Unravel › Java concepts › Security

Learn these first

At a glance

1. 1A SecurityFilterChain bean configures the rules: http.authorizeHttpRequests(a -> a.requestMatchers("/public/**").permitAll().requestMatchers("/admin/**").hasRole("ADMIN").anyRequest().authenticated())Rules are checked in order; the first match wins.
2. 2Authentication filters read credentials (a form, a Basic header, a Bearer token) and create an Authentication objectA custom filter is added with addFilterBefore(myFilter, UsernamePasswordAuthenticationFilter.class).
3. 3The AuthenticationManager asks AuthenticationProviders to verify credentials, usually through a UserDetailsService and a PasswordEncoderOn success the SecurityContext holds the user for the rest of the request.
4. 4Failures are routed: a missing or invalid login gives the AuthenticationEntryPoint (401 or redirect to login), a logged-in user without rights gives the AccessDeniedHandler (403)

• Order and specificity of rules matter
• For stateless APIs set SessionCreationPolicy.STATELESS and disable CSRF only when authentication is not cookie based
• The DelegatingFilterProxy forwards each servlet request to FilterChainProxy, which picks the first matching SecurityFilterChain and runs its ordered filters (CORS, CSRF, logout, authentication filters, exception translation, authorization)

@Beanpublic SecurityFilterChain api(HttpSecurity http, JwtAuthFilter jwtFilter) throws Exception {    http.csrf(csrf -> csrf.disable())        .sessionManagement(s -> s.sessionCreationPolicy(SessionCreationPolicy.STATELESS))        .authorizeHttpRequests(a -> a            .requestMatchers("/auth/**", "/actuator/health").permitAll()            .requestMatchers("/admin/**").hasRole("ADMIN")            .anyRequest().authenticated())        .addFilterBefore(jwtFilter, UsernamePasswordAuthenticationFilter.class);    return http.build();}

1. line 4 uses sessionManagement, the core of Spring Security filter chain and authorization rules
2. line 5 uses authorizeHttpRequests, the core of Spring Security filter chain and authorization rules
3. line 6 uses requestMatchers, the core of Spring Security filter chain and authorization rules
4. line 7 uses requestMatchers, the core of Spring Security filter chain and authorization rules
5. line 8 uses anyRequest, the core of Spring Security filter chain and authorization rules
6. line 9 uses addFilterBefore, the core of Spring Security filter chain and authorization rules

How Unravel recognises it

When you paste code, Unravel looks for these signs of spring security filter chain and authorization rules. Spotting them yourself is a good habit when you read unfamiliar code:

• Types: SessionCreationPolicy UsernamePasswordAuthenticationFilter AuthenticationEntryPoint AccessDeniedHandler AuthenticationProvider GrantedAuthority SimpleGrantedAuthority UserDetails AuthenticationFailureHandler AuthenticationSuccessHandler DaoAuthenticationProvider WebSecurityCustomizer BadCredentialsException UsernameNotFoundException and 2 more
• Method calls: addFilterBefore() addFilterAfter() authorizeHttpRequests() requestMatchers() anyRequest() sessionManagement() authenticated() permitAll() hasRole() hasAuthority() formLogin() httpBasic()

Part of a learning path

• Security for backend developers · previous: Spring Security basics · next: JSON Web Tokens (JWT)

Related concepts

Builds on this