST APIs - https://www.keycloak.org/docs-api/19.0.2/rest-api/index.html

springsecurity6's Issues

Getting error in running the Spring Boot application, for the "SecurityFilterChain defaultSecurityFilterChain(HttpSecurity http) " method

Hi,
For the code in -> Link

I am getting the following error:
org.springframework.beans.factory.BeanCreationException: Error creating bean with name 'defaultSecurityFilterChain' defined in class path resource [com/rg/EazyBank/config/ProjectSecurityConfig.class]: Failed to instantiate [org.springframework.security.web.SecurityFilterChain]: Factory method 'defaultSecurityFilterChain' threw exception with message: This method cannot decide whether these patterns are Spring MVC patterns or not. If this endpoint is a Spring MVC endpoint, please use requestMatchers(MvcRequestMatcher); otherwise, please use requestMatchers(AntPathRequestMatcher).

Here is my pom.xml

`

4.0.0

org.springframework.boot
spring-boot-starter-parent
3.1.2


com.rg
EazyBank
0.0.1-SNAPSHOT
EazyBank
Demo project for Spring Boot and Spring Security

<java.version>17</java.version>



org.springframework.boot
spring-boot-starter-data-jpa


org.springframework.boot
spring-boot-starter-security


org.springframework.boot
spring-boot-starter-web

	<dependency>
		<groupId>org.springframework.boot</groupId>
		<artifactId>spring-boot-devtools</artifactId>
		<scope>runtime</scope>
		<optional>true</optional>
	</dependency>
	<dependency>
		<groupId>com.h2database</groupId>
		<artifactId>h2</artifactId>
		<scope>runtime</scope>
	</dependency>
	<dependency>
		<groupId>org.projectlombok</groupId>
		<artifactId>lombok</artifactId>
		<optional>true</optional>
	</dependency>
	<dependency>
		<groupId>org.springframework.boot</groupId>
		<artifactId>spring-boot-starter-test</artifactId>
		<scope>test</scope>
	</dependency>
	<dependency>
		<groupId>org.springframework.security</groupId>
		<artifactId>spring-security-test</artifactId>
		<scope>test</scope>
	</dependency>
</dependencies>

<build>
	<plugins>
		<plugin>
			<groupId>org.springframework.boot</groupId>
			<artifactId>spring-boot-maven-plugin</artifactId>
			<configuration>
				<excludes>
					<exclude>
						<groupId>org.projectlombok</groupId>
						<artifactId>lombok</artifactId>
					</exclude>
				</excludes>
			</configuration>
		</plugin>
	</plugins>
</build>

`

can you please help me with this.

Thanks

Ss

Section 5 Project is not working. It gives 403

I have created same project for customAuthenticationProvider but it doesn't give response after authentication.

Deprecated methods in JWTTokenGeneratorFilter.java and JWTTokenValidatorFilter.java

Replaced deprecated methods with new ones on JWT token generation and validation process. I opened a pull request with these changes #4