iSharkFly-Docs/java-tutorials
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[JAVA-33634] Split-or-move-spring-security-core-2-module (#16447)

Browse Source
This commit is contained in:
vunamtien
2024-04-23 23:23:26 +07:00
committed by GitHub
parent 4a139b7188
commit 9177009ab6
16 changed files with 102 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
spring-security-modules/spring-security-core-2/README.md
-3
View File
@@ -5,11 +5,8 @@ This module contains articles about core Spring Security
### Relevant Articles:
- [Handle Spring Security Exceptions](https://www.baeldung.com/spring-security-exceptions)
- [Handle Spring Security Exceptions With @ExceptionHandler](https://www.baeldung.com/spring-security-exceptionhandler)
- [Prevent Cross-Site Scripting (XSS) in a Spring Application](https://www.baeldung.com/spring-prevent-xss)
- [Guide to the AuthenticationManagerResolver in Spring Security](https://www.baeldung.com/spring-security-authenticationmanagerresolver)
- [A Custom Spring SecurityConfigurer](https://www.baeldung.com/spring-security-custom-configurer)
- [HttpSecurity vs. WebSecurity in Spring Security](https://www.baeldung.com/spring-security-httpsecurity-vs-websecurity)
- [Spring Security AuthorizationManager](https://www.baeldung.com/spring-security-authorizationmanager)
- [Migrate Application from Spring Security 5 to Spring Security 6/Spring Boot 3](https://www.baeldung.com/spring-security-migrate-5-to-6)
- [Creating a Spring Security Key for Signing a JWT Token](https://www.baeldung.com/spring-security-sign-jwt-token)
spring-security-modules/spring-security-core-2/src/main/java/com/baeldung/authorizationmanager/DemoController.java
-28
View File
@@ -1,28 +0,0 @@
package com.baeldung.authorizationmanager;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RestController;
@RestController
public class DemoController {
@GetMapping("/anonymous")
public String anonymousResource() {
return "anonymous";
}
@GetMapping("/adminonly")
public String adminResource() {
return "admin only";
}
@GetMapping("/authororeditor")
public String authorOrEditorResource() {
return "author or editor";
}
@GetMapping("/custom")
public String customResource() {
return "custom";
}
}
spring-security-modules/spring-security-core-2/src/main/java/com/baeldung/authorizationmanager/DemoSecurityConfig.java
-65
View File
@@ -1,65 +0,0 @@
package com.baeldung.authorizationmanager;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.authorization.AuthorizationDecision;
import org.springframework.security.authorization.AuthorizationManager;
import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.provisioning.InMemoryUserDetailsManager;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.security.web.access.intercept.RequestAuthorizationContext;
import java.util.Random;
import java.util.function.Supplier;
import static org.springframework.security.config.Customizer.withDefaults;
@Configuration
@EnableMethodSecurity
public class DemoSecurityConfig {
@Bean
SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
http.authorizeHttpRequests((authorize) -> authorize
.requestMatchers("/custom/**").access(customAuthManager())
.requestMatchers("/adminonly/**").hasRole("ADMIN")
.requestMatchers("/editororauthor/**").hasAnyRole("EDITOR","AUTHOR")
.anyRequest().permitAll())
.formLogin(withDefaults());
return http.build();
}
@Bean
public InMemoryUserDetailsManager userDetailsService() {
UserDetails admin = User.withUsername("admin")
.password(passwordEncoder().encode("admin"))
.roles("ADMIN")
.build();
UserDetails author = User.withUsername("author")
.password(passwordEncoder().encode("author"))
.roles("AUTHOR")
.build();
UserDetails editor = User.withUsername("editor")
.password(passwordEncoder().encode("editor"))
.roles("EDITOR")
.build();
return new InMemoryUserDetailsManager(admin, author, editor);
}
@Bean
PasswordEncoder passwordEncoder() {
return new BCryptPasswordEncoder();
}
@Bean
AuthorizationManager<RequestAuthorizationContext> customAuthManager() {
return (authentication, object) -> new AuthorizationDecision(new Random().nextBoolean());
}
}
spring-security-modules/spring-security-core-2/src/main/java/com/baeldung/authorizationmanager/SpringSecurityAuthManagerDemoApplication.java
-14
View File
@@ -1,14 +0,0 @@
package com.baeldung.authorizationmanager;
import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
@SpringBootApplication
public class SpringSecurityAuthManagerDemoApplication {
public static void main(String[] args) {
SpringApplication.run(SpringSecurityAuthManagerDemoApplication.class, args);
}
}
spring-security-modules/spring-security-core-2/src/main/java/com/baeldung/dsl/ClientErrorLoggingConfigurer.java
-32
View File
@@ -1,32 +0,0 @@
package com.baeldung.dsl;
import org.springframework.http.HttpStatus;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer;
import org.springframework.security.web.access.intercept.AuthorizationFilter;
import java.util.List;
public class ClientErrorLoggingConfigurer extends AbstractHttpConfigurer<ClientErrorLoggingConfigurer, HttpSecurity> {
private List<HttpStatus> errorCodes;
public ClientErrorLoggingConfigurer(List<HttpStatus> errorCodes) {
this.errorCodes = errorCodes;
}
public ClientErrorLoggingConfigurer() {
}
@Override
public void init(HttpSecurity http) throws Exception {
// initialization code
}
@Override
public void configure(HttpSecurity http) throws Exception {
http.addFilterAfter(new ClientErrorLoggingFilter(errorCodes), AuthorizationFilter.class);
}
}
spring-security-modules/spring-security-core-2/src/main/java/com/baeldung/dsl/ClientErrorLoggingFilter.java
-56
View File
@@ -1,56 +0,0 @@
package com.baeldung.dsl;
import jakarta.servlet.FilterChain;
import jakarta.servlet.ServletException;
import jakarta.servlet.ServletRequest;
import jakarta.servlet.ServletResponse;
import jakarta.servlet.http.HttpServletResponse;
import org.apache.logging.log4j.LogManager;
import org.apache.logging.log4j.Logger;
import org.springframework.http.HttpStatus;
import org.springframework.security.core.Authentication;
import org.springframework.security.core.context.SecurityContextHolder;
import org.springframework.web.filter.GenericFilterBean;
import java.io.IOException;
import java.util.List;
public class ClientErrorLoggingFilter extends GenericFilterBean {
private static final Logger logger = LogManager.getLogger(ClientErrorLoggingFilter.class);
private List<HttpStatus> errorCodes;
public ClientErrorLoggingFilter(List<HttpStatus> errorCodes) {
this.errorCodes = errorCodes;
}
@Override
public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException {
Authentication auth = SecurityContextHolder.getContext()
.getAuthentication();
if (auth == null) {
chain.doFilter(request, response);
return;
}
int status = ((HttpServletResponse) response).getStatus();
if (status < 400 || status >= 500) {
chain.doFilter(request, response);
return;
}
if (errorCodes == null) {
logger.debug("User " + auth.getName() + " encountered error " + status);
} else {
if (errorCodes.stream()
.anyMatch(s -> s.value() == status)) {
logger.debug("User " + auth.getName() + " encountered error " + status);
}
}
chain.doFilter(request, response);
}
}
spring-security-modules/spring-security-core-2/src/main/java/com/baeldung/dsl/CustomConfigurerApplication.java
-13
View File
@@ -1,13 +0,0 @@
package com.baeldung.dsl;
import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
@SpringBootApplication
public class CustomConfigurerApplication {
public static void main(String[] args) {
SpringApplication.run(CustomConfigurerApplication.class, args);
}
}
spring-security-modules/spring-security-core-2/src/main/java/com/baeldung/dsl/MyController.java
-14
View File
@@ -1,14 +0,0 @@
package com.baeldung.dsl;
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RestController;
@RestController
public class MyController {
@GetMapping("/admin")
public String getAdminPage() {
return "Hello Admin";
}
}
spring-security-modules/spring-security-core-2/src/main/java/com/baeldung/dsl/SecurityConfig.java
-52
View File
@@ -1,52 +0,0 @@
package com.baeldung.dsl;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.Customizer;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.core.userdetails.User;
import org.springframework.security.core.userdetails.UserDetails;
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
import org.springframework.security.crypto.password.PasswordEncoder;
import org.springframework.security.provisioning.InMemoryUserDetailsManager;
import org.springframework.security.web.SecurityFilterChain;
@Configuration
public class SecurityConfig {
@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
http.authorizeHttpRequests(auth -> auth
.requestMatchers("/admin*")
.hasAnyRole("ADMIN")
.anyRequest()
.authenticated())
.formLogin(Customizer.withDefaults())
.apply(clientErrorLogging());
return http.build();
}
@Bean
public ClientErrorLoggingConfigurer clientErrorLogging() {
return new ClientErrorLoggingConfigurer();
}
@Bean
public InMemoryUserDetailsManager userDetailsService() {
UserDetails user1 = User.withUsername("user1")
.password(passwordEncoder().encode("user"))
.roles("USER")
.build();
UserDetails admin = User.withUsername("admin")
.password(passwordEncoder().encode("admin"))
.roles("ADMIN")
.build();
return new InMemoryUserDetailsManager(user1, admin);
}
@Bean
public PasswordEncoder passwordEncoder() {
return new BCryptPasswordEncoder();
}
}
spring-security-modules/spring-security-core-2/src/main/java/com/baeldung/xss/Application.java
-14
View File
@@ -1,14 +0,0 @@
package com.baeldung.xss;
import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
@SpringBootApplication
@EnableWebSecurity
public class Application {
public static void main(String[] args) {
SpringApplication.run(Application.class, args);
}
}
spring-security-modules/spring-security-core-2/src/main/java/com/baeldung/xss/SecurityConf.java
-31
View File
@@ -1,31 +0,0 @@
package com.baeldung.xss;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.security.config.Customizer;
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
import org.springframework.security.config.annotation.web.configuration.WebSecurityCustomizer;
import org.springframework.security.web.SecurityFilterChain;
import org.springframework.security.web.header.writers.XXssProtectionHeaderWriter;
@Configuration
public class SecurityConf {
@Bean
public WebSecurityCustomizer webSecurityCustomizer() {
// Ignoring here is only for this example. Normally people would apply their own authentication/authorization policies
return (web) -> web.ignoring()
.requestMatchers("/**");
}
@Bean
public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
http.headers(headers ->
headers.xssProtection(
xss -> xss.headerValue(XXssProtectionHeaderWriter.HeaderValue.ENABLED_MODE_BLOCK)
).contentSecurityPolicy(
cps -> cps.policyDirectives("script-src 'self'")
));
return http.build();
}
}
spring-security-modules/spring-security-core-2/src/test/java/com/baeldung/SpringContextTest.java
-18
View File
@@ -1,18 +0,0 @@
package com.baeldung;
import org.junit.Test;
import org.junit.runner.RunWith;
import org.springframework.boot.test.context.SpringBootTest;
import org.springframework.test.context.junit4.SpringRunner;
import com.baeldung.dsl.CustomConfigurerApplication;
@RunWith(SpringRunner.class)
@SpringBootTest(classes = CustomConfigurerApplication.class)
public class SpringContextTest {
@Test
public void whenSpringContextIsBootstrapped_thenNoExceptions() {
}
}