= Hello Spring Security with Boot
:author: Joe Grandja
:starter-appname: insecure
:starter-config-type: boot
:completed-appname: helloworld
:completed-config-type: boot
:include-dir: _includes
:hello-include-dir: _hello-includes

This guide provides instructions on how to add Spring Security to an existing Spring Boot application.

include::{include-dir}/setting-up-the-sample-boot.asc[]

Verify the application is working by navigating to http://localhost:8080/

Click on the *_secured pages_* link and verify the page states *TODO Secure this*

Once you have verified the application runs, stop the application server using the following steps:

* In the _Boot Dashboard_ view select the running application
* Click the stop button (a red square) to stop the application

include::{hello-include-dir}/secure-the-application-boot.asc[]

include::{hello-include-dir}/exploring-the-secured-application-boot.asc[]

==== Displaying the user name

Now that we have authenticated, let's update the application to display the username. Update the complete content of */index.html* with the following:

.src/main/resources/templates/index.html
[source,html]
----
<!DOCTYPE html>
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:th="http://www.thymeleaf.org" xmlns:sec="http://www.thymeleaf.org/thymeleaf-extras-springsecurity4">
    <head>
        <title>Hello Spring Security</title>
        <meta charset="utf-8" />
        <link rel="stylesheet" href="/css/main.css" th:href="@{/css/main.css}" />
    </head>
    <body>
        <div th:fragment="logout" class="logout" sec:authorize="isAuthenticated()">		<1>
            Logged in user: <span sec:authentication="name"></span> |					<2>
            Roles: <span sec:authentication="principal.authorities"></span>				<3>
            <div>
                <form action="#" th:action="@{/logout}" method="post">					<4>
                    <input type="submit" value="Logout" />
                </form>
            </div>
        </div>
        <h1>Hello Spring Security</h1>
        <p>This is an unsecured page, but you can access the secured pages after authenticating.</p>
        <ul>
            <li>Go to the <a href="/user/index" th:href="@{/user/index}">secured pages</a></li>
        </ul>
    </body>
</html>
----

NOTE: We are using http://www.thymeleaf.org/[Thymeleaf] for our view template engine and
https://github.com/thymeleaf/thymeleaf-extras-springsecurity[Thymeleaf - Spring Security integration modules]
in order to utilize the _sec:authentication_ and _sec:authorize_ attributes.

<1> Displays the Thymeleaf fragment (DOM Node) if the current user has been authenticated.
<2> Displays the name of the currently authenticated principal.
<3> Displays the authorities of the currently authenticated principal.
<4> The logout form.

TIP: Thymeleaf will automatically add the CSRF token to our logout form. If we were not using Thymleaf or Spring MVCs taglib we could also manually add the CSRF token using `<input type="hidden" name="${_csrf.parameterName}" value="${_csrf.token}"/>`.

==== Update the _secured_ page

The last step is to update the _secured_ page to also display the currently authenticated principal. Update the complete content of */user/index.html* with the following:

.src/main/resources/templates/user/index.html
[source,html]
----
<!DOCTYPE html>
<html xmlns="http://www.w3.org/1999/xhtml" xmlns:th="http://www.thymeleaf.org">
    <head>
        <title>Hello Spring Security</title>
        <meta charset="utf-8" />
        <link rel="stylesheet" href="/css/main.css" th:href="@{/css/main.css}" />
    </head>
    <body>
        <div th:substituteby="index::logout"></div>
        <h1>This is a secured page!</h1>
        <p><a href="/index" th:href="@{/index}">Back to home page</a></p>
    </body>
</html>
----

Start up the server and try visiting http://localhost:8080/ to see the updates to our application.

== Conclusion

You should now know how to secure your application using Spring Security with an existing Spring Boot application . To learn more refer to the link:index.html[Spring Security Guides index page].
