Unravel › Java concepts › Security

Learn these first

At a glance

1. 1Roles: the user (resource owner), the client application, the authorization server (identity provider) and the resource server (API)Spring can play the client (oauth2Login), the resource server (oauth2ResourceServer) or, with Spring Authorization Server, the provider itself.
2. 2Authorization Code flow with PKCE for browsers and apps: redirect the user to the provider, they log in, the provider redirects back with a one-time code, and the client exchanges the code for an access token (and an ID token with OpenID Connect)
3. 3Client Credentials flow for service-to-service calls: the service authenticates with its own id and secret and receives a token with no user involvedOAuth2AuthorizedClientManager fetches and refreshes it for WebClient calls.
4. 4Scopes limit what a token may do; the API checks them (SCOPE_orders.read) or maps roles from claims

• Use the code flow with PKCE; the implicit flow and the password grant are deprecated because tokens leak through URLs or apps see the user password
• Validate tokens fully on the API: issuer, audience, signature, expiry
• Spring registers filters for the flows: OAuth2AuthorizationRequestRedirectFilter builds the redirect with a state value stored in the session to prevent CSRF, OAuth2LoginAuthenticationFilter receives the callback and exchanges the code, and BearerTokenAuthenticationFilter reads Bearer tokens for resource servers and verifies them through the JwtDecoder or…

@BeanSecurityFilterChain resourceServer(HttpSecurity http) throws Exception {    http.authorizeHttpRequests(a -> a            .requestMatchers(HttpMethod.GET, "/orders/**").hasAuthority("SCOPE_orders.read")            .anyRequest().authenticated())        .oauth2ResourceServer(o -> o.jwt(Customizer.withDefaults()));    return http.build();}

1. line 6 uses oauth2ResourceServer, the core of OAuth 2.0 and OpenID Connect login

How Unravel recognises it

When you paste code, Unravel looks for these signs of oauth 2.0 and openid connect login. Spotting them yourself is a good habit when you read unfamiliar code:

• Annotations: @RegisteredOAuth2AuthorizedClient
• Types: ClientRegistration ClientRegistrationRepository OAuth2AuthorizedClient OAuth2AuthorizedClientManager OAuth2User OidcUser OidcUserService DefaultOAuth2UserService OAuth2AuthenticationToken JwtDecoders OAuth2AuthorizationRequestResolver ServerOAuth2AuthorizedClientExchangeFilterFunction OAuth2AuthorizedClientService AuthorizationServerSettings and 4 more
• Method calls: oauth2Login() oauth2Client() oauth2ResourceServer()
• Configuration keys: spring.security.oauth2.client.registration spring.security.oauth2.resourceserver.jwt.issuer-uri

Part of a learning path

• Security for backend developers · previous: JSON Web Tokens (JWT) · next: CORS and CSRF protection

Related concepts