Securing applications is super important in software development. When dealing with Java, Spring Security is a powerhouse tool. This article lays out the steps to secure applications using Spring Security for both authentication and authorization.

Spring Security Essential Overview

Spring Security is essentially a bunch of servlet filters that bring authentication and authorization to your web applications. It integrates effortlessly with frameworks like Spring Web MVC and Spring Boot. It also supports standards like OAuth2 and SAML. One great feature is its ability to automatically generate login and logout pages. Plus, it shields your app from common threats like CSRF (Cross-Site Request Forgery).

Getting Spring Security Ready

To kick things off with Spring Security, you need to plug in the necessary dependencies in your project. If you’re on Maven, slap this into your pom.xml file:

<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-security</artifactId>
</dependency>

Once this dependency is added, Spring Security auto-locks your application, requiring users to log in before they can see anything.

Authentication Basics

Authentication is all about verifying user identities. Spring Security offers various ways to set this up, including in-memory user storage and database-backed user storage.

In-Memory User Authentication

For simpler apps, storing user credentials in memory works just fine. Check out this example configuration:

@Configuration
public class SecurityConfig {
    @Bean
    public UserDetailsService users() {
        UserDetails user = User.withDefaultPasswordEncoder()
                .username("user")
                .password("password")
                .roles("USER")
                .build();
        UserDetails admin = User.withDefaultPasswordEncoder()
                .username("admin")
                .password("password")
                .roles("USER", "ADMIN")
                .build();
        return new InMemoryUserDetailsManager(user, admin);
    }

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
            .authorizeHttpRequests(auth -> auth
                .requestMatchers("/auth/welcome").permitAll()
                .requestMatchers("/auth/user/**").authenticated()
                .requestMatchers("/auth/admin/**").hasRole("ADMIN")
            )
            .formLogin(withDefaults());
        return http.build();
    }
}

Here, two users are defined: user and admin, each with their respective roles. The SecurityFilterChain config states which URLs need authentication and which roles can access what.

Database-Backed User Authentication

For more serious applications, storing user credentials in a database is the way to go. This involves creating a user entity, a repository for database interaction, and configuring Spring Security to work with this repository.

Here’s a straightforward example with Spring JPA:

@Entity
public class User {
    @Id
    @GeneratedValue(strategy = GenerationType.IDENTITY)
    private Long id;
    private String username;
    private String password;
    @ManyToMany(fetch = FetchType.EAGER)
    @JoinTable(
        name = "users_roles",
        joinColumns = @JoinColumn(name = "user_id"),
        inverseJoinColumns = @JoinColumn(name = "role_id")
    )
    private List<Role> roles;
    // Getters and setters
}

@Service
public class CustomUserDetailsService implements UserDetailsService {
    @Autowired
    private UserRepository userRepository;

    @Override
    public UserDetails loadUserByUsername(String username) throws UsernameNotFoundException {
        User user = userRepository.findByUsername(username)
                .orElseThrow(() -> new UsernameNotFoundException("User not found"));
        return new User(user.getUsername(), user.getPassword(), getAuthorities(user.getRoles()));
    }

    private List<GrantedAuthority> getAuthorities(List<Role> roles) {
        List<GrantedAuthority> authorities = new ArrayList<>();
        for (Role role : roles) {
            authorities.add(new SimpleGrantedAuthority(role.getName()));
        }
        return authorities;
    }
}

@Configuration
public class SecurityConfig {
    @Bean
    public UserDetailsService userDetailsService() {
        return new CustomUserDetailsService();
    }

    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
            .authorizeHttpRequests(auth -> auth
                .requestMatchers("/auth/welcome").permitAll()
                .requestMatchers("/auth/user/**").authenticated()
                .requestMatchers("/auth/admin/**").hasRole("ADMIN")
            )
            .formLogin(withDefaults());
        return http.build();
    }
}

Here, a User entity and a custom UserDetailsService load users from the database. The SecurityFilterChain setup is quite like the in-memory example.

Authorization Breakdown

Authorization controls what users can do after authentication. Spring Security offers several ways to set up authorization rules.

Role-Based Authorization

A common approach is role-based authorization. Roles are defined for users, and these roles restrict access to certain URLs or methods.

Here’s how you configure role-based authorization:

@Configuration
public class SecurityConfig {
    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
            .authorizeHttpRequests(auth -> auth
                .requestMatchers("/auth/welcome").permitAll()
                .requestMatchers("/auth/user/**").hasAnyRole("USER", "ADMIN")
                .requestMatchers("/auth/admin/**").hasRole("ADMIN")
            )
            .formLogin(withDefaults());
        return http.build();
    }
}

In this setup, /auth/user/** URLs are accessible to USER or ADMIN roles, while /auth/admin/** URLs are only for ADMIN users.

Method Security

Method security secures specific methods within your Spring beans using annotations.

Enable method security by adding @EnableGlobalMethodSecurity to your configuration class:

@Configuration
@EnableGlobalMethodSecurity(prePostEnabled = true, securedEnabled = true, jsr250Enabled = true)
public class SecurityConfig {
    // Other configurations
}

Now, use annotations like @PreAuthorize, @PostAuthorize, @Secured, and @RolesAllowed to secure your methods:

@Service
public class UserService {
    @PreAuthorize("hasRole('ADMIN')")
    public void deleteUser(Long id) {
        // Method implementation
    }

    @PostAuthorize("hasRole('USER') or hasRole('ADMIN')")
    public List<User> getUsers() {
        // Method implementation
    }
}

In this case, the deleteUser method is for ADMIN users only, while getUsers is for both USER and ADMIN.

Custom Authentication Manager

Sometimes, you need a custom authentication manager for specific authentication scenarios, like delegating to an external app via REST.

Here’s how you implement a custom authentication manager:

public class CustomAuthenticationManager implements AuthenticationManager {
    @Override
    public Authentication authenticate(Authentication authentication) throws AuthenticationException {
        String username = authentication.getName();
        String password = authentication.getCredentials().toString();

        // Code to make REST call here and check for OK or Unauthorized
        boolean isAuthenticated = makeRestCall(username, password);

        if (isAuthenticated) {
            return new UsernamePasswordAuthenticationToken(username, password, getAuthorities(username));
        } else {
            throw new BadCredentialsException("Invalid credentials");
        }
    }

    private List<GrantedAuthority> getAuthorities(String username) {
        // Logic to retrieve authorities based on the username
        return getAuthoritiesFromDatabase(username);
    }
}

@Configuration
public class SecurityConfig {
    @Bean
    public AuthenticationManager authenticationManager() {
        return new CustomAuthenticationManager();
    }

    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
            .authenticationManager(authenticationManager())
            .authorizeHttpRequests(auth -> auth
                .requestMatchers("/auth/welcome").permitAll()
                .requestMatchers("/auth/user/**").authenticated()
                .requestMatchers("/auth/admin/**").hasRole("ADMIN")
            )
            .formLogin(withDefaults());
        return http.build();
    }
}

Here, CustomAuthenticationManager handles the authentication by making a REST call to an external app. The SecurityFilterChain setup uses this manager.

Customizing Error and Login Pages

Spring Security lets you tailor error and login pages to match your app’s needs.

Custom Error Pages

Overriding default error handling behavior lets you set custom error pages:

@Configuration
public class SecurityConfig {
    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
            .exceptionHandling(exception -> exception
                .accessDeniedPage("/access-denied")
                .authenticationEntryPoint(new LoginUrlAuthenticationEntryPoint("/login"))
            );
        return http.build();
    }
}

Here, accessDeniedPage sets a custom URL for denied access errors, and authenticationEntryPoint sets a custom login URL.

Custom Login Screen

You can personalize the login screen by using a custom login page:

@Configuration
public class SecurityConfig {
    @Bean
    public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
        http
            .formLogin(form -> form
                .loginPage("/custom-login")
                .usernameParameter("username")
                .passwordParameter("password")
                .defaultSuccessUrl("/welcome", true)
            );
        return http.build();
    }
}

Here, loginPage sets a custom login page URL, and defaultSuccessUrl sets the URL to redirect after successful login.

Password Encoding

Spring Security supports different password encoders to securely store passwords. Here’s how you configure a password encoder:

@Configuration
public class SecurityConfig {
    @Bean
    public PasswordEncoder passwordEncoder() {
        return new BCryptPasswordEncoder();
    }
}

In this case, BCryptPasswordEncoder is used to encode passwords. Other options include ScryptPasswordEncoder, Argon2PasswordEncoder, and Pbkdf2PasswordEncoder, depending on your security needs.

Conclusion

Securing your applications with Spring Security involves multiple steps, from setting up the framework to configuring authentication and authorization rules. By understanding and implementing these concepts correctly, you ensure that your applications are secure and resistant to common exploits. Whether using in-memory or database-backed user storage, Spring Security equips you with the necessary tools to build strong and secure applications.