Spring Security
What is Spring Security?
Spring Security is a framework that enables a programmer to impose security restrictions on Spring-framework–based Web applications through Java Enterprise Edition components. Also, it is a library that can be used and customized as per the programmer’s needs. The greatest advantage of this framework is that it is powerful yet highly customizable in its implementation. Although it follows Spring’s convention over configuration, programmers can choose between default provisions or customizing them according to their needs.
Spring Security is centered round two core concepts:
- Authentication: It is the process of knowing and identifying the user that wants to access.
- Authorization: It is the process to allow authority to perform actions in the application. We can apply authorization to authorize web request, methods and access to individual domain.
Features Spring Security Offers:
- Supports authentication and authorization in a flexible and comprehensive manner.
- Detection and prevention of attacks including session fixation, click jacking, cross-site request forgery, etc.
- Integrate with Servlet API.
- Offers optional integration with Spring Web MVC (Model-View-Controller).
- Allows Single Sign-On so that users can access multiple applications with just one account (username and password).
Components of Spring Security Architecture
- Authentication Filter
- Authentication Manager
- Authentication Provider
- User Details Service
- Password Encoder
- Spring Security Context
- Form-Login
- Login with a Database
AuthenticationFilter: Intercepts requests and attempts to authenticate them. It converts the request to an Authentication Object and delegates the authentication to the AuthenticationManager.
Get Shahazada Talib’s stories in your inbox
Join Medium for free to get updates from this writer.
AuthenticationManager: It uses the authenticate() method to authenticate the request. The authenticate() method performs the authentication and returns an Authentication Object on successful authentication or throws an AuthenticationException in case of authentication failure.
AuthenticationProvider: The AuthenticationManager is implemented by the ProviderManager which delegates the process to one or more AuthenticationProvider instances. Any class implementing the AuthenticationProvider interface must implement the methods — authenticate().
UserDetailsService: It is one of the core interfaces of Spring Security. The authentication of any request mostly depends on the implementation of the UserDetailsService interface. It is most commonly used in database-backed authentication to retrieve user data.
Password Encoder: This encodes the user’s password using one of its many implementations. The most common of its implementations is the BCryptPasswordEncoder.
Spring SecurityContext: This is where the details of the currently authenticated user are stored on successful authentication. The authentication object is then available throughout the application for the session. So, if we need the username or any other user details, we need to get the SecurityContext.
