== Securing the application

Before securing your application, it is important to ensure that the existing application works as we did in <<running-the-{starter-appname}-application>>. Now that the application runs without security, we are ready to add security to our application. This section demonstrates the minimal steps to add Spring Security to our application.

=== Updating your dependencies

include::../{include-maven-repository}[]

In order to use Spring Security you must add the necessary dependencies. For the sample we will add the following Spring Security dependencies:

.pom.xml
[source,xml]
[subs="verbatim,attributes"]
----
<dependencies>
  <!-- ... other dependency elements ... -->
  <dependency>
    <groupId>org.springframework.security</groupId>
    <artifactId>spring-security-web</artifactId>
    <version>{spring-security-version}</version>
  </dependency>
  <dependency>
    <groupId>org.springframework.security</groupId>
    <artifactId>spring-security-config</artifactId>
    <version>{spring-security-version}</version>
  </dependency>
</dependencies>
----

After you have completed this, you need to ensure that STS knows about the updated dependencies by:

* Right click on the _spring-security-samples-{starter-config-type}-{starter-appname}_ application
* Select *Maven->Update project...*
* Ensure the project is selected, and click *OK*

=== Creating your Spring Security configuration

The next step is to create a Spring Security configuration.

* In the Package Explorer view, right click on the folder _src/main/webapp_
* Select *New->Folder*
* Enter _WEB-INF/spring_ for the *Folder name*
* Then right click on the new folder _WEB-INF/spring_
* Select *New->File*
* Enter _security.xml_ for the *File name*
* Click *Finish*
* Replace the contents of the file with the following:

[[security-config-xml]]
.src/main/webapp/WEB-INF/spring/security.xml
[source,xml]
----
<b:beans xmlns="http://www.springframework.org/schema/security"
		 xmlns:b="http://www.springframework.org/schema/beans"
		 xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
		 xsi:schemaLocation="http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans.xsd
						http://www.springframework.org/schema/security http://www.springframework.org/schema/security/spring-security.xsd">

	<http />

	<user-service>
		<user name="user" password="password" authorities="ROLE_USER" />
	</user-service>

</b:beans>
----

[[servlet-api-integration]]
The <<security-config-xml,security-config-xml>> will:

* Require authentication to every URL in your application
* Generate a login form for you
* Allow the user with the *Username* _user_ and the *Password* _password_ to authenticate with form based authentication
* Allow the user to logout
* http://en.wikipedia.org/wiki/Cross-site_request_forgery[CSRF attack] prevention
* http://en.wikipedia.org/wiki/Session_fixation[Session Fixation] protection
* Security Header integration
** http://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security[HTTP Strict Transport Security] for secure requests
** http://msdn.microsoft.com/en-us/library/ie/gg622941(v=vs.85).aspx[X-Content-Type-Options] integration
** Cache Control (can be overridden later by your application to allow caching of your static resources)
** http://msdn.microsoft.com/en-us/library/dd565647(v=vs.85).aspx[X-XSS-Protection] integration
** X-Frame-Options integration to help prevent http://en.wikipedia.org/wiki/Clickjacking[Clickjacking]
* Integrate with the following Servlet API methods
** http://docs.oracle.com/javaee/6/api/javax/servlet/http/HttpServletRequest.html#getRemoteUser()[HttpServletRequest#getRemoteUser()]
** http://docs.oracle.com/javaee/6/api/javax/servlet/http/HttpServletRequest.html#getUserPrincipal()[HttpServletRequest.html#getUserPrincipal()]
** http://docs.oracle.com/javaee/6/api/javax/servlet/http/HttpServletRequest.html#isUserInRole(java.lang.String)[HttpServletRequest.html#isUserInRole(java.lang.String)]
** http://docs.oracle.com/javaee/6/api/javax/servlet/http/HttpServletRequest.html#login(java.lang.String,%20java.lang.String)[HttpServletRequest.html#login(java.lang.String, java.lang.String)]
** http://docs.oracle.com/javaee/6/api/javax/servlet/http/HttpServletRequest.html#logout()[HttpServletRequest.html#logout()]

